{ "Event": { "published": true, "date": "2021-08-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-24", "timestamp": 1629849781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c669aca4-0fbf-40cd-96d8-268c71391171", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e0e855-0497-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ServHelper)", "timestamp": 1629781068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781068, "uuid": "b4aff84c-d4eb-4d62-bac6-1d272d63ff56", "comment": "Malware payload (ServHelper)", "value": "1aa9dda1b9b413444b0668500611c7f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781068, "uuid": "decd0f5c-b6c1-4c2d-8ef6-18baa8615c21", "comment": "Malware payload (ServHelper)", "value": "02031c62d916cdd41d26a271e93ec5b06eabfa910187207b02ead07fd480c2a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781068, "uuid": "4e22afc0-d031-4569-9502-55a5498738f5", "comment": "Malware payload (ServHelper)", "value": "d980ac83bf107df1a7510ad94304a7e364d927a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781068, "uuid": "10e4bb88-c463-463f-956c-e7f4cd6d3d70", "comment": "Malware payload (ServHelper)", "value": "4f9a28910a7fe276f1a2a7e5023583bee6fd5024dc24c9fc9b8518858113dba58fead7781d2d70b70b4c5c2dff2de212", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781068, "uuid": "a3108276-2c68-4272-a063-fa00a32f7cac", "value": "T1587633552E005E67E45CF77106C6A23D13FE1BEB2A1B690EE748EE1D91312A4470F3EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781068, "uuid": "806063c8-29b8-4539-9297-819be79e4686", "value": "667e6d0f434d248524103ade13b913e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781068, "uuid": "806e4a46-c149-4104-942a-496f35db1929", "value": "196608:52Gvm6FNJgKzN5nCIxDniOShT7KJUMpAng3+jB:5RFFNX1iRRKLpAguV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629781068, "uuid": "afc9debb-0915-473e-98ef-32ee8a6ccbb7", "value": 7520796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629781068, "uuid": "c8ef57ea-3836-4195-a423-676dd50f366d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781068, "uuid": "0e98f386-9692-4684-a3a9-30d8e9492918", "value": "1aa9dda1b9b413444b0668500611c7f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db23fddc-052c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629845075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845075, "uuid": "cb5f54d3-2031-4499-92c5-5cb15063e1e7", "comment": "Malware payload", "value": "41c7582c480287b17b913476b83cfe5d", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845075, "uuid": "df206850-08ec-4bd3-8e4d-84756fbfcf48", "comment": "Malware payload", "value": "0231aa0cf3686c184fb9dd21492fe6f5a7615719a74fb341d7369283f559a2c7", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845075, "uuid": "303bb0ab-da67-4240-a6c3-e9bd6fe051cc", "comment": "Malware payload", "value": "cf5decb3634809e4b8235cd3d7ae1e7f5a89937b", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845075, "uuid": "8d4bf0fb-02d3-43a0-bbbe-3144eff9eb4c", "comment": "Malware payload", "value": "449f716d0360254f0a7f29f3543fa18ced397d09b2126744d10f718f2d3434539da6a20b93dbf76f76b7bf879d8fafab", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845075, "uuid": "a5dd50a6-3997-4e96-9830-250752855e4b", "value": "T1D8E4232CC1E90AF349A92570F94E93EDE4D832EEC374074991388A6D67C4DEFD84A749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845075, "uuid": "05ae6845-a93f-4314-bbd3-10478f3b45a9", "value": "12288:x0NkSqa1Lo6MQVmmUXnuI0DC7YY/1I0ezrsiRYo0KLVElCBW:x1SZC6MDLuI027rdI0ezYiJ0dlC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629845075, "uuid": "08a4ee82-00a7-4691-aecd-af55306bf0d2", "value": 691567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629845075, "uuid": "1438087c-c698-4552-bde5-06c2cb6fafae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845075, "uuid": "5ca98850-1629-48e0-875b-c8a28ca22d21", "value": "Detalles de devolucio\u0301n de pago.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c831a075-04d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629809395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809395, "uuid": "cc6bf7d1-6e41-408b-a987-1b172df40d7b", "comment": "Malware payload (AgentTesla)", "value": "a0e5f04eb9e66908981d60e41ba37260", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809395, "uuid": "d7642fc6-eeee-4242-99ed-8f8f37b7fd88", "comment": "Malware payload (AgentTesla)", "value": "026c16e07aa7a3c56d2945fd7a10f671765baa7c9968bfad5dd8d2561024a811", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809395, "uuid": "75c0ec3b-9d59-4b91-a5ca-38f741b31524", "comment": "Malware payload (AgentTesla)", "value": "2dfebf91b1063093d438ece152020b8ac4ded3d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809395, "uuid": "57b05c06-9c1d-423b-b2e0-334762874ccc", "comment": "Malware payload (AgentTesla)", "value": "f8db6db1de5ea13fb73e76a6da1bf1089512713460643e1fa556ce4b2129c23953e609d5692258ab68bf2d022c573d68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809395, "uuid": "51474f6b-da2c-4c44-ba45-958d862c4fca", "value": "T14D341219C299829BC6DE3C7E8913472127E5CE639048960D676537CFBD318B7070BABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809395, "uuid": "66258215-915d-4552-878a-71375e01d4ad", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809395, "uuid": "b903061b-24a3-4645-b34c-1da8df993030", "value": "6144:OZ49L0r4u5ufiXf4c3twKjICIRmyMOuId:cA0cu8fI4c3HIsylug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629809395, "uuid": "43de1839-4360-4615-98b8-3e5d39543190", "value": 235221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629809395, "uuid": "6dce69db-e5b6-4842-a435-acf3b1bf14eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809395, "uuid": "339d2f28-bb91-4f97-b6f1-a9d6c69b7676", "value": "Revised order 006277-12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26f30ba-04d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629806406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806406, "uuid": "140f0f96-e90d-4fb4-95f8-7e1965b50393", "comment": "Malware payload (Mirai)", "value": "17b3e1ed27d5af465451fcf3780b8247", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806406, "uuid": "913ddf09-ff70-41ed-b244-508fabbd96b5", "comment": "Malware payload (Mirai)", "value": "027e9bd90535a1e23d5f04acb1e291382ee334bfb58a1c8d2f6f16032d2795a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806406, "uuid": "14e8d274-9834-4c63-ac29-f1f3d2f254c1", "comment": "Malware payload (Mirai)", "value": "47335ce1daba81d9a608a5259bf749057220a13b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806406, "uuid": "8f047e4d-45ca-4008-939b-b6a6bb39edd2", "comment": "Malware payload (Mirai)", "value": "76b3abf8f9b3e5859d761c0f015f71704f124ceb18ddcc07b38c1eea6ac7e109761270d6c9d67b3fc39f610028097060", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806406, "uuid": "ea6f026a-7ea5-4b7c-a800-f65ace0fbdb1", "value": "T196433B59BC929B02C5C151B7FF1F4289772A43A8E2FB33039E256F20378796A0E3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806406, "uuid": "404427ca-ac3e-4d18-8373-da6e35db1c30", "value": "1536:nrS6jlb1FNUCkXRkPOO8N5PdE3xKvKTJ:pFNykq5muK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629806406, "uuid": "967405f4-de0b-448d-a12e-b62509af4763", "value": 58696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629806406, "uuid": "4a5412f1-fbc0-47ac-90ac-1bfd49fd6079", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806406, "uuid": "ffaffda5-129b-4c18-a969-401632cb9ead", "value": "peach.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c31f55-0481-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629771617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771617, "uuid": "634a971e-b5eb-4829-8852-f086648adadd", "comment": "Malware payload (Formbook)", "value": "0904a7dbdfd19397e12b3e6a0ce5ca77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771617, "uuid": "9f84e6b7-1a98-4d9d-b9f3-1456563d8d3d", "comment": "Malware payload (Formbook)", "value": "02f219e86791727efbc7d24273381485d1843ec9d85fa2d6fbd902d8e7c2fa12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771617, "uuid": "e7bcb68b-d71c-41cf-96cc-3298b07c63f4", "comment": "Malware payload (Formbook)", "value": "8f77b7ebf18cc08b5821281e63e2864baf3e2169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771617, "uuid": "239dc867-3424-450e-a151-68885f8732ef", "comment": "Malware payload (Formbook)", "value": "1a21122219f5dab91f80314d30260b8ec5cbb9190407b2b9d5ca1b292dc24466418e840162642395c7eb0dd6b26f9033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771617, "uuid": "c4c88821-bf16-40c9-96d2-bae0b9d90598", "value": "T1B73412A765230CADC8970438B5E368BC35DEDF2AD74916D3E682734A4839B4DB81C1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771617, "uuid": "f1ef35af-e5ff-4b0d-bfaf-c03ecf950760", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771617, "uuid": "428d26c4-0978-444e-bc24-0017fb8c7014", "value": "6144:GY4NW0EW47tREX+0q9/IN1usjMdLLA9qc+7gWHx1:2W0EL7jNNITAdL2OkWR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629771617, "uuid": "5ef14c75-23d5-42dd-b233-e4d259b4e272", "value": 232077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629771617, "uuid": "eb5ea2ee-c8df-42fb-ac57-8c8177fac2fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771617, "uuid": "274a4630-aaca-4161-822c-b286d7b55c2f", "value": "payment advice_0802421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb9b713-04e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629813057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813057, "uuid": "5df88327-0ec8-4521-8425-4388870a2424", "comment": "Malware payload (GuLoader)", "value": "52ecf1eda77735ff792defcaab299e41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813057, "uuid": "a9915e26-bc49-4946-8a42-4e00d73769c0", "comment": "Malware payload (GuLoader)", "value": "0330d6ce24c120c8b37a691bebfe1fc023bda398d26942c2775c1bfb886a6f75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813057, "uuid": "e5157133-fdb7-4f79-a82f-bc681b5f7ef8", "comment": "Malware payload (GuLoader)", "value": "f0334ffdf9399a3bcd6f6a55f12bb708e7184b64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813057, "uuid": "4a76b431-56d9-4cec-83ae-fd36da75093d", "comment": "Malware payload (GuLoader)", "value": "a8ee6ca91a454d5c6ee07fa395df28c2c91569f532a35278faac872dce12febc5fa4ac7e08776242d7ee36a43518efd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813057, "uuid": "e2192220-216a-42a5-aab2-e69c27dd22df", "value": "T103348DB220DB5C57E52342B520FBDB3847523A1AD56E59EAB0D6B23586FF302813970E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813057, "uuid": "262a6307-b741-4a60-82ab-eb9b2f9d6f3a", "value": "6923c8ee86140e5fe91a6ff4f0a9d1b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813057, "uuid": "43b8f323-f658-4f57-984e-48ba34169a05", "value": "6144:T6svF7BBdIuodGBoYsWxSFwoFbZBBdIuoMFO6s:T6yB0dK9sRFwqbB0L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629813057, "uuid": "b108840e-8126-4ab2-9d7f-9a947e7cd2b7", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629813057, "uuid": "968339c5-a949-4b5c-9abf-18e1a748ce4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813057, "uuid": "3472f321-63e5-4e2d-8082-eae2f3508293", "value": "SKMBT 23082021 Ref MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e252ca-0470-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629764109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764109, "uuid": "01dccfb3-04ea-41bf-ae5e-944a4c22a09a", "comment": "Malware payload", "value": "285077759cf896f88b6ce1216d9560e2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764109, "uuid": "611d89ea-ee0a-4de9-b41e-5d2bb8595931", "comment": "Malware payload", "value": "03476367339177133a25fc77248d2952c48d4fb1096631b0de1248355c9e21b0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764109, "uuid": "7b2ca3c6-0706-4a54-8fd1-4fa9e1af3a0e", "comment": "Malware payload", "value": "70c2b66d18b16ab677a66deffffe36764bff523a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764109, "uuid": "cd58eef2-db8a-4ade-b0ab-180c28854428", "comment": "Malware payload", "value": "ea45d4036483c0711cfa95ffb964f3251195b27cb016f0aba5fb9d30bb93a4cdb181da4f515cd7dd14ac2eb4b484d770", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764109, "uuid": "c1670f9d-2564-451b-9538-595fbc5a6945", "value": "T127C6330A94E64FD1CD4E11BC82DB1B93225AFB0AA993872F5374DA6F7FB62F0C515024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764109, "uuid": "572d35c4-996f-434f-92f1-2cdd79ce160c", "value": "196608:VVU6UgGxFoZqpp9daapeXu/ltcmoegU+4hA+DnECk4YtFCE5UFBXWRPJ5HEW2rI:fkF7pHpe+/ImSKEYYt8E5wGlyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629764109, "uuid": "b6f04ce4-5eff-4076-9aeb-f4ee3d5c1f6e", "value": 12076907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629764109, "uuid": "f3ae7c5c-1a58-4982-8eb6-39566576c895", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764109, "uuid": "33c102f9-7922-46e8-9f59-575d5a1e303a", "value": "pm14.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0e81c0-0514-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629834604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834604, "uuid": "f6cb1e1a-1dcd-4e23-9a2c-c986cd7b0191", "comment": "Malware payload (Mirai)", "value": "61927e788e7075be3c1cdf69df13f02e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834604, "uuid": "a44bfe5f-9f3a-46a2-8e5c-50ea24448add", "comment": "Malware payload (Mirai)", "value": "0377e641aceb800a33f1684fcd5af71376621dfc8dc6bd2a6ad2a049a5901aa9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834604, "uuid": "1e0fe48e-9c63-4eee-9026-7d32feadd7a4", "comment": "Malware payload (Mirai)", "value": "ec22bbf19b5d3928fb05e6b17b6cbdc6cef995dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834604, "uuid": "80f0fb80-5e72-4522-82af-cfdbd2377613", "comment": "Malware payload (Mirai)", "value": "fe98c9f345816d351f5c1587e1bf1e9620b8175c1e61cc49e9f8a0809fde6ed393334e7c55f2a30523f8c6c925955d63", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834604, "uuid": "60be739d-b422-465f-84ed-5f81a67888dd", "value": "T1D0B2D0BB57DE0092C885263B776B5FE7B1419C880F9DFFF03A56C885A9720296B42D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834604, "uuid": "137579fc-11bc-4798-bb06-784a05d7f3ca", "value": "384:MU7LalTr/lS3rOVT6rJoA/0np7NYLPr/EIZewpSySyKN/QdpOg5Z0wcNGzkSmOjE:T7m2bOVWNj/0njYLXtpS7yKN4dsgKNiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629834604, "uuid": "0ea506f4-632e-464d-8a21-af9fef9cf15b", "value": 24484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629834604, "uuid": "6cc1a766-eeb9-4488-86cd-e744501c2d01", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834604, "uuid": "72396275-dea5-4bc3-9074-52bd70293ff5", "value": "c0r0n4x.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceeae3b7-04d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629809406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809406, "uuid": "2a7eede5-2c78-4267-87fa-4aa81d37f444", "comment": "Malware payload (Mirai)", "value": "f1b4efcf7f14e369d85f3804076ff42b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809406, "uuid": "f1656319-865b-4227-be8c-d2fdad710e18", "comment": "Malware payload (Mirai)", "value": "03935f2d3bade18acb3e378b36372d84057e28a5107e78424bd14f878cecd42b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809406, "uuid": "b708843b-53b2-4aba-95e6-ad59bbd3ec6a", "comment": "Malware payload (Mirai)", "value": "325fb929f905e4e181965d3dd01fcd1b46b820ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809406, "uuid": "48105387-eb81-4b8e-9a44-dc1c7ba6312b", "comment": "Malware payload (Mirai)", "value": "e828b1fb3cd8f00be1bf0ba7973cb443c2bc5a23473fcdef00d13a73debaa5a37743e921816b19deda2d3748d3a5f15e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809406, "uuid": "44963328-52bf-47a1-8547-4656e4ca2e88", "value": "T1FCE34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809406, "uuid": "c7ca811d-20f7-42c6-8403-8976aedfb35d", "value": "3072:ka5gM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvzPhLZ8RvBgR6yoC1MG:ka5gM69pe0QmlTvI8t9mrsplDKZUQQBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629809406, "uuid": "5e9c7b2e-1e26-44d2-bc87-f8d9052ec196", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629809406, "uuid": "c9717064-8827-4de5-aaec-e25e183a7e9b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809406, "uuid": "8e40b50d-ff59-488d-b678-60f838584927", "value": "loligang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430e8292-04bb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629796287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796287, "uuid": "085b63dd-acc9-4f87-974d-6c6d4c12e980", "comment": "Malware payload (RedLineStealer)", "value": "aacffa175bf8729a31f5e84f1671431b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796287, "uuid": "5477483c-3ea1-44d8-86c9-71da9c9358a7", "comment": "Malware payload (RedLineStealer)", "value": "03ef87ac53244de6918f09d3f3e48412323db6fd1f1ea9208a287abfad4e688a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796287, "uuid": "46e3a718-62a0-472c-891f-5efc09bd7f1f", "comment": "Malware payload (RedLineStealer)", "value": "4bbb67ef469362908a39a9678941aac07aebeeda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796287, "uuid": "12a2fd08-4e77-48b9-aec6-94b4dd050930", "comment": "Malware payload (RedLineStealer)", "value": "8043d685c34d4f4fc90c6ba99bd253e5f0f8078809405396f811530fb3879f7578197863b04f867c29946d1dc55f9fb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796287, "uuid": "5931b851-3177-4735-bced-21a402f4af99", "value": "T131D41F18667FC016D0F7EAB12DDC68BBD9A990E3644D793710A4633B4B52784EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796287, "uuid": "14c4e7e3-e928-4400-9a2a-029adc67937f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796287, "uuid": "3358677a-090f-4c7f-ae92-5450b95299e2", "value": "12288:FkaLmy5eA1GoQ+msoHv73ujEzMVlbO/2g:3mk13c7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629796287, "uuid": "23e446e1-0c3c-4425-bbed-ba92216005ca", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629796287, "uuid": "b305bf71-c933-44e0-a2cd-ea112097337e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796287, "uuid": "debd3e79-99a9-4b86-82ea-25a04b9efb57", "value": "aacffa175bf8729a31f5e84f1671431b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88cbe978-04c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629799410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799410, "uuid": "a9c19ae0-a8b2-4e70-a079-ceffdb9dc0e4", "comment": "Malware payload (Mirai)", "value": "f8fe1ee9e272ea8cf03d9b8f2019ec54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799410, "uuid": "45685d81-8607-48c8-b142-3df04ef643a0", "comment": "Malware payload (Mirai)", "value": "0574d9645ffc411482391a62e3ede2806c1224283f330fa2838dd3eb21551723", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799410, "uuid": "d29fa47f-04c5-4412-8c1c-ca6d6a4dab88", "comment": "Malware payload (Mirai)", "value": "d3ec2c25bfe6bdd2186def73eed240270f7bb6d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799410, "uuid": "3b8a8b8b-a3b4-4e5d-ac10-6be179c2eee5", "comment": "Malware payload (Mirai)", "value": "ce0898a1d562cc2ce3477b6a6fc199586dc23511fdf56bc37da25ec6c2d3621b2ee6077dd47a90c63d212291d3e64973", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799410, "uuid": "ee04130b-02e2-42d8-b58a-590f7fde3be7", "value": "T182D2D0EFD0942183C6ECBC3A055A1BEC88A5F1C033D59BEC232358C5579EAD7394A61A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799410, "uuid": "cc263f44-131e-4567-8aff-ad892e3bc4e2", "value": "768:G9Jd9zCnnaNq4pgFw+0iOXITr6p0SAgGWS:G9JdmOqwgFJOXP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799410, "uuid": "5e2e7d00-ebb9-4ef6-849c-c6eb798df174", "value": 29608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799410, "uuid": "666f9ba2-8980-45a4-8bea-848e6be562ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799410, "uuid": "c05d1abb-e3bd-410f-a882-401680888a5e", "value": "f8fe1ee9e272ea8cf03d9b8f2019ec54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be03ea0f-04f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629820974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629820974, "uuid": "2b5628d5-c0e4-4e87-acec-5a5ee7364cb5", "comment": "Malware payload (AveMariaRAT)", "value": "4b6b88023b160ced365608fccdf9b015", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629820974, "uuid": "b332827d-2397-4c45-9d1a-d143df531302", "comment": "Malware payload (AveMariaRAT)", "value": "05ae064e31b84c617d5cb888c3bcab28b5eb16ac5c257833ba5c9c409d2a50ea", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629820974, "uuid": "47df317b-5888-4f84-8092-c95bfb598b07", "comment": "Malware payload (AveMariaRAT)", "value": "0940fdc0b59cfa08169967b840db2cdce7016292", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629820974, "uuid": "a0c53ebf-8d42-457f-89c3-187b7f3ae6b5", "comment": "Malware payload (AveMariaRAT)", "value": "b87185b70cb4a98d9f24584b310f4b6835fd804cc1b5c7c490760a04405ee2ca552431224d92666c95a8c55384673bce", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629820974, "uuid": "fb608d38-1eb0-4fda-a6a2-2cb531b8e8d0", "value": "T123F4D43C19B93A27E0B9D765EBE19817F15094AF3521AD99A8CE03A70307A4375C733E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629820974, "uuid": "c658b4d9-ee60-47ec-95b5-cba769440f96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629820974, "uuid": "a9835f27-9fc7-4d3b-88bd-ce705be6a856", "value": "12288:oQDc9F3nC0Py3gAhnJpDP2++cl8WJlPL0XfJeSIZyJL1eC/3oOllJ9jl:oYDP2VWJVkA5yV1tPoSlJ9jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629820974, "uuid": "9aaf0c62-c0ae-4ce9-9c3f-83990a737fd6", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629820974, "uuid": "aef64fcf-0736-4ba7-9e65-362eeaf5467e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629820974, "uuid": "dc9a2ac6-6875-4af3-a702-8d9b5b4dcc8c", "value": "INQUIRY LIST FOR OUR NEW PURCHASE REQUIREMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269ccb8a-04d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629808265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808265, "uuid": "e79ef10a-7745-4e1f-aebc-73b05bec08f2", "comment": "Malware payload (Mirai)", "value": "68808103a04bdf9790ee23935e06e00d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808265, "uuid": "00c72e16-dd78-48ba-aa46-38959d911cde", "comment": "Malware payload (Mirai)", "value": "07a29262d7b27eb102f1cc352ff2a96a33f9d6be1b32465a209019d9516b9502", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808265, "uuid": "c9caced9-8255-425f-b0e3-7ca6ccfd1440", "comment": "Malware payload (Mirai)", "value": "2b021fb6146712e861a0bb63556fec3154612cb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808265, "uuid": "0fc07d53-67d7-431e-8fd6-67da667ee348", "comment": "Malware payload (Mirai)", "value": "88bb4e589bd246c968568f2a5963482b442da5540bcbaadf0ef22720c5ac277abd53f8fb2946587b0105aa67c02f23cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808265, "uuid": "6e1367fa-7dad-49d7-ac3b-f0299177e181", "value": "T17A434C41B30D0943E1675EF13A3F2BE0D39EEA9021E0F944394EEF859172E325186ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808265, "uuid": "12836019-b24f-4d87-9f35-4c9d0df5e42c", "value": "1536:A4SZ9C8OzqpQBfoE6/uc5FCqlsy3O0QDuI0:A4SK8QFKE6mkkn90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808265, "uuid": "b287a97a-5126-41c1-9adb-859e0840b262", "value": 58792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808265, "uuid": "eea17c3f-65a0-4ce2-8566-a3204812aca3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808265, "uuid": "d5499f56-bda9-4efc-811d-151b8c3e0f65", "value": "68808103a04bdf9790ee23935e06e00d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b785c6-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629812807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812807, "uuid": "bb6a1e60-911e-4221-91e4-0f2337010c65", "comment": "Malware payload (AgentTesla)", "value": "ef8c1369f49714a185a9c3b1f4581c4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812807, "uuid": "b5eee739-23d4-4563-96a2-6ca3d08a6b9c", "comment": "Malware payload (AgentTesla)", "value": "088e1d62ab8b0447fcef9bb32bb6ba58a998511eda17b81bc703ab2e63fe3ba0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812807, "uuid": "575bea54-9f1f-4fab-8dac-7d1930841b66", "comment": "Malware payload (AgentTesla)", "value": "402261117422db41a8cb423fcac25d893698498a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812807, "uuid": "8b5fc132-921a-4741-a9d9-38c90074bb2a", "comment": "Malware payload (AgentTesla)", "value": "d4ca7919a20638607a20d50730fa7f9564ad3a4604c0d37414b832f19f58cc5a1d8938ebbaf215beaea649b1cc7890e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812807, "uuid": "972a6226-4c62-46ae-9537-345cbcdbf727", "value": "T141158C306389C294EC1A8FF0166CF79002F275E7B6C5CD7A16DA724CCE5E9D22A0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812807, "uuid": "6d8d7157-6c7f-4b50-b248-dc821b90bb7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812807, "uuid": "36442ed0-123a-46d6-bf46-7949be9f0e76", "value": "12288:n2csGI/cr8fdf/KD8hYBZsk29bCH09HEzINTJ0LqTblTnEj4bJgOfrR2EObbm:n+d1hkZsvCU9ksNlAqTJTnEEbq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812807, "uuid": "df931313-7881-40f4-8652-179653973a08", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812807, "uuid": "d3b6d3b5-d1f2-48a7-8437-c073c163efcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812807, "uuid": "ccbf31b4-2029-4b90-b972-103ac6c5bf36", "value": "ef8c1369f49714a185a9c3b1f4581c4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99268006-04bc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629796861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796861, "uuid": "9b65bf03-612a-4d11-8117-a901b066eeea", "comment": "Malware payload (RaccoonStealer)", "value": "00ee7ae265bb48ce6ab52a0bcb509bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796861, "uuid": "8e2a7fdc-b4bb-405d-be4b-bac8957faa45", "comment": "Malware payload (RaccoonStealer)", "value": "08ed53a3a85b3f17d9b15fd7e5eaf5184ac569443e42abae9ae5f5bdbf6bec61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796861, "uuid": "bc8da16f-6c7c-4509-a1b7-44fb3f1442d8", "comment": "Malware payload (RaccoonStealer)", "value": "81eabf190ad78bd544e8dae5e1b47dd95ffb2fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796861, "uuid": "8d34b5a0-7830-4d33-811a-b0b0cdbc48e7", "comment": "Malware payload (RaccoonStealer)", "value": "3994ae4ab2c3156d8fa4ac7f92d905d4fed315099f82d7d51b450277f14fcf64b886787edc4601ae9c37e26abe7cab15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796861, "uuid": "e249a01d-9012-47ec-a968-ac914188228b", "value": "T1B4E3AE3075F0C076F592D13048A2DAA16B6FF8E3ABA0854F36A92F5F1E342D057293D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796861, "uuid": "caa907e9-7594-4bbc-8ce5-f6fa526d8437", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796861, "uuid": "d2682923-814b-467f-b230-1213dd0e384e", "value": "1536:/htfMEhuNikOICm5C2W6D0dh3ka/hDvW6j5bFbAOwrrJIR/J942sbc6PPSOQt9z6:8JNFCMY6wdh39DvPj5bFErr65o2L9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629796861, "uuid": "c109b021-3a16-4eae-a3d5-1d24653c415c", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629796861, "uuid": "455db53d-1344-472b-813d-297d792688f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796861, "uuid": "50b0980c-200f-4443-bb2e-e0e2f5c25ff2", "value": "00ee7ae265bb48ce6ab52a0bcb509bba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbd1e7e-0526-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629842422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842422, "uuid": "6e76611b-41f1-4e29-8c75-e5340d463bcd", "comment": "Malware payload", "value": "8ed30c6c10b4ce0567bd443935666e7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842422, "uuid": "436890f2-a9a3-4139-b9b1-0025ba4b0927", "comment": "Malware payload", "value": "0a17ef3263b6b35cb6a99754dcd6349922d3a377de87c9a0516c284a4082b3eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842422, "uuid": "aa233102-eaa8-44e4-8283-f101e7b17174", "comment": "Malware payload", "value": "12de64ba388e674c6b1dad44aca0b02b2b478029", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842422, "uuid": "be25c6db-fcb0-4975-b76e-abd0a66171a2", "comment": "Malware payload", "value": "4a679f764593442d9041b2fc8241971befce13b143a98fb753b86fd02c8055282f399124d44e70df66304e07f430a5c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842422, "uuid": "c3e45074-4a4f-4550-8dca-d11e7e08c502", "value": "T1D3B33A2563DCD629F7FE0B7574B0061047F0E19B6021EB5B8EC274DA1E76B82AA446F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842422, "uuid": "6a6f0cce-40a0-4eb6-a0eb-1d1bd083edbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842422, "uuid": "c4a74c17-2290-486b-9774-8e93112af756", "value": "1536:Vt9pmixb39O6sc+sdOyMYTrdXLzgZnGm9jbuqGdfnMuyq+drV1dDjEyG6qTaoigm:ftb39fJrd/Trdbz2lGfnjyjdrdY/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629842422, "uuid": "079c96e7-8168-49ff-a95f-dd085ecd4792", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629842422, "uuid": "7505b9f0-d746-48fa-82a2-946fb8085679", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842422, "uuid": "66ab521c-a829-45dd-99a5-e9e60492e50b", "value": "8ed30c6c10b4ce0567bd443935666e7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90b60ed-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629805934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805934, "uuid": "b95cffe6-6c8f-4034-bc00-93d83a7a9d31", "comment": "Malware payload (RaccoonStealer)", "value": "877d7d6f4ba4afd92ae616549fa20b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805934, "uuid": "6dddeb29-abfe-426f-9edc-c0e0fc773f8c", "comment": "Malware payload (RaccoonStealer)", "value": "0b52e92d8ece1d9c7395b04335a6b95a9c744404eceb4330d88fe1237e9200c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805934, "uuid": "19e282d1-d65f-41e4-a566-3127fa654f41", "comment": "Malware payload (RaccoonStealer)", "value": "3bdd9007953ccff589c5ccd27d775ed7b7365d12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805934, "uuid": "733d453b-4cb5-4038-a024-3a1e61c2365e", "comment": "Malware payload (RaccoonStealer)", "value": "02394678273ff15a30c0a34e7b288812a23d7dbe50530c626caf13fa13c83b88bd21f6922beff2fa6f953570c729d1d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805934, "uuid": "c195e1f9-1331-485e-adbc-0cc1c28ef8c9", "value": "T1E2D3BF1135B0C873D45A59B148E9CBA0EA2AF8626B61854337DD7B2F6F302C1B73B352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805934, "uuid": "3d376dae-acda-4bcd-b92c-8b63c4c585e6", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805934, "uuid": "5a5fb6fa-12e9-4b1d-aed5-415077adee1c", "value": "1536:B0O09Ck9J9qTEsB4xCqelKXuH5e/ddddlxVdQKHBriobhO2Yp2:O9pATVKeH5e/ddddlrdFlgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805934, "uuid": "0f94023a-374a-441e-b689-b506ccf999b8", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805934, "uuid": "2635dc28-d911-4561-b90d-a801cf2a5dca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805934, "uuid": "b36ab6a9-3ac7-4ca1-942f-b535062f3bfc", "value": "877d7d6f4ba4afd92ae616549fa20b21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def5572b-04f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629822748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822748, "uuid": "7a072cce-1a07-4ab8-851d-5440716f3070", "comment": "Malware payload (CoinMiner)", "value": "2d9182d1442bb5eb07db3212ea96a93f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822748, "uuid": "a1e725dc-140e-4f26-b432-9bbe00644279", "comment": "Malware payload (CoinMiner)", "value": "0b57a9ec21d243df448008de2329afddcb907a5b7e0c56b2af876a00771546e9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822748, "uuid": "6546b624-ae0b-4cb4-b81e-8d57c7d19c59", "comment": "Malware payload (CoinMiner)", "value": "a131e7658fc7aff9262f24b23514e0f5d6a8e898", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822748, "uuid": "31396a77-ba53-497e-9321-6ed216364724", "comment": "Malware payload (CoinMiner)", "value": "0b3f9b5142c4fa2c4395ae7db5cb7c769a678f3d8590e53912fd41428b5b836e7a9931a596d742b65f4b94d16e20554b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822748, "uuid": "a55a3803-2655-436e-bd42-53e7ce0b7eb5", "value": "T1E014CE0136A0C833C65645B048D2CFA1E629BD716EA19A4337E8EE6F3E352F17716397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822748, "uuid": "4dc7e44b-31fd-4e19-a544-93b6fbc0a72f", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822748, "uuid": "8f12aed1-7730-4b24-9156-e712b98db330", "value": "3072:QGkXn5xpAcSu32/hv056X5nSdJQKtOgMRZafD4UA1b:QG65x6cb25vU8bEcxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629822748, "uuid": "2c27ef33-c196-4cd7-aae5-d0779f9a39a0", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629822748, "uuid": "28742120-e60d-448b-a4ed-f24ce16312ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822748, "uuid": "397e31e7-b3d3-44dd-876d-afe8292d7d33", "value": "2d9182d1442bb5eb07db3212ea96a93f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df42b905-04e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629812440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812440, "uuid": "e07bb5e0-c517-403d-95dd-cd1d2ac23237", "comment": "Malware payload", "value": "9896f3d2daabd8df12aefad5e94051fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812440, "uuid": "30c5a38f-1fca-4df4-9373-c6b11fa79a53", "comment": "Malware payload", "value": "0b6d331c90041dc8996da865a2da6fc9530d68abe88819104d88f90dc1c2aee0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812440, "uuid": "ba303a18-a6ff-41a2-8adf-fe653a4b6192", "comment": "Malware payload", "value": "3d67da773dbe7ec35b1bda4b50d33d448bb47147", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812440, "uuid": "7abfec5d-c406-40dc-aec4-32949bbb8400", "comment": "Malware payload", "value": "752ef9b075f2f5df23a6bee7e72748864f76869fb0dde0a5cfd6bca38cfb794cd1a9dd1d11b111d6d3e0718101f632f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812440, "uuid": "6c4c0e27-5711-45bb-b931-164eadea7414", "value": "T1D9246C1232D0C076D6BF027A59678B3967B6BD508FB5C64B3F90FF8E5D305918A2A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812440, "uuid": "169445aa-12af-4394-9505-e2665319b3db", "value": "4eb7fc2f707d289b051956294ff4e88f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812440, "uuid": "3de4b59b-2b9d-4435-8b69-24dba6188707", "value": "3072:PXocyqUue49Woqk+zIvW/9f/xK1zRLNd1pZ7lvwnAxgNAijtv1wmDa:P4ZqUPoWoqkHvW/hxKDDplvwnASNAI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812440, "uuid": "9f5f4afc-49ba-4348-a15e-803df5387338", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812440, "uuid": "2617b613-58cb-41fc-8874-c3625c11b965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812440, "uuid": "763e470b-4aae-4fa0-8170-67195b0eebd9", "value": "ty.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a541ff0-04b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629793373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793373, "uuid": "18d3f56d-b52a-49dd-88d2-c814750fe889", "comment": "Malware payload (AgentTesla)", "value": "174a3ab2bbaa4e1ab786b9c98c7b3639", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793373, "uuid": "e7390a31-7b76-4eaa-8fd0-053022551afc", "comment": "Malware payload (AgentTesla)", "value": "0c81f1f9ab9a50ca7a8076384b1b46cc484f67cb0f8da081c56c9da42da4055d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793373, "uuid": "e8c2bed9-49cb-4a37-a8b0-c8da12eb29dc", "comment": "Malware payload (AgentTesla)", "value": "d0b3bccc1c855b1c59ed75c5c7d826bf168a85fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793373, "uuid": "223c1779-99e1-45f5-818a-5c77de51d3e3", "comment": "Malware payload (AgentTesla)", "value": "14fd39e99892b4c8e3169e2f3d9b98c0a0006e49ef9322779161dd7a58e8bfce4d69e8a1be662469fc792b124dc4a5d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793373, "uuid": "8ce7125b-6c8b-4b53-99cc-02a63f1495d5", "value": "T1EF159D702389C294EC1A8FF0167CF79402F235E7B6C5CD6A16DA724CCE5E8C22A1765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793373, "uuid": "5649592f-0a23-4aae-98b1-5f6059f3d372", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793373, "uuid": "eafd6a68-8ce7-484d-b213-97d32d47c609", "value": "12288:GwcsGI/cg1RbcvPiaeS905fcyY+P45no+7e9o3CZq2CJSUD7pC4BLeom38/vk2E3:GmRbVcyYt1oKe9PtuSUBCerlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629793373, "uuid": "83d23cf2-7603-4424-a2f4-06555ffef584", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629793373, "uuid": "a660383b-c366-4fe7-a92e-32ea8e7c8038", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793373, "uuid": "1824c028-fa3f-4670-956a-0b20b8683ad0", "value": "873762-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5578e44d-048d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629776561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776561, "uuid": "edbd0b37-bd72-4a87-ae36-9c185ae20f09", "comment": "Malware payload (RaccoonStealer)", "value": "fc316a48dadfc20ef46f52d892a9c365", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776561, "uuid": "7df50f88-47ab-4126-9356-38fbd7f5b767", "comment": "Malware payload (RaccoonStealer)", "value": "0d8501287af1bdb73891772549bf9f60e1119327a5c3e7ff3bd75b36dc22a93d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776561, "uuid": "955401f1-2a0b-4983-aff6-618839d7927f", "comment": "Malware payload (RaccoonStealer)", "value": "b453226e5ac53e1ab44617704a58eec8a31155ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776561, "uuid": "5caa8185-31b4-4932-8e95-eceb9473b718", "comment": "Malware payload (RaccoonStealer)", "value": "776f0320669c3836fac8131118dec6a35d4ae204e849c01d9a63f5bf9e186d5b2c9b429e926dfdd28fed15f9522505e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776561, "uuid": "d9518f65-bc6d-4bab-94b4-7e278954c0fc", "value": "T175941231B9B0C93FC01254304D62C694B66AAD50557852073EDB3F6A6E323D0DA6BFEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776561, "uuid": "400ff9a0-9e25-4b70-83bc-5b6b408d3da4", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776561, "uuid": "5a106523-20fe-40b8-a171-0c676d135412", "value": "12288:Z/Or11PVYODNiWoJhYv3/hvoIYQ8xC4ZL:F2PnDNilh+hvoRhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629776561, "uuid": "c6a35aac-f234-4407-a93c-b0b2f15c2605", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629776561, "uuid": "c120ba50-671d-4d9c-a020-34dcef5e0aa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776561, "uuid": "35efb842-f201-4cf1-9245-7239329f79f3", "value": "fc316a48dadfc20ef46f52d892a9c365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fd3d19-04c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629799946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799946, "uuid": "88a7ce3e-aa87-448e-a38c-caf0340b433f", "comment": "Malware payload (Mirai)", "value": "6a4f53eb809f66ef120fc92819f57754", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799946, "uuid": "697b588a-1587-42f4-a4b9-2e0c0235a3e8", "comment": "Malware payload (Mirai)", "value": "0df8e0c960b16abe1af9657a73e072eee735f30c84b9a76638cd241c20347bc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799946, "uuid": "bc0553b7-be06-47b8-95ba-01cb9bf49ffc", "comment": "Malware payload (Mirai)", "value": "9a0d33415484468daee11eba04d63ca51420740a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799946, "uuid": "dddcdfdc-5938-4147-a2a3-25683390dfe8", "comment": "Malware payload (Mirai)", "value": "73c71b8537915b75896b415820d4bad2a2201676cb05b583d9a5b4c7310d61db006137a239ec5b006197082c4a8a9bc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799946, "uuid": "182d138c-fcc8-45be-a063-c7ac01162cdd", "value": "T1DDC2E0C2D0628CC6FFAAAC313534C7C9A7B11EDDA763C89671C187F9213B526638685D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799946, "uuid": "b1424a23-b714-49ed-b0ff-13eef04b17aa", "value": "768:7Ovk/aUhzxUFP0mUS6iZGeA4uVcqgw09R:7zHdxU2mUS6is4u+qgw09R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799946, "uuid": "f03a3bdc-531c-4b07-ac48-3a9bba6029e8", "value": 26348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799946, "uuid": "df08d406-bd7a-4027-87a8-70f608196047", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799946, "uuid": "d3f786e5-21d3-49ad-ab48-074b9e3195a6", "value": "6a4f53eb809f66ef120fc92819f57754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bd4ee2-04b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629795187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795187, "uuid": "334e0467-f1ec-4d54-bc7f-7c8c46ea846c", "comment": "Malware payload (AgentTesla)", "value": "e812ae485011a55057cce00cfaf1d9e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795187, "uuid": "20beba2a-45be-4dd0-99b5-55e91446f801", "comment": "Malware payload (AgentTesla)", "value": "10218b537bfd6abc2652c9f3dd158c5a9e769ccbc9fca7ecb4a304a4fcacbd92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795187, "uuid": "a26ffeb2-badd-4a19-b888-31490f67e8aa", "comment": "Malware payload (AgentTesla)", "value": "05e607c17a9146b5f9c9152ebf33f81e62645985", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795187, "uuid": "e468a8b2-9983-4087-81ad-01c9ed8e8a3c", "comment": "Malware payload (AgentTesla)", "value": "91f2fb5fa0b4aac48c91df62ca17f66976c0175ff5132e40e931a48e282cd3dc7cef4f2fa9cf8f509899709ddd71c22b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795187, "uuid": "c1340c17-a0b2-404a-b020-a31d8b916321", "value": "T1E3159C706389C284EC1A8FF0167CF7A402F275E7B6C4CD6A16DA724CCE5E8D1660768B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795187, "uuid": "a0c480d2-1c26-4a70-be72-ec8e21b1aa02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795187, "uuid": "e093bcc6-ea31-4e79-a327-e051fbf11a51", "value": "12288:wjcsGI/czJlszkbbrO1FP12zN62H5WLmlwM9VfthwVMn1Q/evlfEYi6IXduXV62D:we0QrOvP1Yn5WLmx912MnqqhEYi6eoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629795187, "uuid": "060340fc-d178-4beb-a1fb-c604a42dde63", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629795187, "uuid": "89ef3084-038d-40b3-ab94-17c985450bd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795187, "uuid": "4d6d8279-6236-4a85-a1bf-6baee6bb6c28", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DVA.genEldorado.428.24928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293d73d9-0508-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629829315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829315, "uuid": "db4503e6-fcb1-4f93-86b4-1a47c1f58ea2", "comment": "Malware payload (RaccoonStealer)", "value": "52ec98edc40a37f72767c991f2873fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829315, "uuid": "89add3c5-fef5-4e5e-984f-23441c7e47e5", "comment": "Malware payload (RaccoonStealer)", "value": "1057e32209c7a104a08941ae6c45b17cf9fd2ee3a28117d3e1e9023134e116a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829315, "uuid": "d5f159ff-471d-48d9-8f7d-c77dc16c7384", "comment": "Malware payload (RaccoonStealer)", "value": "1258e0454f6d359714b85214fd87221f6bcb9f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829315, "uuid": "9da15f4d-cd50-4f6d-b347-f8ceb288edd8", "comment": "Malware payload (RaccoonStealer)", "value": "d5ce5aacbf42092ec6b3d0588ab121eef393f615bf7b3c6a30d63994367f43c33eab2ede0108a30fd503e0ad309363c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829315, "uuid": "e85923e1-b730-4958-9efd-94145a34c518", "value": "T19AA402007270C833D5AAE57658E5DBA0D57E79A16E7552033BE99FAF2E303C0732D286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829315, "uuid": "1b710563-3a65-41e9-94f2-23f2f0486425", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829315, "uuid": "1f3e474b-48be-42cb-ac70-c57c76b88f5b", "value": "12288:lmhcZSf+q6dpq4nWQ8rzI7tMo8dS9vh8RyEcF:lmhmSfT67q4TezI7tMo5h+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629829315, "uuid": "97804c40-2835-43ac-b240-1e1e46a90ec6", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629829315, "uuid": "19a9383b-7ea6-464e-8725-8a10ab08dec3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829315, "uuid": "ecd21023-da93-4f8b-8aee-39c2432f7b9f", "value": "52ec98edc40a37f72767c991f2873fa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e1274b-04ab-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629789664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789664, "uuid": "9d03c9aa-e609-42d1-8310-04ecff6985e2", "comment": "Malware payload (RaccoonStealer)", "value": "01ff144b49f948b06c93a24f6924afd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789664, "uuid": "3fec72c2-dbf6-4b5e-8e49-c80fc806752b", "comment": "Malware payload (RaccoonStealer)", "value": "106f44512e66537d4e5f1b0b08c561951882eb3bdf5e648cebb4c5a9a2ba3c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789664, "uuid": "ba863230-3130-4660-abbb-c514de501be2", "comment": "Malware payload (RaccoonStealer)", "value": "bb44f0dd41b0a971d0cc1c1b4069ce802f79e73d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789664, "uuid": "9dffaa70-e995-4708-9066-b0c226b410ab", "comment": "Malware payload (RaccoonStealer)", "value": "a1b4fee0bc3a8eafe80068b974a32515038e8396f6103520130f953814769023ae60ccfed2491b27f79b6445b83f6264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789664, "uuid": "2b6b3793-6c3b-4fc2-825a-0a564caab429", "value": "T115941212F272D873C01280365CC1DBD0EBA7B5A16EA05147BBF89EAB9F70641773635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789664, "uuid": "b0f1471d-1495-41b5-aacd-977f36cfef6a", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789664, "uuid": "da263dce-8e9d-4df8-af02-411bbbfa1e53", "value": "6144:NtQ8HDi6OpPcYac0fisT569dKywCSb/nIndmwo8LDv+B0Oq:N1jApDADCKx/nIdmwo8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629789664, "uuid": "4bc18f46-d41f-4892-b6d5-f5be4ea27849", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629789664, "uuid": "21b4517c-84ba-46ec-8bd0-b7b0a96fbb49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789664, "uuid": "34927cf7-f3ba-47d7-944a-e81939826d59", "value": "01ff144b49f948b06c93a24f6924afd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44eb36af-052a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629843964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843964, "uuid": "b8962b8a-0bd8-44e2-a064-afe50ca35c94", "comment": "Malware payload", "value": "7f02c85a9b5fddc4bd13d2bb99184c3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843964, "uuid": "fb69027e-f0fb-46ac-9d23-c1221f3dc20f", "comment": "Malware payload", "value": "109f4e911963fc423baf52a474ef505145cedf68c146a86158bfdc9b8bbcc45b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843964, "uuid": "ea1ed6bc-b37a-4a12-bf38-99aca92038bf", "comment": "Malware payload", "value": "d839fb08d8d81483c8e2341960977a81953ab10f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843964, "uuid": "9ba26fe4-1060-4843-9392-59da77622ffd", "comment": "Malware payload", "value": "a50dfb0446dbd2dde80c1e538de95ecc3ee6a229f2a74a8eb2d922553768b38e8efe19123c733be5f1434b71c55942b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843964, "uuid": "2ddda405-0748-4ac0-a280-3d209d79c796", "value": "T1F2A30897F801DFB7F40AE67604D34B24B670BBE54F531622722739A6AE722D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843964, "uuid": "f4b5ff67-bca2-4210-a437-5e7b4c4a34a4", "value": "3072:BdKLGdUvuXwyKQlU8fzv6mumuxVqDr78fz1e:BdKLGdUfyKl8r6mumuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629843964, "uuid": "b6a24e93-6b1a-4df0-8f86-b4f815d587d4", "value": 98923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629843964, "uuid": "a25488a0-4ce6-4747-a36d-814189e15470", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843964, "uuid": "4879e5c1-6134-4357-ac0c-017dbc723ef1", "value": "7f02c85a9b5fddc4bd13d2bb99184c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1db9050-04eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629817115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817115, "uuid": "e8aaa73e-b66e-46aa-8d0e-98eda6c5fea9", "comment": "Malware payload (AgentTesla)", "value": "2e9b19f3786e0a3813220e18490f6eaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817115, "uuid": "5baef9ff-af05-4c21-ba14-b4c3b0199879", "comment": "Malware payload (AgentTesla)", "value": "110a165c7a6e46a050bd5f550ceaa19a40eefd679ed9cf4d917c127f2032f49e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817115, "uuid": "a8bd25aa-fa1c-4bc2-853b-9acf2c50d707", "comment": "Malware payload (AgentTesla)", "value": "7fb8fa927c2038cc170ea5e2f25811e386d6bde3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817115, "uuid": "3ae30267-bbf0-4f1a-9eb1-35bf63d54f54", "comment": "Malware payload (AgentTesla)", "value": "ce33ff7e936ac5a62a4db6c23e669b7b2eaccf511531dda1fc7a61e410c539085370e60c775745239b03578542a4424a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817115, "uuid": "73063b73-70bc-4c87-bc4d-2e0a089cbcff", "value": "T17505B37E1ABD92278175C2B5EBE75417F0409B5F3411AC297AC203664232A7BB4F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817115, "uuid": "e24d2036-3681-4877-abe5-43293935ba2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817115, "uuid": "f5fd65ae-f506-4989-9bc0-76519165c243", "value": "12288:zVkJVDWTkj1xfkgdH95hBp7ZkxKYZbZrZdSbJz6D7:5kegJxfkb3+bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629817115, "uuid": "5c136c59-81e4-4188-8d44-583fe4f9f7d3", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629817115, "uuid": "44574f94-a541-4998-a47f-97d402647f15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817115, "uuid": "8e3d7742-5dc2-4488-9f22-81f76dbf9850", "value": "Supplier Bill Of Quantity RFQ #1057850 Petrochem Tender #1057850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369ffc25-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629812587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812587, "uuid": "edea4ea1-f4a8-42fe-92ef-e83c517c94f2", "comment": "Malware payload (Formbook)", "value": "9d2916594f9a26e36d83e519a6b20a5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812587, "uuid": "3949885d-2ef8-40d9-af02-92b8cd7f0d20", "comment": "Malware payload (Formbook)", "value": "11dde0ea97b2f63edbd9d6b42af105bff7fad9225396219a6de96cb8d51125d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812587, "uuid": "5376d788-96db-48d3-831c-057e0736db6b", "comment": "Malware payload (Formbook)", "value": "04951ff38bdc38598277278f2a9f12f229848c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812587, "uuid": "ac5dd43a-1eca-474c-a128-9054643520af", "comment": "Malware payload (Formbook)", "value": "566fbd7d296b4c0da2df736286a85996162a436b4f7f4975c5d63cc146bd5dd7aed05972db9b69e458b1182b4db3f183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812587, "uuid": "57438ed7-ada7-42f4-99bc-80acb1e62377", "value": "T14715B3BE1ABDA2278175C2B5EBE75417F0409B1F3411AC257AD203660232A7BB5F732D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812587, "uuid": "e0a09293-39b1-46aa-96ee-8e932ff97c18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812587, "uuid": "e66d80c3-2c10-4893-9b4b-cbc3ab488574", "value": "24576:CHJhz/qZq0itNY/KTxDxTiJhaIn4kJUK:CHJhjqutNbTdxGJhLnl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812587, "uuid": "be186cc0-0416-4da0-a170-90e3b448c8e0", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812587, "uuid": "ce19cb46-1f02-429b-95c1-9543a8dba939", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812587, "uuid": "76af4c36-b903-4db6-892b-e75171f099e9", "value": "9d2916594f9a26e36d83e519a6b20a5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbe9c5f-04eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629816974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816974, "uuid": "4b17d172-295c-46eb-b084-c13bb7afcb63", "comment": "Malware payload (AgentTesla)", "value": "23ba404beb26e9dfaac96f3380efabf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816974, "uuid": "6c3552b3-6af4-4377-a7ed-61cb73ebbf95", "comment": "Malware payload (AgentTesla)", "value": "1218c9a68af2c211a461f2b61e05e6fd0a6486a2d38736084b9576cda3f2b70c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816974, "uuid": "9411345b-7277-4a7b-a476-9d0487a5701d", "comment": "Malware payload (AgentTesla)", "value": "36312399c7893c97b24e5436e00de74bc8927de1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816974, "uuid": "1efa3505-b585-48f4-bf14-178df8bf6935", "comment": "Malware payload (AgentTesla)", "value": "aa2fc216821903e02aed50528579b35e7038297e2f45736b8d13538524ec46999e18c2d83dce45a33a3abb4f0e383a13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816974, "uuid": "305a4b4c-c4bb-4f5e-9aaa-f672af3216a1", "value": "T143243A166754D551CB6F417FC016820831F1DB07A72AD2CF5AA6D8FA2F812CEF92B8E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816974, "uuid": "832c66e5-4f28-419a-be55-be7f345d4bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816974, "uuid": "7d94235e-29bb-4ff5-ab6e-b7b3b082b4bb", "value": "3072:yGWFKNshSslk4+EKDY67HUsaLqAcsOru4bJ7Yp4Bpra2xUEeJO+Ym9XQQtUPev:yYr4+EIjUuArOTFzSTEeAcg0UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629816974, "uuid": "61ffbc52-af2e-44fe-a1a8-c0eb1c0f0c0a", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629816974, "uuid": "12225374-451d-4dcb-abe0-df23f44626ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816974, "uuid": "22704614-de5f-4ce2-99c9-bc3dd7cac762", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2df0ab9-0527-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629842833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842833, "uuid": "1daabddc-86cd-4d5b-a394-6e25f6fa03bc", "comment": "Malware payload", "value": "a10d4a136f05967528266ebc9e161a58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842833, "uuid": "0fe783ec-2fa9-4c21-a288-f72713300978", "comment": "Malware payload", "value": "123c93809c546f51600c15b1c76fd5f1b4fb4e3988122623e4831443a155a784", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842833, "uuid": "2808970d-1f79-4178-a0ba-4e5478d06945", "comment": "Malware payload", "value": "545e3780ac4ddbf44eabb219064a992bf16ea314", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842833, "uuid": "65f59098-b605-45b0-bdb7-a6991bd4a941", "comment": "Malware payload", "value": "bea86a59911a4ec42971a8a084f30486004336f721a183dbdf7c2ab75ea9e41df67aec5c4f50d7fab3f0330afb3eaf5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842833, "uuid": "85528aa8-0591-47de-84ce-1485a4563d37", "value": "T17E6295083295DA12E2625E321ED6EAE737B9BC146F56433B3288731F2D3FB658D16341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842833, "uuid": "200967f1-82db-463d-9d58-69a41e8e45ed", "value": "192:36UwX9XoFg4KSv7qRvRFa9u2/RPyTsBeuv/heccUmx+:3t+kg1Sv+vRFa9u4R+j0hec3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629842833, "uuid": "f914704f-b39c-4866-a935-dd1cc1e6d3ba", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629842833, "uuid": "30ab9300-cf15-45ff-afc0-f2caeb408124", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842833, "uuid": "29c2422a-7749-462f-be17-56fbbf1c2295", "value": "SecuriteInfo.com.P98M.Downloader.12.19463.28195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11572785-0502-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629826698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826698, "uuid": "d957cb4a-cb98-4ed3-abb2-fcfb6e80e43d", "comment": "Malware payload (RedLineStealer)", "value": "b1d7b91643e20a8ca83dcf4dd6f482da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826698, "uuid": "4ff8d1da-5fa7-4dec-95a2-57742f4df345", "comment": "Malware payload (RedLineStealer)", "value": "123f8cec3ea0bc986981a142bc15c08d28a37b48774b5829c946404d59823f3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826698, "uuid": "728403e3-1af7-456d-9a52-c2526da5f974", "comment": "Malware payload (RedLineStealer)", "value": "48d13c01b37a9d3bcf860fa42526d66111b932f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826698, "uuid": "f96dc38f-3206-4cb8-a763-2b2affa6ff87", "comment": "Malware payload (RedLineStealer)", "value": "b898cff512256e37d62048cf22919096bc150f1cd78e2d46bd2d72ecbc0166c2b814e4fa0654554a86bc5915dff432e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826698, "uuid": "e05c6f4b-8da7-4f4c-8be7-8c2a7c6c3231", "value": "T1F10623956DB8DC66E472663F0387143A8CAF005A99CDF15A3B1393DE4375B923B2B10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826698, "uuid": "56806c3b-be55-4783-b217-7fd7670a44dd", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826698, "uuid": "9cc9b243-5080-4fcd-8dff-f83763158040", "value": "98304:+Zf9Bz+pQ6h0sfzYcZqGgWIXr2PLG6rOL1:cjKmsfMydsX2LGyc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826698, "uuid": "797115ed-425b-4166-9f4b-6a6a992c61dd", "value": 3674040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826698, "uuid": "f985680a-42ec-43d9-8869-80083926e6e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826698, "uuid": "6c2e020c-1960-4542-907c-e0a4ad1468b3", "value": "b1d7b91643e20a8ca83dcf4dd6f482da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59755e1a-04ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629816511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816511, "uuid": "04ff37cd-1958-4f4e-b986-5d7bf6220364", "comment": "Malware payload (AgentTesla)", "value": "067b1ee2b60785f7e4ba4362a65a6488", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816511, "uuid": "2b8b8339-2469-4fdc-94e9-426b27ea241f", "comment": "Malware payload (AgentTesla)", "value": "128db20afc0741c8be717aee35267d50d219d694857978d6faa1710a6a9ab4af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816511, "uuid": "5eaaaed0-1df7-4415-bd4b-0d6d427dc7d0", "comment": "Malware payload (AgentTesla)", "value": "b519f6a45270006a60127319b9d62156948f833e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816511, "uuid": "54484639-ad3c-4425-86ac-3ed5a56c29a1", "comment": "Malware payload (AgentTesla)", "value": "453b0548ba19db85e12b913b568563a79d9d8dd249b6c35c073eba44c39c002702657778d89fb64461e5322fc38a9e28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816511, "uuid": "2b6bfc57-acef-41a7-8edf-091d004bc565", "value": "T1B1159C306389C294EC1E8BF0167CF79402F235E7B6C5CD6A1ADA724CCE5A8D16B0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816511, "uuid": "43fe8606-dd12-4278-94ca-9ede70cdd7a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816511, "uuid": "e1868658-071b-46bd-8d25-10faa73864c9", "value": "12288:jgcsGI/c0GyMWefjMQoLW8dGtVjYLCeSNaMkycxqJINUZPqVaOxNPpAbqX57X2E2:jRYUAWnjYLsgXxqqNmqAOxXXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629816511, "uuid": "438b32bb-26fe-4a4b-add2-17dba02ab0f3", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629816511, "uuid": "79163687-b2c7-4490-b89d-7204177db145", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816511, "uuid": "2ac214c8-d2a3-4486-a483-00f167fb288a", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9207133f-052e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629845811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845811, "uuid": "d5e2bca4-1bce-45f8-8c7f-9243020c5f25", "comment": "Malware payload (RaccoonStealer)", "value": "b6ca7f11696f8c92f087336db50badff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845811, "uuid": "7b5e3aaa-3828-4cfa-b45d-c3c77c6d82db", "comment": "Malware payload (RaccoonStealer)", "value": "144b62852807332093289be1ce09dfe1f0cced88cf19f54537befbfbea053627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845811, "uuid": "6ac4d313-8107-440d-b83c-281d387582f5", "comment": "Malware payload (RaccoonStealer)", "value": "4535360e33b766a08a3dfa2627473a61c40e01b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845811, "uuid": "d73eadc6-c962-4e01-9457-e623b86e4737", "comment": "Malware payload (RaccoonStealer)", "value": "58a5a21b19a464234f819da4ff613b8da4c80dc094cefc362d3e13d9ea4b3ee5ee3d709d3b01771624062d0825e0032c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845811, "uuid": "f48c9f7f-1a7e-4063-b209-ceebfe0ce8a0", "value": "T1A9449D20A6A4C138E4F311F4596EE3AC69397D712B3050CB63D62AEE66376E4DD30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845811, "uuid": "764e93e4-7fac-4cfe-b8e8-87cb914c16c2", "value": "bd83a1bf510d7a089e2d041b1c2c46b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845811, "uuid": "0df7a37d-7f96-48c0-913a-7223fc93fac1", "value": "6144:rQgJs6jzTZ9EOAe/tWYbOcJ9KjiiOLGA+I4EBZz:FS6jzTjEe/8YS31NA+HEBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629845811, "uuid": "b39d501b-6fdb-4bfa-8c6c-3e56a8211f91", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629845811, "uuid": "27f67aba-0fa9-4203-83e1-40bc01955bae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845811, "uuid": "be633d56-a11c-4603-854f-7fcdcbf0c904", "value": "b6ca7f11696f8c92f087336db50badff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3a3a7d-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629812596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812596, "uuid": "037d570b-2c5d-4af4-bb51-23d39a604bc2", "comment": "Malware payload (RaccoonStealer)", "value": "f5b77e6abf2c6e906dd483e27d5bc767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812596, "uuid": "6e870f73-6f59-46dc-9417-f8ce8fa1e0d1", "comment": "Malware payload (RaccoonStealer)", "value": "15d10737b362b3d02fb10e0eb1062776eba9b97212ce0160391a839dc7ae4954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812596, "uuid": "8ce16bb0-2088-4ae8-98fb-d1ec39a33786", "comment": "Malware payload (RaccoonStealer)", "value": "75570555e04b1f68aac2b3575d885efbcdd2c7e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812596, "uuid": "b8c8e5cd-4fa4-44a6-b285-c3cbdab5d5ab", "comment": "Malware payload (RaccoonStealer)", "value": "5476efea33158e575a6813fe5b35fe3681f6e5ba656ed67049ba06205370c5af7a09b1450d42181cb5a756df26ab099a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812596, "uuid": "651fa1ea-ba8d-4a4c-ba5e-95400e3e9806", "value": "T1F2941222B472C833DA8314B14CE2CF7DFEA9B9565964504277CC8B9F1F742C1BA6A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812596, "uuid": "df61411e-fdbb-430e-98f5-88cda7453ef5", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812596, "uuid": "d09eb431-2e16-40e9-bc28-d5cd82bbbe16", "value": "6144:gIRpQP3i0gIlyIFniHZkj7OCslyOekGU9r8nJ0St4Ut20MGWV0J+IC6GBWCCb:5coIpj7OZyObGqe+wtgGrUIwWCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812596, "uuid": "2a808627-8974-4148-ba4c-c97b05f1dc07", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812596, "uuid": "b952c5e4-73ec-4c81-b90b-9c468529a0bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812596, "uuid": "f48f31e4-f18e-46be-98fc-87937be28897", "value": "f5b77e6abf2c6e906dd483e27d5bc767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5068c929-052a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629843983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843983, "uuid": "c74252f1-470a-4d5d-8ca4-e74ea36673a9", "comment": "Malware payload", "value": "e136ca6832e499d90a5d9ef07e86832e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843983, "uuid": "575afb2e-73fc-477b-974e-a147cf9e6ec9", "comment": "Malware payload", "value": "160d8f976656dcc6e367c15fc88f8a8523e6f8a4cf99acbba5f3e113e1e16dbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843983, "uuid": "ddda92c9-3e59-4f19-bef3-3527463dbf0f", "comment": "Malware payload", "value": "408ec037a40d6c8950f5c8855820681066bf2b6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843983, "uuid": "8b5ddd6c-4eba-4cf6-b399-4dd5c9edb07d", "comment": "Malware payload", "value": "08d3d840c7ec7e84143ff5fd29b08e5fff29c748f82069847e8b6e97707022a60e2f1ebad7be84a9803b9b86bc462b1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843983, "uuid": "a9fa99a2-1fcf-4f3b-89d1-290e030efd85", "value": "T1D4A32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843983, "uuid": "0d8e6cad-92cb-46fb-b566-7dfa780af62f", "value": "3072:1Sd+e6mKaGP0NFD3PpShtKmZuqQ4DPwXXtse:C6mxGP0FD3PiKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629843983, "uuid": "1575b762-150d-42e7-8b97-7082b4de2bf1", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629843983, "uuid": "ee1952ff-3b35-477d-ba56-2c76c5fb2e45", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843983, "uuid": "f1edeb16-c8f8-4827-a4da-8a15352465b9", "value": "e136ca6832e499d90a5d9ef07e86832e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcde6739-04d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629808624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808624, "uuid": "a6dcb8cb-d3e6-4eb5-ab6d-837e3621b512", "comment": "Malware payload (RaccoonStealer)", "value": "579f14b249c3aae5f77804dcc34eff82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808624, "uuid": "d141e1cf-a001-4dff-b60b-65f2fc7222f3", "comment": "Malware payload (RaccoonStealer)", "value": "16ec891cdea96c9a6053fa67e3e9ff7b04ae5ec0746a2c27eb3375dd8a16c489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808624, "uuid": "41ca834a-c50c-4cf0-966f-9f56b5706778", "comment": "Malware payload (RaccoonStealer)", "value": "ee5970fe34035d01ef60cf2cbe9655c0a2502e93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808624, "uuid": "5943cae7-a5df-4d61-b825-c44d152fe6b9", "comment": "Malware payload (RaccoonStealer)", "value": "458990417c76eb7ec9ed8303cedc0e14a6cd52d185df538b742614fcd132e43ac5d7e4870d302d0a4eae31c59a8c19e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808624, "uuid": "d4abf3a3-cd01-4d1f-ad20-cbc37a782e1c", "value": "T1B1941221F160C137D15E097D9CE2CBB2E56A76516B2644437ACD8EEFAE912C0BB2431E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808624, "uuid": "5162a2b2-de9e-403c-a5fb-40fd9ec3578f", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808624, "uuid": "227d554c-f431-44cb-985c-9f98b15dfb0e", "value": "6144:DQftcnFOh6fPNvouMhOvlw7ETpgBs9xfB1dx2FYJqEQb:Wc4hQvoPOvLpjx5t2FOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808624, "uuid": "7ab30a0d-35b2-453d-8d2b-cf08fc15298c", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808624, "uuid": "666b4234-91dc-4b75-9905-96329601dafc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808624, "uuid": "3f1e8f22-72cf-4310-8e55-95532dab7cc3", "value": "579f14b249c3aae5f77804dcc34eff82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66370f5a-048f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629777448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777448, "uuid": "714ff4bb-a7bb-4382-94aa-fed2fbc6b326", "comment": "Malware payload (Loki)", "value": "dff1db58aa3b5724fa459b67786cea67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777448, "uuid": "60262226-0cbf-469f-90f5-7f802fefd593", "comment": "Malware payload (Loki)", "value": "174e45d5d868482d497fe97557fdcb6fd7d89ebcb478fc78cb3f6378bfa6c457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777448, "uuid": "727d345d-4716-4289-9762-8656767cef6f", "comment": "Malware payload (Loki)", "value": "7c76f26f7d2a86ec9fddb979bc5a2e133ee29245", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777448, "uuid": "e91b5a47-d35a-481d-9e9f-28caad24ff5c", "comment": "Malware payload (Loki)", "value": "958b2cf0281ba7c7a19d370a43a3a53aec4b118104c296b41fa0785a289521c161c7cede3337709b0149e158944851e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777448, "uuid": "a778b4d8-338b-46a8-9a4a-7c64f4992161", "value": "T157F4D33D19BA1637C1B5C365EBE58423F149985FB414AE6A6CDE07A7030BA8734C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777448, "uuid": "8d088d19-11c1-440d-863c-42ad84f6d2b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777448, "uuid": "7ea07181-2a55-4a39-8a45-c15c75033b36", "value": "12288:0L8OqSwLS3rCACj4Wi/KVhy+u+mYKevhVx/pgxNno:0ZCwjWi/6hy+u+mYKMx/yxNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629777448, "uuid": "defa1fc5-e717-4c9a-8069-8b987093e041", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629777448, "uuid": "7bbc270b-0b01-4f70-83bd-a0d42a211b4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777448, "uuid": "fb27e28a-b422-403e-854b-6f61f43c7174", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17135798-04ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629818547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818547, "uuid": "de6744f4-caaf-44c8-afb9-7c9501b8267e", "comment": "Malware payload (Loki)", "value": "c675b7f3ef62d7ef787ad26dc04b1f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818547, "uuid": "5204023f-24a3-4b56-b044-4a3d8e2cca81", "comment": "Malware payload (Loki)", "value": "17d834e57da74a4f66bba8b86e498d191ea46e65bd1a4ace8d23c076a6cb90cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818547, "uuid": "c00f2b0c-aa75-4199-922b-c60b7e86659d", "comment": "Malware payload (Loki)", "value": "1be4965818a35698f1220e9a85e60603c3c8d735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818547, "uuid": "6e49e27a-9f06-4e7c-846a-4f4b99f6c4e3", "comment": "Malware payload (Loki)", "value": "3ad2723a9a88b02d44a9afdf79950ef4ed77491a8c4912a74719be6dede8b5a515a784533c6ea4f94c40aea247ee4ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818547, "uuid": "77af002f-63c4-424c-b9a9-babb139571da", "value": "T1D1F4927E1ABDA2278175C2B5EBE79417F0409B5F3410AC2576D203664232A7BB4F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818547, "uuid": "ac010c5c-80af-4396-95fb-0bc9c2c2b2fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818547, "uuid": "d9fbb49f-d430-4597-a168-ca48a91cf646", "value": "12288:xEsswc45xOCrjV4wkaUWTypdAbvwPezzVD92DduR:xEsswc4zDijafTy/m8edJUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629818547, "uuid": "db6b23ca-a4bf-4e39-8b27-62c84c320be0", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629818547, "uuid": "46b321cd-2a57-46e3-b946-7a64301e47f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818547, "uuid": "93afe00f-9dd1-440b-97c0-010cdec15a25", "value": "scanned copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0552e4-0509-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629829885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829885, "uuid": "a094ac9f-d7a1-47a7-b11c-544c57b59766", "comment": "Malware payload (CoinMiner)", "value": "b306c8342945e2e54bf9c52b742d81b5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829885, "uuid": "ff4516fb-eb0d-45d8-8056-4ed2902d91d8", "comment": "Malware payload (CoinMiner)", "value": "17e00c3ad44ba7ca21a4abb6836deec7ae735c810ade5f109e27a990430e7a91", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829885, "uuid": "b41600f8-644e-43e8-9d5f-52f7cdf530d7", "comment": "Malware payload (CoinMiner)", "value": "93d06d62fffed1d1d5536bbdd63e6d62a53bd408", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829885, "uuid": "ca6415e0-d640-4658-b2b6-0727e6497fd8", "comment": "Malware payload (CoinMiner)", "value": "bc07e341447877903f92fded48b0a6acd91c96ac5ad70b27e03de81d9b7d616795334f3f004661baaf2ea408da8e4620", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829885, "uuid": "9085cf86-76d9-489b-a1e4-8fff3eb827b4", "value": "T14214CF0132A0C537DCA6057044D6CBB0EE29BDB25EA5894337E8EB6FEE351D0771A396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829885, "uuid": "4fe4bd20-32d6-4a2b-840d-8feaa5517c96", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829885, "uuid": "42763ef1-9d54-4103-8860-532e34799611", "value": "3072:rGkSMcn7BK30vu5SSopa6hJQKtOgMRZafD4UA1b:rG9MoBJhpaQ8bEcxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629829885, "uuid": "44d594b4-58a1-4323-ae4d-fc6c845309a0", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629829885, "uuid": "511be514-cd10-4a99-ae79-34ea9fbde85d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829885, "uuid": "bb70d0aa-25c3-4256-a92a-7c87feddede3", "value": "b306c8342945e2e54bf9c52b742d81b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca1b8e3-04fc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1629824274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824274, "uuid": "d208d36d-ce9d-4891-99d5-5049508d943f", "comment": "Malware payload (Hydra)", "value": "a69b063e1e864e17a29a9d28b3e41531", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824274, "uuid": "c7714dae-ff2f-4327-a3e6-49a414efa5a9", "comment": "Malware payload (Hydra)", "value": "182252ae86aae33b4b13b824357bc02218e94ae8daaadb69b85101c08e74773b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824274, "uuid": "582b92e7-0a85-478a-9d2b-3ef60642ac7b", "comment": "Malware payload (Hydra)", "value": "67aeb5e5033516434d2c111e35104130d834953e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824274, "uuid": "532522bf-3440-4e9d-bc86-781edd54c524", "comment": "Malware payload (Hydra)", "value": "d6e555602e0d631d18f7a819079688062d2414cfe90fbb3bfb419a720e30d121704449eaebb1bd7842267ba7626f4d4e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824274, "uuid": "6de73572-b59d-451f-b868-1bd6e2724601", "value": "T1B6F5337978A6CB4DE446843580D2FB978204276A050DF03B2FB2269C5D8ED6E6F17DEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824274, "uuid": "eab76f46-1294-4e82-aaad-fa7475e6701a", "value": "98304:DaEuj0rGMikYH8g3o8/NUiY0PbMfCLrXp8UJw23W3g:DaA/MH//DPtBJP3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629824274, "uuid": "616bb0b1-305d-4587-8839-22e62fe0c0de", "value": 3367537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629824274, "uuid": "95a7ba17-f746-45d0-8a2a-9642f1aed2d5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824274, "uuid": "f8a369d1-02e5-41e1-b0c0-a774183dec98", "value": "85106_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59038af4-04fc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1629824241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824241, "uuid": "fb4ea762-5a44-4816-9a30-79cd2e76cc50", "comment": "Malware payload (Hydra)", "value": "7e8a7091147d1514a6826b66d2aea081", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824241, "uuid": "691a8125-9075-49f1-bab2-a090d9340cb3", "comment": "Malware payload (Hydra)", "value": "1a6c8a2854417027d380f9b3572c5e8ec655493fcedc7a95467a80177f6d26c8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824241, "uuid": "0ce6657c-6d57-4de4-bbfd-49e0500d42cc", "comment": "Malware payload (Hydra)", "value": "0807fefad7a37c75da6bffc7fa047b7ce09feb79", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824241, "uuid": "cad09e38-4c18-4a79-bfd8-3c76300e8669", "comment": "Malware payload (Hydra)", "value": "f1a990dc188f4f88512f36145d757a172986d0db9fb9a61988d3c3c6c8b014780a518d74c0b9ae6da5efbb01f5c4765d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824241, "uuid": "637ab417-22aa-47c7-ba4f-3ce650460cd5", "value": "T1D1F533E9AF81D789C32BDCB79183CED341941F8430CDB9478A26568C9475D4E0A8BDBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824241, "uuid": "be2c6228-0f6b-4f8b-b2b9-fa96d4521d11", "value": "98304:JZDpcLbfjT9Fa7G4r+myxsgjiTrXLGjA2QAi2r6k3W3c:JZlqzf9s64r+ktGjFQA5rz3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629824241, "uuid": "58fff185-a58d-4fce-ac0d-4a50cdcd602f", "value": 3367537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629824241, "uuid": "ca2f9875-cebf-44a1-9ef3-70ec8d9c42d2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824241, "uuid": "61cf7c87-a557-4ac3-a878-791e823ecada", "value": "68930_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f679fb-04df-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629811827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811827, "uuid": "f08171fb-78b0-433c-8456-07fca9bb353c", "comment": "Malware payload (Alien)", "value": "74ff2c72c16aa2909fdb5adbb83f122b", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811827, "uuid": "6ff681dc-90a0-4aba-bded-12071ee01a85", "comment": "Malware payload (Alien)", "value": "1a79724595a99052723f2422d57ec93b1f62e1cdb2121ae9ae2175b107e60a00", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811827, "uuid": "25632a25-10d4-4f7e-a15e-33934e8c0200", "comment": "Malware payload (Alien)", "value": "eafc99acfb4757ee27bce2b2bbac0e08bd6f6b52", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811827, "uuid": "f2111c90-b42d-43ee-b37c-b088e09fcf75", "comment": "Malware payload (Alien)", "value": "b5d2b15f4dfc1a5accf9d5cc80735f7b8c20c9b854ef723befd25c966f7d90787729c42500fe88e4f9b14b7af2aee7bc", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811827, "uuid": "0af063e2-1c07-4461-8ebf-c1fa61b04389", "value": "T100261256EFC09827E142A870B1134197AE154BA77000F82B25A7A45E6B77FB01F35EFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811827, "uuid": "01110770-d6a5-4f9b-b72f-9766e7476a03", "value": "98304:eiyySaTQmA1mTEw07N01PtM2G2LqUrSUjvbLqs50MISGhGv3Jn:cyS/CTEtN6FvGLvKui3Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629811827, "uuid": "974399f5-fae2-41dd-8cda-79cc800374ae", "value": 4493024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629811827, "uuid": "af6b84a8-ca22-4918-9528-a946110112f5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811827, "uuid": "b25eddba-0a24-4749-95a6-4b159d6d83b8", "value": "Chrome589828.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032ee5aa-0470-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1629763967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763967, "uuid": "0878e291-7f2d-48ca-ae81-b0fd18b84999", "comment": "Malware payload (Tofsee)", "value": "436e17ef9e2a6ad19ecff23cf1f6e642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763967, "uuid": "f07f2991-4713-43e4-851e-8ff4474e6ac1", "comment": "Malware payload (Tofsee)", "value": "1ae374502df9e63ab3d4b3bc2611b0758f97285c3eb49d58713fd654ed9ab756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763967, "uuid": "a6387414-9846-4d82-892b-9d47c6d55595", "comment": "Malware payload (Tofsee)", "value": "68260081ce98caf5cca43e86cbbeb20d69018e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763967, "uuid": "31a70936-521f-4716-9420-2df739f1dea7", "comment": "Malware payload (Tofsee)", "value": "49ac6e34bb8dcc17a191207662e2942e378353df3c40a86f879bc473d19939dd373c64ce7c98d1715cd46f762a5d93c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763967, "uuid": "8a3b0e30-f901-47e4-bda2-e60050ca4a6c", "value": "T1EF547C30AB91C034E1F611F859B683B8B93A7AB16B7450CF53D12AEE56386E4EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763967, "uuid": "4b871506-57b3-46ed-b9d6-16f0f01a233e", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763967, "uuid": "bfdc6039-7cfb-4c52-b1e2-b35603c4e7df", "value": "6144:pVJT4T3mCj3AR3ulKKx4/PYJaFan7EFmDcjpPj6wzTWpW8GESzJuee:tTG3muQR3Jmko74mDQPjL3WpW8A9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629763967, "uuid": "7bbfae72-f1bc-474e-a88b-97140e201f94", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629763967, "uuid": "2f718323-3470-4a7a-8acf-ef6e50c0f074", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763967, "uuid": "9cab4442-4db0-4dee-b158-796931d59653", "value": "SecuriteInfo.com.Trojan.DownLoader41.25700.7371.25329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631f957b-049a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629782167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629782167, "uuid": "48e061f3-6a6d-4238-bc16-de126e1c4503", "comment": "Malware payload (RaccoonStealer)", "value": "980de5d0befa8f49a4e41bf033633bad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629782167, "uuid": "c727486d-58ca-4b04-9878-6e2ff8940785", "comment": "Malware payload (RaccoonStealer)", "value": "1b4d4888df7a07d7a2d2f9f6701b834c254548a0ed9f4602ecb114e1a92eacd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629782167, "uuid": "e2b8bc5e-0ed7-4672-9ba1-6dfe61d98a72", "comment": "Malware payload (RaccoonStealer)", "value": "4352982e3822b111d3b43b9ccf49d9270358931e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629782167, "uuid": "f57e35d7-ed6a-432a-bd6c-380e4336a19f", "comment": "Malware payload (RaccoonStealer)", "value": "9f6a8c7c6e51194a80bf84cafde8500d6b80f587f5a7722103c2d0183f0172e53e6bf155a0dc00654581bc182fe43b66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629782167, "uuid": "25051784-6570-4383-b4bc-73311f49199e", "value": "T16B940211F810C533C64DC6304AC39590E97ABE616BBE52C33BF057AE5E326D1763A2B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629782167, "uuid": "2821333c-39c5-49bf-be67-431390ef5415", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629782167, "uuid": "95607d1f-5447-4bc2-9893-493635600f85", "value": "6144:IZJ+HGylisJijTFzQ4fP9Fd6zD+zdoU49fN+XJ6kwWAIFf8eKof7xIM+3:IZnyl/i5Q4fVzFIf1b2FU/oWM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629782167, "uuid": "7540a57e-cef4-4de8-9a27-e0f053e0309f", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629782167, "uuid": "a35dbe79-c3b5-4590-bf9a-93cd2a0865f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629782167, "uuid": "f312ef40-9fc6-45ac-ba91-d408ebf2be87", "value": "1b4d4888df7a07d7a2d2f9f6701b834c254548a0ed9f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979f3787-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629786550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786550, "uuid": "7475c605-d00c-469f-bf48-e551a50b4118", "comment": "Malware payload (RemcosRAT)", "value": "8852b3e6c42fc2e82ad6f7c1bac0b773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786550, "uuid": "1ec47b82-529f-4549-ac2a-fc1b6453f1a5", "comment": "Malware payload (RemcosRAT)", "value": "1bdb2bb10581f1ff96824ff8e8ee07de970bf051d63c2c9d216ad9744dc75804", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786550, "uuid": "fd2ce76e-66fd-4bfa-b64e-1fe527c5cd2a", "comment": "Malware payload (RemcosRAT)", "value": "06c3eab70feb601fd7940f69aaf4b13905d7ae06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786550, "uuid": "b30738a3-1c15-4958-86bf-ec7f2d2bfc95", "comment": "Malware payload (RemcosRAT)", "value": "80d4aae7c105786e7ad5c964a2a4da31bc9baddd2bdc360479bc7d055a16cbd6919adad307abfbf00c475c5b1384595f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786550, "uuid": "bf4a6cdf-9107-478a-acf0-f310e1927c82", "value": "T1DCC4E14773908A21C7C46A71D0A305384BF3EA8B7673E78A2F0C56D55E823B4EC5A7D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786550, "uuid": "8b000d1e-6cd5-43ab-95b5-157eb13f6040", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786550, "uuid": "f3783e34-fc51-4e6d-9a36-7a98d575a2ec", "value": "12288:Wr60N0zj03lrTh9Hr2ikQvA9RhuYYeWiRj6etJLugjpwSi:Wr6K0zjcrd9DI7HKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786550, "uuid": "090a167d-ec5b-4543-96c2-a66928e0a553", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786550, "uuid": "9cb65f39-cb30-439e-8fdb-72646f2257f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786550, "uuid": "69276c57-9c15-4d09-b865-03a4f84d1e00", "value": "8852b3e6c42fc2e82ad6f7c1bac0b773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24a721e-04d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1629807184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807184, "uuid": "6a95ee1a-35ac-483b-a5df-080696994fdd", "comment": "Malware payload (Hydra)", "value": "1a1c0beae19827530fe6e3fea729845a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807184, "uuid": "5192d640-43c1-44b2-bc8b-9bcd02372319", "comment": "Malware payload (Hydra)", "value": "1cd704ca2729a62bfab839ffdc5fd1c19de0bc15fb961da305c7ae1ccbe8e1c7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807184, "uuid": "29533510-dd49-4f73-87e7-c70bebc7849d", "comment": "Malware payload (Hydra)", "value": "0accfe19ad55130c45063cd0cdadbe9cb002437f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807184, "uuid": "3e598eab-6bd8-4cc1-adaf-c71302ffe887", "comment": "Malware payload (Hydra)", "value": "b164f2c3649c935f1ab1b5098d17c4962e26326ac19bfd54e36dbd7384b109ad74bd8a4b5febb483abee74ead9d18d2b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807184, "uuid": "6ccff0a3-a26d-4d18-beb1-26568c853898", "value": "T184F5331D7EC0D654E20BB132CB9BA5E3020D5E4A30A0E50B05B297CD64F5D5A6AD3EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807184, "uuid": "9d4d17bb-7b11-40ce-b388-974e35a43461", "value": "98304:9KvwDNss09Wro46vM78DvADyLrXnUCHGY3W3PcF6dM:9KvwxlcIb6vM8Ay7Hj3oOcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629807184, "uuid": "6a01b5f3-fe1e-4d03-b3a4-24432f796f2d", "value": 3367537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629807184, "uuid": "6b141832-7096-42ad-8a13-7284fbc87aa1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807184, "uuid": "aff26967-9ddd-4e0e-9ead-c7d997dd889f", "value": "18562_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f21bd87-0500-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629825915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825915, "uuid": "63a3e1f2-1fda-45fe-8313-583d0e09f700", "comment": "Malware payload (DiamondFox)", "value": "341df9edc889079470d9108d702a5bfa", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825915, "uuid": "498d3670-e31e-4518-abc3-e33c0e352510", "comment": "Malware payload (DiamondFox)", "value": "1cf6570844a3a440ad731d0c72ed9bd8369f2cfb44243a952942f91097767776", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825915, "uuid": "112251d7-72d0-4c28-a186-f3983ccdcd18", "comment": "Malware payload (DiamondFox)", "value": "dd1c7de40ef944df647df9b273072c72b467fbf4", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825915, "uuid": "9851c302-faa9-4da7-9b6e-b5cc853be45f", "comment": "Malware payload (DiamondFox)", "value": "69c2b34136275b9c3f46b79b1d96c130ffb96918cb60ffc9abdfdfc51ba9d4566cc5ff0c604650cdfc5110905e272f91", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825915, "uuid": "bf4aaa8b-193e-4573-b442-a39e8f620fb8", "value": "T116D47D11B344769ACC7645308951C1E5152BBE395A2297B7F7E47F2EEE3E0C38A30A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825915, "uuid": "537300ca-ab0b-4387-adb9-f16037d3b40f", "value": "1b90ad0d3d7218730afbb0fdc6bdf7ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825915, "uuid": "c999723d-3f51-408f-b267-d4c43c3b9e78", "value": "12288:5hckP/FOzgwvyf/18gxuDPU69Kw6VafLxVFFDTSVvkVixVVtY7+MSC1ml3dojnGy:52kPNOM+y69Kw6VafLxVFFDTSVvkVixS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629825915, "uuid": "98785fd3-e44f-42f1-9a96-c65625a216f2", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629825915, "uuid": "741277bf-8b35-45fa-a474-ca9c8f9dcd70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825915, "uuid": "f498a40a-430d-4217-94af-4830bc556ce0", "value": "341DF9EDC889079470D9108D702A5BFA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919876b5-051c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629838080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838080, "uuid": "d8fbc23f-f4ea-4ae2-9a25-75bf8f356c36", "comment": "Malware payload", "value": "12b49a31ec3ac087a155b739e3ec64e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838080, "uuid": "9f39d1a1-a37a-418d-bdc2-434183863a85", "comment": "Malware payload", "value": "1d1b6600cb9def0b4960f29a38396ca4482f821f12b4832fdd42cfee75469165", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838080, "uuid": "4c2f23c4-6726-4040-87bf-9b98e27198e9", "comment": "Malware payload", "value": "44027672874a6fb6b8e621e88c8610ff2fabbd63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838080, "uuid": "d0f5edb3-4d59-49a3-8813-520dd3728661", "comment": "Malware payload", "value": "4e051280149736fa25a285c7a795a3e0ad1a20307825b0b8c0c8abe7ef35dc5253fd8746c9074be7d40aa64ea36e4ea2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838080, "uuid": "8e9c371d-2190-41ec-b5cc-674b330df22f", "value": "T1C26318337B271E23C0CA55B144E30332B7B5DB493CBA4797B9956E983F12A8438167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838080, "uuid": "e2865e18-b290-403a-9294-eb17ea5a0f6b", "value": "768:rU/+HP/DwHJGoBhzoDJmtSAo1O+YM5V6kC8j7t6Ib6W7v1DS46:NDwH3PtVCYM5Pt6W9W46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629838080, "uuid": "bfd94e83-0535-445c-bd58-9f1376a01b37", "value": 70180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629838080, "uuid": "44b779e0-f740-4e2a-bb17-1dcd38210ee1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838080, "uuid": "a58aec56-1675-4f98-926b-0da7d9c1f49b", "value": "12b49a31ec3ac087a155b739e3ec64e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161836b8-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629786333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786333, "uuid": "2adf211c-f9fc-4bf8-b295-5985bf86e521", "comment": "Malware payload (Smoke Loader)", "value": "9cb0f10770d10bb5fe00d502dfa9a754", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786333, "uuid": "283a71e9-64ee-4f54-a556-d025a204227e", "comment": "Malware payload (Smoke Loader)", "value": "1d56c98200907afafa8a54f802c21ed824e1827162fb19d8f73cf8a8bb61b7f2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786333, "uuid": "c9e6523e-4c8d-4aaf-a321-ed2be2f1441e", "comment": "Malware payload (Smoke Loader)", "value": "b7d7cf699d6a43c631c6b3065e4f50d70e7a8179", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786333, "uuid": "e31309a6-94fa-4791-b3d7-421117891a0b", "comment": "Malware payload (Smoke Loader)", "value": "d7ceafb36a2d02358ea2bd0b6e5e4e15932e875e1b883028b20b61334250f9c823c2bdb69573dd0548dd109f6e99f97f", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786333, "uuid": "15b7f424-a514-47e8-b602-9d7cc6b025c6", "value": "T1AA547C30AB91C034E5B712F445BA83BCB93A7AB16B3550CF52E52AED16386E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786333, "uuid": "dc34f1f9-aa1e-4447-9fda-6314e0677f36", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786333, "uuid": "ba470d2e-0047-4e2e-888e-08ec12edf217", "value": "6144:CYqKb4oEmrj3wwofXBxcuYCKsK6P/ZVD/CUOs7iwpdM7jAk:YKbJEm3gwsagpPxVD6u7JrOMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786333, "uuid": "84062516-29f0-4de7-bcd2-ce5b3a4197e8", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786333, "uuid": "83c9602a-1ad5-4b48-8d64-5caf4f40ab1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786333, "uuid": "f8b3ae1c-bddb-4253-8c86-b9ce0c971130", "value": "9cb0f10770d10bb5fe00d502dfa9a754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e439e07-04e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629813459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813459, "uuid": "72473e3f-7d98-475b-bb82-2bd0e5a57db9", "comment": "Malware payload (RedLineStealer)", "value": "c91e50195ef24ac8d09727982fc7e905", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813459, "uuid": "b6047fcb-94f6-4caf-9da5-921f0c728a1b", "comment": "Malware payload (RedLineStealer)", "value": "1dbbeb69f4ebfddfc611a8c517b28942353e2572c5f26229f6d0948e26c28109", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813459, "uuid": "bd07bd18-d361-4a28-b31b-88f459385a03", "comment": "Malware payload (RedLineStealer)", "value": "b45bc6d99d4f1e42a0a09d1366907d4a0b2daa3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813459, "uuid": "08bcafbb-e615-468d-91b0-ac0e8ca8e65c", "comment": "Malware payload (RedLineStealer)", "value": "480370f2336b9b52bbda2056ad0f3c0e9e7885d47513da43642a36ab019cad47f7a758cbf029ccb14295b6145ec80a8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813459, "uuid": "5e801c2d-18df-46f6-83ac-1f8ddc60f194", "value": "T121C4126235E08A33C4579A7088D5E760F57574420BBC448B73D6DBBF2D272E47B6A223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813459, "uuid": "80d2fa38-2069-479e-8b85-5a6649bab095", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813459, "uuid": "e361c18e-b334-41c5-8d90-bb18a8b27c48", "value": "12288:N2E3SxcubYc4XmiQQycLK0idkgaSlDOS5l2wnWO:Ns2uHiBD3id3a2DOS5gwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629813459, "uuid": "cfbae7f9-5d2b-4432-9322-c1277983cd32", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629813459, "uuid": "e80460c6-6d7e-4dea-bce8-4fcd8930b18b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813459, "uuid": "5ba1ae56-ef76-4b29-8c4f-ad3bf11864fa", "value": "c91e50195ef24ac8d09727982fc7e905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9641c5a-04ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629802928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802928, "uuid": "d6c97116-a5d3-4d01-b0b2-98986292b61d", "comment": "Malware payload (RaccoonStealer)", "value": "079a62e755c81905d82590a25b4b28fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802928, "uuid": "e4faab2c-46b7-40fd-8428-1e710d4ffce0", "comment": "Malware payload (RaccoonStealer)", "value": "1eafd3db9ba42f6682aae969d90f2fd2f986093a9592e36f7012d7532321e52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802928, "uuid": "efc9df94-df03-4953-aa89-683c21442a98", "comment": "Malware payload (RaccoonStealer)", "value": "ca5d9c6864e8152cb38914f3adfc2699e0339d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802928, "uuid": "a557f408-9254-4ba2-90d5-8af17cd57dc9", "comment": "Malware payload (RaccoonStealer)", "value": "b4bf6e66bf9409e3c5ec219ea9573034bab67d300eb9b34593ad1747fdf15ab603e0df6b5832f0871133948d1f74a747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802928, "uuid": "26d1bd1d-7e96-4d05-997b-027f77ebf8c3", "value": "T134941222B5B0C433D08205F25DDADF61E999B511AF61124737D98FAF8A63280B73E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802928, "uuid": "b1482970-03bd-4a7b-9812-45f4a24ef1d6", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802928, "uuid": "e01f941f-bf75-4326-8910-61306bcfcb70", "value": "12288:q4Qfv/RIpIAfkOIx7p4XU5uSPwIKzjycIVVPYvnpa6Er:q4Q/KpIAMBlIUcWxOj9igv46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629802928, "uuid": "85559033-3c3e-4422-baa0-eb9f35eae819", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629802928, "uuid": "88442ddd-2045-43c0-acf5-ae3e8ef8bf85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802928, "uuid": "58269c68-5131-485b-8e12-c7d10cadd6d4", "value": "079a62e755c81905d82590a25b4b28fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43caefbd-0517-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629835802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629835802, "uuid": "9e96e07a-1d82-45fd-aba4-cef211066ffd", "comment": "Malware payload", "value": "3da27a30b57ba6c9e2b64203ec268fc8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629835802, "uuid": "34486de8-9cd4-4723-9684-f0fe0a8172ed", "comment": "Malware payload", "value": "1f1377592f28fff06c0221c5c1f6e52ab949bc96701b3f05fd27d079915e57d3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629835802, "uuid": "661ca30b-aa86-4e30-8074-678986624388", "comment": "Malware payload", "value": "2b520eca3767e8a3039b671367092de2b21e1da2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629835802, "uuid": "a419f8e5-e7f1-47d1-bf9b-ce3d858d2ab7", "comment": "Malware payload", "value": "b2a13ced53ba592a6d011cd6d795397c6e6dd91e8d57689a66063ea80046cc774b7b83ee084eebfa15efa7c1c215a048", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629835802, "uuid": "91d799d5-e1c8-4bf3-a5cc-08584f4d4904", "value": "T1DA03F905B391C622F19246354DD7CBDB733CBC09AE21832B33947B0EBC7A6B48A16724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629835802, "uuid": "7dfc5448-bd3c-48de-8e4c-374d4fcb6a4f", "value": "384:3S9D8yGcSdW+wRsCBkcsUAwJVVCNTBJukz7Wo8I5dginAvYthGjV2/:aVKCBKeVCTuqWo8MKDV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629835802, "uuid": "2564b7f2-880c-48d1-9530-ff400a214a0e", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629835802, "uuid": "86659de3-3f65-49d2-99b7-e838bece7062", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629835802, "uuid": "66f851c5-d51c-457b-a7c2-2604ad6cb952", "value": "1f1377592f28fff06c0221c5c1f6e52ab949bc96701b3f05fd27d079915e57d3.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c009ca-04a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629787305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787305, "uuid": "4df4100f-2d16-432b-8106-07dfb6f74106", "comment": "Malware payload (RedLineStealer)", "value": "f48bf19f4b8ce988f58ceb4b7f79c930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787305, "uuid": "b99720be-eaa0-49f6-af64-7160cd5042da", "comment": "Malware payload (RedLineStealer)", "value": "1f4e13efea5ec1a2b000324a2546c450f0b8e29f6cd657cbef8f44ec67a5230a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787305, "uuid": "9ba00899-7d8c-4f60-916d-e2006e823300", "comment": "Malware payload (RedLineStealer)", "value": "de9a1f3cac2977adbfb7e37e52fe09287b7217c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787305, "uuid": "b6175c15-9494-462e-a6a5-49fce419c4d9", "comment": "Malware payload (RedLineStealer)", "value": "5f925ab36769b833b8fbc9c26fb5feba029fd6ab4aa268c0cf9bea489abe47dc1843818c4f7caedaa619b0c3df5a5552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787305, "uuid": "832b7289-8b96-4df5-9f37-02112253d8e2", "value": "T19444E11276B0F433C453417088D1D7E3E53AB9829AA1C1877BE7276E6E312E27F26356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787305, "uuid": "ed7a78a1-585c-4392-a884-6be1205f8d92", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787305, "uuid": "7c841f00-e0f1-4618-8763-4bbde7e44805", "value": "6144:5aId+meaZVkQVYtcqlCjWo6g8cN84KYG:5aM+meaZ6QVYtcqlCjbvN847", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787305, "uuid": "7b0e319e-5a78-44f8-890b-2a9a989a06e5", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787305, "uuid": "1445590b-e5b5-4b94-9ed4-d9d2b0f5d2ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787305, "uuid": "3172f792-2e5b-4651-b733-74195b77422a", "value": "f48bf19f4b8ce988f58ceb4b7f79c930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccad840-0514-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629834609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834609, "uuid": "74aac491-7042-4535-bef8-e95af637b2ba", "comment": "Malware payload (Mirai)", "value": "6965cadb69e3c5887c297b2013d39608", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834609, "uuid": "f0180edd-5dd7-4172-9ecb-f62d8f4713ae", "comment": "Malware payload (Mirai)", "value": "1f82852d2d6d84af52b1f137fa8a728e45f733dc24523798459a38eff12d84d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834609, "uuid": "5351c767-63ad-433b-ac4c-f55ccd3c0e60", "comment": "Malware payload (Mirai)", "value": "e0001f780bc54203ebf482ba1ced825f966a7aec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834609, "uuid": "22de9af6-cc05-4026-a6f4-d12cc96686ac", "comment": "Malware payload (Mirai)", "value": "5c4af36da20f14d1189ba1dd61cb526f78e4a4edbc150436c3b327cbe028738c170717938d5ea02c4d5f35cf42902e5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834609, "uuid": "c87a5d87-fa06-4f46-90c7-d4862fba2c28", "value": "T16BB2C0A16A9D21F1F2D06A7BF5F849C9739A46B4C09E72A0372402FCEF8109159F9199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834609, "uuid": "8bba5351-dccf-4399-81d6-f2776c25e575", "value": "768:VwwgSUT279k8X3MvHKMdcWvQTE5LlptUO3Ud:WHOWW3MvH3c4BptE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629834609, "uuid": "9379861b-1061-430c-ae57-fb20a60b3822", "value": 24696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629834609, "uuid": "6336a750-23c5-443c-b613-42f389d4410a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834609, "uuid": "48d2ad83-fe96-4afe-8e0d-0536679af9a0", "value": "c0r0n4x.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382f4725-04f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629822468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822468, "uuid": "aaab470b-d882-414a-8ac8-6da684594c4f", "comment": "Malware payload", "value": "ecb966cd32eba8383ce4b67aa13eb2bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822468, "uuid": "42be8721-0302-4840-9c29-8f318081e09e", "comment": "Malware payload", "value": "20538d7772510a1a23b69ffcf5cab90f330bd665fc68fba30da4334dc0af0c19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822468, "uuid": "aecb429c-01b7-4d52-a715-b8dac7d6d8f0", "comment": "Malware payload", "value": "f914d42a20b819198e9e6aebd50dcfe37be8f8eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822468, "uuid": "0f65227f-8e6b-4180-acbe-6fa1c658c4c6", "comment": "Malware payload", "value": "a67d0ca86947e9b6f2eb923b189cdde5f1029867060925142da27ed966fa3b5f61c9a188459d994bfe6b0764dda4ad2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822468, "uuid": "4270bb8d-9c6b-4bfa-85c4-acf68af6b91b", "value": "T13F677B3063C9C294EC1A8EF0167CF79002F235E7B6C5CD6E16DA724CCE5A9D16A0769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822468, "uuid": "f32b11f6-fe66-428e-8221-622cb7a668f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822468, "uuid": "da1e81aa-7d7b-40b9-bfdf-5c02fd61e328", "value": "12288:xpcsGI/cb3iVafvMU4lyc9YFjLChqznWB9hIl5jexZ6rjwX5x12EObba:xKyVIUD9pBolg6KH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629822468, "uuid": "57d824b9-3ac1-4c55-8a2f-9cd2b7977786", "value": 32505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629822468, "uuid": "a10a4685-80dc-43cd-8c19-335182774d9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822468, "uuid": "53dc6f7c-c684-4c64-9d54-f5563c667ca2", "value": "HEK_QUOTE_53297.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f4328d-04a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1629787321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787321, "uuid": "60295442-d2d2-42af-a0e5-1da1553433a7", "comment": "Malware payload (KPOTStealer)", "value": "d4bcbd31d9138b2d6f86d109c4dad6f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787321, "uuid": "6e9d6933-7092-4c2a-87e0-31ca81116b31", "comment": "Malware payload (KPOTStealer)", "value": "22101fe25d7a6acbcec8dc39d177dccb0fb56e6f08f95876963a9f3dfda01b5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787321, "uuid": "ee6995f1-f809-4b65-aa0a-af521d70f6ee", "comment": "Malware payload (KPOTStealer)", "value": "bb2d1b4e68a3e1b9869f0a5755e25ef16ac664b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787321, "uuid": "a6cd3d0c-a25d-45ec-9da2-e1f47099c0e6", "comment": "Malware payload (KPOTStealer)", "value": "b358058752e9687787cd452003af2c44439b303cd3d105174560fd440ec2adc98753e983d018476cfde31f68fe1f997f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787321, "uuid": "09fd1921-4598-4389-9f13-ddf38c14c0ac", "value": "T1DF74F1107BA4CD37F541723588E59AF1F22EF955AA7688373BC816AA1EB01D0F336316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787321, "uuid": "4916606f-a4c1-4be6-a0f3-9094d903395e", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787321, "uuid": "0302978e-896c-41f7-a90d-fb355f9c29c6", "value": "6144:OsF31t5bxy5WCICtRec+a4r+Faw6zW6CIe1w:OsF3FxYlIBaK+Faeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787321, "uuid": "fb8bbb80-1f49-4e48-adc8-eaa7b153cc41", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787321, "uuid": "a8ffd674-f901-4d51-8c62-a597cc065eb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787321, "uuid": "148c997a-a47b-409f-80ef-35313d97010e", "value": "d4bcbd31d9138b2d6f86d109c4dad6f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6101af-0485-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629773406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773406, "uuid": "a8437b70-a1b0-45af-95bf-4b324d0d9750", "comment": "Malware payload (Mirai)", "value": "6632cd3f2e45dbb4d98dac108f79032b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773406, "uuid": "8fd610f0-dcdc-4bf1-bc1a-7286feab1da6", "comment": "Malware payload (Mirai)", "value": "221613a67ed91a8dd86dbe33b8e5c0982c44644d3dee85f93b8f67e65b503810", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773406, "uuid": "0c6324b2-4ea0-49e4-985d-4d6844166168", "comment": "Malware payload (Mirai)", "value": "43f937d408d367e1b51b77750e86c14fbdb8bff8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773406, "uuid": "c9fc2830-895b-4470-a78c-6873214d0262", "comment": "Malware payload (Mirai)", "value": "59baccc254bc4d5518a35941e8d9e8595cce693b1543870f61760797ebeb810f7ac0c26687dd4aad11fd8fed840d4d3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773406, "uuid": "a52b45d4-b5ca-4c00-9612-e3e11a2b157a", "value": "T14CD21B85B9819A03C5C55277F61E038D3B26179CF2DF3303AE2B6F51279B92B0E6B446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773406, "uuid": "ff20370f-7a31-4f81-ba8e-313b274aa769", "value": "384:isAs4ZcvZsCbriwK28u56utT36l6fuLP7qupRUDNEJQ1BPZJH/GZITMubOFx4eyQ:isH4Kv2Cqwtx1sREhHhJH/PXfh1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629773406, "uuid": "d7b58e45-5ccf-46a7-9946-737789f06224", "value": 29760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629773406, "uuid": "1d096445-d783-4565-aec9-5772fc53b098", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773406, "uuid": "661cf1cf-3fc1-4332-b0a2-6dffe799f4b9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af92a2d4-0524-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629841566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841566, "uuid": "8d0fa0ac-2133-4fd0-859b-b932942e00a4", "comment": "Malware payload", "value": "76e7cf67db78239f871e3a1184efe657", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841566, "uuid": "8cd65eee-4ae9-44b4-908b-3eaaf603aa89", "comment": "Malware payload", "value": "22731870ca0ece8bf4615462b522c8f42f84478a575ade07a06cbdd842cddfb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841566, "uuid": "1d2a920e-69bb-4705-bddb-799beb61208b", "comment": "Malware payload", "value": "6b16279a3b03b67eb8d6ed721d707b687f2a6bc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841566, "uuid": "2ffc29c7-0d65-494c-b429-c66ccdc8dc38", "comment": "Malware payload", "value": "fe758ff91ace7f714f5f249d4a4834d5209f68667354b8833a4a3dd9ff47f37616d9eb6617eb0e2b3061b36eab42879f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841566, "uuid": "b97c2a54-fafb-4c26-b095-8ebc77b3c1d3", "value": "T105136D0276640E47E1514AF9282F27F083FED99125F4BA8D190FDB120736F77298AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841566, "uuid": "43cc4ec1-0d97-4487-ba30-eaaf256882e1", "value": "768:UYfPffzWfQuxL/j4oy9RTcEYyrm/EkCx7qn5yQCGEgvM3f/3Szte:UUSfVj4oKJryE32yQTJvM3f/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629841566, "uuid": "dfb3c837-d455-4227-8cb2-5617e9f16957", "value": 43537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629841566, "uuid": "feb3e098-52e3-4aaf-8962-b897e1673539", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841566, "uuid": "575663b8-c26d-4608-b4ed-1ed6c0fb9169", "value": "76e7cf67db78239f871e3a1184efe657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99bff47-048e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629777239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777239, "uuid": "def0eea9-66ec-4cc7-8967-3f32e081c736", "comment": "Malware payload (NanoCore)", "value": "6b2e5b5da9e46c293c28586fbcb9a44c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777239, "uuid": "36ad8fc0-2a94-46a0-a5ea-56f2d470597e", "comment": "Malware payload (NanoCore)", "value": "22f88dbb28d58e10e7519be3ffef6b64a266f4d8d14658ffc2a5d6c327878140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777239, "uuid": "e208891a-6699-43c5-804d-f3466bdf15a3", "comment": "Malware payload (NanoCore)", "value": "ef24b12fa97ebbcb87159730a58a49ed0aafc786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777239, "uuid": "716c7768-b1e4-4f67-86c9-37398f33eb4b", "comment": "Malware payload (NanoCore)", "value": "630cd7c361d10c8d6233caa75c61ed2fde30ed81866d3617fbe8d7026d74c38fbe29f2b3a2d1111055e62820b0c2d2cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777239, "uuid": "1b1985bd-8484-4c48-ae0c-9f18e82105f1", "value": "T11905D14472B65F92EABD8BF46932611007FA7D6B656FE30E0DC530DB15F2F101AA2A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777239, "uuid": "a12435ca-74ea-476a-82ac-1692beafe383", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777239, "uuid": "b62d3051-ae4b-4730-b674-1993e8939d0b", "value": "24576:CjlWZxwG54G4ND1LZiPIM2cZS+GImynFG:elUxDcZLZiPIM2cQZynF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629777239, "uuid": "b8061f29-d2aa-4640-a75d-6c988dd2a5dd", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629777239, "uuid": "d151c0c9-354e-493f-b4e8-b3444a75e372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777239, "uuid": "ca233151-6956-4c45-9221-9930cf789690", "value": "Remittance Form Payu.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8356fc2-04ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629802926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802926, "uuid": "58dc2d02-0370-4bdb-b7d0-fe67abe2b061", "comment": "Malware payload (RaccoonStealer)", "value": "ab270565df70533f0023598f4ecf4987", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802926, "uuid": "d5e7bf3d-8ef2-4a1a-81b0-8a6ea1dccc00", "comment": "Malware payload (RaccoonStealer)", "value": "24d889bae17743c94b494b98147438603a42b396594592c3d5e6b104742b3547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802926, "uuid": "b12b72af-12e3-437f-9ac1-e5b59c8b5b18", "comment": "Malware payload (RaccoonStealer)", "value": "f1943fe6f8df6584a6ca2f279a2ddfece4d11f1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802926, "uuid": "11e4f43d-a032-44c0-9049-68c646db41ff", "comment": "Malware payload (RaccoonStealer)", "value": "5b8ff51dcedf9ced0cacdf30ea928515f62a0e26fad825a648368ceb9c57a5963b6dd9252fbd27f8aa59605d5681e3a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802926, "uuid": "23fc88bc-fff1-401d-a4c5-25757a6d2b88", "value": "T1F8A4121E7AB0C276C54A0D748895FF64CD32B81167C04D8B76A9AD2F3E357D2722A743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802926, "uuid": "4fb4912c-c892-4022-bfc4-36801cf3b302", "value": "6b22ece31495fe337ab5b098b4e30ca3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802926, "uuid": "bf641b6e-309f-434d-89b1-c936994cc70d", "value": "12288:wqIfZ20e+sooa6pKnOohkcojKOlrxXdPAH:5QNe1aIKOEFOlrwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629802926, "uuid": "e8603660-e29b-4691-ade8-d2828697ce8f", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629802926, "uuid": "26fbd6d5-f203-453d-9918-789ec5723b03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802926, "uuid": "e516e828-27e0-454e-b7c7-b0227b2d8e62", "value": "AB270565DF70533F0023598F4ECF4987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c67d92-04de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1629811300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811300, "uuid": "81b25b5c-ea2c-4478-b127-583a01e34a51", "comment": "Malware payload (STRRAT)", "value": "00c6403b831a9a510743b7cb1f3edc62", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811300, "uuid": "e3353a00-97e0-4934-935f-2c692389fb96", "comment": "Malware payload (STRRAT)", "value": "269ad9c64667ee8349c77e0917b256ec7b16cd256f02ba3fc7258b844a9742db", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811300, "uuid": "f66baa5a-95de-4f2c-8b8b-c14b114e3948", "comment": "Malware payload (STRRAT)", "value": "83cb65673aa680082875b7795d71a3923142adeb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811300, "uuid": "517ab479-72f3-46a6-a423-ac9eef23026a", "comment": "Malware payload (STRRAT)", "value": "ac9445d524be4c4a30cba189f9d2f803622eb37bd1ab5ac65c0856ede5deb520d141cc7db45055249ea07cbc1a827aca", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811300, "uuid": "3bfe9919-adf2-4e8f-8913-444b3767e0a9", "value": "T10FA3C01F7DEA80EAD54F7477970D8236AA4F1189C91AD52F71F806015CB2CA81B82ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811300, "uuid": "54af132b-57a7-4989-b56b-afff55a2d054", "value": "3072:g6XYBrmewh+tsLXyGZiv/JAlPu7HYnelp5BVHJ:g6QrmXXFIv/+YYeXLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629811300, "uuid": "e2c528d1-e5b3-43ec-bf65-0ffb2a3dafad", "value": 98316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629811300, "uuid": "701be8df-691c-40b3-be3a-01d387d4e7b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811300, "uuid": "44a58461-dd92-4957-9a70-f375dc7e61d3", "value": "401k-statement.PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4193b4eb-04b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629793707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793707, "uuid": "93b2fc7c-faf7-415a-896e-f17f69eaad99", "comment": "Malware payload (AgentTesla)", "value": "d4243a63322a239d9084d08b4504f2c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793707, "uuid": "4093a18b-db9a-44bb-852a-4a0bf5bbd002", "comment": "Malware payload (AgentTesla)", "value": "2770b7974848bb62f7a5f49b1c4b3deaa9a99cfee76a303636d7840455a10d11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793707, "uuid": "17207cba-985b-441a-bdef-dcb68e36a68a", "comment": "Malware payload (AgentTesla)", "value": "2be2471aced4d81b7bc0ea22a0113261eb89b02a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793707, "uuid": "f926821e-eaf8-4979-8add-2363e8647982", "comment": "Malware payload (AgentTesla)", "value": "f8a910baa106f1c699e05e9eca4931c3946140d105107d3d12450d4f3ecbfe42dba1d23b03a1491e69b8abf368675202", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793707, "uuid": "101a582d-3aa6-4e36-9a51-4e4b0bf4678e", "value": "T170C45A9C7650B5EFC867C876DAA81C64EA60747B930BD243A05312EDEE0D99BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793707, "uuid": "77b068d4-4ad4-4942-9af6-c8599b68745d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793707, "uuid": "b271a347-6bf6-4440-9e55-d5dddb7fb103", "value": "12288://5P0FfSIvWVcK+oqQn5fzz+zO3IxkdKaiQvpi/7ZjsWSDnFMZLF21ztMflGCqp+://5GSI+VcK+or5f+SzdKaiQAV3SzFer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629793707, "uuid": "527855ae-f677-4535-8943-861562069fb3", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629793707, "uuid": "722b18ab-ed09-4cb5-aa98-3064247f6466", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793707, "uuid": "0ea55db0-d286-4d13-906d-e4a07ccd2a7b", "value": "DL-PR-0721-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d1ee5e-04ba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Turla)", "timestamp": 1629796025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796025, "uuid": "a301ec3e-4644-46ca-bbea-8382a87712c1", "comment": "Malware payload (Turla)", "value": "293ff355dbefa2aaa0f5915812d7337a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hyperstack", "colour": "#4A4134", "exportable": true, "hide_tag": false }, { "name": "SilentMoon", "colour": "#B1B0D5", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796025, "uuid": "81963869-9f6a-42f3-920d-7864945495e0", "comment": "Malware payload (Turla)", "value": "27c42ec84c4f69e6ac63580e8dae70d87190e60974c71b04b6471a78d7956d0a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hyperstack", "colour": "#4A4134", "exportable": true, "hide_tag": false }, { "name": "SilentMoon", "colour": "#B1B0D5", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796025, "uuid": "d0db3629-963f-4c8b-8536-a57823ebeaf2", "comment": "Malware payload (Turla)", "value": "78d9e2a5a7bc5f7e4fcf6888414f82315cd28624", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hyperstack", "colour": "#4A4134", "exportable": true, "hide_tag": false }, { "name": "SilentMoon", "colour": "#B1B0D5", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796025, "uuid": "3ca82cb6-a267-4ae8-8d17-47cb4d759409", "comment": "Malware payload (Turla)", "value": "642d3c63560868719560c4d26fc15982b7616b68a21b9020e64cc0a1a15724208b3b97d3461b7e4ce6b1f3f1722c263c", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hyperstack", "colour": "#4A4134", "exportable": true, "hide_tag": false }, { "name": "SilentMoon", "colour": "#B1B0D5", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796025, "uuid": "1587e9ae-c28a-4c93-8d9f-8f0c4dfb7a1b", "value": "T13343181799828D57D7AA01FD60EA896D95BDF8B6133084D79A641FDB2ED03F088E03C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796025, "uuid": "e7035c7f-9189-4014-b0a6-44b2239d493f", "value": "6a320d2c5fb51ca393771d060d34701b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796025, "uuid": "e8a6f012-a136-418a-9214-c9d97a78d81e", "value": "768:ofzzmPXzJqOytUaWRBGg20LQqAzMA+AkhMtiLt+0E23ACjY:fPXzJqpnCX0qL280r8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629796025, "uuid": "ab6df0c4-3ec5-4739-94f7-59b6e68def5c", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629796025, "uuid": "46a24908-f8a5-4d02-850e-9dba24544975", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796025, "uuid": "a6c42a3a-8b0e-4c66-96fb-adcf5b8b4270", "value": "27c42ec84c4f69e6ac63580e8dae70d87190e60974c71b04b6471a78d7956d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9510df6-04b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629792700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792700, "uuid": "072a3ac1-9ecc-44d4-af68-b0583ef3b6e4", "comment": "Malware payload (Mirai)", "value": "7c39de275e9a9f015047c0d928dc367f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792700, "uuid": "3e275aab-6d54-4c35-b2ea-5d9ea4e87c19", "comment": "Malware payload (Mirai)", "value": "28028140a18b97c30af9750610f7d45d55f19ccf415e9ec0924aaff161d30a65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792700, "uuid": "c7803372-627c-482e-9bed-40dda76463c1", "comment": "Malware payload (Mirai)", "value": "ec9cda099a8cd21d9f6d01e45ac1e9acbf4ea392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792700, "uuid": "9ee71567-8d6b-44ea-b234-c041e4f04a0b", "comment": "Malware payload (Mirai)", "value": "951ab5b5687d7bddd5ec99b121215316895579ed94d39d32db4f45e2e1481fe1e1e9c6ec5b7352a1c52c7232167c6631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792700, "uuid": "7bc8a09b-2897-4ba3-83a9-3ec9c7c12540", "value": "T152C3F772B804DF66F40AD6B604D38B227E30BFA70E631662B31739669D331D52867F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792700, "uuid": "5b48da48-3bf1-4cb2-87db-599bb0603725", "value": "3072:L+YUpmc5hIof5UM7XgYjykKdjmm/QcuLB126DNb:LwU1of5UMPyk2jmm/QcuLB126DNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792700, "uuid": "5aebd002-8a0b-4759-8554-0901d24f8666", "value": 118319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792700, "uuid": "08004f2f-91b9-4b56-aa11-4eb85faae607", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792700, "uuid": "f43ce194-e544-402e-8689-125e4eb21aae", "value": "7c39de275e9a9f015047c0d928dc367f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57253b0-04d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629806813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806813, "uuid": "6a6e1465-2fef-4fd5-8f5c-131946c5a9d1", "comment": "Malware payload (Loki)", "value": "19240f4b0efd2c8ed2f7fcc0835fad17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806813, "uuid": "ac20efc7-2ff4-4b9e-96a1-620881998f13", "comment": "Malware payload (Loki)", "value": "28c228483667d39208e479e2096ff9cccf10f6c62838804c6715e24f6a0f2e71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806813, "uuid": "693ca160-aa9d-4a75-be08-2820198f6d2c", "comment": "Malware payload (Loki)", "value": "d09fca9744cbcc6f68ca24e600c94a8aa2faef3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806813, "uuid": "b11d27ba-db60-4b08-baef-f2a2201dc945", "comment": "Malware payload (Loki)", "value": "b7b44bb1127d78ca75fa0e0bda9533e00dd434526e76f8445e4b9b8d6791596e1901c8d418eca3c795da6e653ed78aaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806813, "uuid": "a138c4c7-db2e-4c47-b87e-435b3ad21aa3", "value": "T105057C306399C284EC1B8FF0166CF79402F235E7B6C5CD6A06DA724C8E5E9D16B0769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806813, "uuid": "e830070b-034d-4bb5-aeb0-82a1ca967724", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806813, "uuid": "464f6c88-5da3-42f7-8096-021f55a1f5b7", "value": "12288:cjcsGI/c+IDXfWYhCQIHVJid2zrft+S2H6te6IkDRBBP0zXWde02EObbZ:coXfWN1Ji0/1K+MkDRBBP0Z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629806813, "uuid": "bc78b7eb-40f4-49a3-bfb5-c3112545eec0", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629806813, "uuid": "2e2badaf-c4d1-44af-b730-09f45388ec7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806813, "uuid": "5c270082-83d3-4b1f-8828-4f16b766172f", "value": "19240f4b0efd2c8ed2f7fcc0835fad17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9978e7-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629805426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805426, "uuid": "431a91b8-e8eb-41b9-89e7-0303a4be8ca2", "comment": "Malware payload (Formbook)", "value": "e8d945d2105bad763f3b1dc30f2b6142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805426, "uuid": "ee35b244-902b-4ca7-a27e-758321220daa", "comment": "Malware payload (Formbook)", "value": "29175495787385b647e6982e1743e0d928e278b44554662100f53a26a4d97907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805426, "uuid": "110f1bde-15d6-4f22-85d1-64ac1e86267e", "comment": "Malware payload (Formbook)", "value": "4602b1216d9e6961f2398618bc525f54b45fa4c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805426, "uuid": "e5d2d260-86cb-4f4d-9c4c-0e0d6d9c1074", "comment": "Malware payload (Formbook)", "value": "cbb70354f45a1945f6491be6d9ae3c299339b038b43c61fb7e6464572c4ade5ee61e4df5ea468fa5b240d1b7774e6aea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805426, "uuid": "b83a6bc4-d3c2-43c1-8c97-ae512d8dfa4d", "value": "T19A84131A82E87318A277D77BFDF137CF4C97392B2AA10CEE481A9350DC64B22C5D1599", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805426, "uuid": "245eb8e4-3a48-4ed4-9219-1b01a758ceea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805426, "uuid": "851fcb76-8add-4ff6-80da-a6d2d0287a68", "value": "12288:dc6OW1WnXhEDWlzHW3ge7XiqtcBz5D45rY:dNoh0iHr0XiqtcBz5DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805426, "uuid": "6edbfebe-0f92-469b-9737-28c561ef420f", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805426, "uuid": "dfcb74d3-4609-4ad3-94bd-e72993ced261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805426, "uuid": "fa1d9f12-68ed-4914-893a-67245536d7e4", "value": "e8d945d2105bad763f3b1dc30f2b6142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5ce64c-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629805318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805318, "uuid": "a446754a-e643-4d7f-8ca7-fc3494d2efa4", "comment": "Malware payload (TrickBot)", "value": "d78ffab927848218d84e3e78df61af2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805318, "uuid": "b23029c4-0f5c-4f2d-9897-53962ba7b295", "comment": "Malware payload (TrickBot)", "value": "29f9c88b451d133d42ecba93ec60768600748d9bf12611182f070539cc61b578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805318, "uuid": "3f65b82f-9cba-4a62-88bf-694f0d8f6ce4", "comment": "Malware payload (TrickBot)", "value": "976aa9181a72acf9991fa26e836d0e176a976d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805318, "uuid": "ede1fc9c-0afe-4cf5-b049-215ae0f1e340", "comment": "Malware payload (TrickBot)", "value": "ce8c84f3f639ad761e34c1dad13c8f05db24efc1bd40b5d499f30a29ef0b76f95017f891b303d53ef9b8fca5a5ca260f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805318, "uuid": "3a552607-5af3-4e43-b20b-039432ea8a5d", "value": "T1380519D0634CCA7FD6C33130F3A61633D2538B4E1AAB919BEB58F59AA86E5467413307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805318, "uuid": "4f6104d0-e09a-4df8-8861-186c95a46c3b", "value": "884c251bdbb51e23564add248435ff5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805318, "uuid": "a0007620-bc12-4ff3-9d51-1d467482e830", "value": "12288:QFuLe4nHJm79H5851MKd3GydYLMcOCWvnJi7:QFF4nHJowZbnJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805318, "uuid": "85ce6597-a423-470a-859e-127f0f5e26b7", "value": 839733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805318, "uuid": "3fa168fb-89ae-444e-ae7b-d3a8cc2f4331", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805318, "uuid": "552ec666-dc5c-418e-8d75-2346a43a6885", "value": "d78ffab927848218d84e3e78df61af2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8719b5-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629805562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805562, "uuid": "e2d2350c-f8dd-45f5-8ba9-d60cee67c6e3", "comment": "Malware payload (NanoCore)", "value": "b79fbf5e931d1e0cd4cc72f7a8662694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805562, "uuid": "76c7c703-64cf-4f60-8efc-a7a261ec37b1", "comment": "Malware payload (NanoCore)", "value": "2a97913f1069b7fefc0713a5237dd6465e6b62f5439d830258cec024c56a7a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805562, "uuid": "16f30cee-1eb0-4437-89ca-7aed4579bf22", "comment": "Malware payload (NanoCore)", "value": "49eb5908db1c17a9d4d5f81a7e0b155f8eb673db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805562, "uuid": "597c87b1-b9ac-45de-a47d-dc352a927a78", "comment": "Malware payload (NanoCore)", "value": "2e1a6ba873cc194526bd16cbfd374d25afff209c08801b44f1c8216e016081a78ada575d999fd732fd94a9f6a4cf4bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805562, "uuid": "77b16bfc-8d0a-404f-8ae1-b5ebe2a47363", "value": "T1AB259C306389C254EC1A8FF0167CFB9402F235E7B6C4CD6A16DA624CCE5E9D16B0769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805562, "uuid": "2f078bb3-0b6c-4421-a073-9ea55bbd3764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805562, "uuid": "25cdd3d3-238b-425d-8826-f1c8a5223e0c", "value": "24576:iQ9jRUtMHnE2qNL3kUzdcPBqM12YoynSrr3wmq1sK:Nfc8nEFNL3bzaB912bySP3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805562, "uuid": "158a38b6-f662-4db5-8645-92186ea773e0", "value": 993792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805562, "uuid": "8eb0e913-8670-408f-816a-839d6bbce905", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805562, "uuid": "9cf9d5fd-8d0f-4042-bd68-04c09ccd02ea", "value": "b79fbf5e931d1e0cd4cc72f7a8662694.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f7e1ee-04d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629807435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807435, "uuid": "e2ea2ac5-7db7-4fff-9065-59a6248d6f6f", "comment": "Malware payload (RaccoonStealer)", "value": "5c8050e907434066c6857344215641a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807435, "uuid": "e2315283-bee6-4e7a-9955-0bb92ecf42f8", "comment": "Malware payload (RaccoonStealer)", "value": "2b18d06c8dcd5526c85b3adec55515b410b2c80ea586d26e02f3c238b93579b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807435, "uuid": "82f2363b-4d68-4d17-b052-7878f264355b", "comment": "Malware payload (RaccoonStealer)", "value": "ef7baba758b95b0981acfdac7eb5277df0b8164a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807435, "uuid": "7ce2da9e-2372-44e5-9782-121856cfafc1", "comment": "Malware payload (RaccoonStealer)", "value": "df29025637e4e4e0b00398dab0779eea4fc2ae340df0dec9cb6b35c8042e2cc295207a41fe68460b377c0010411bc7a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807435, "uuid": "3049addc-6c11-448e-86af-cc1c5b721bde", "value": "T111940211B9B1D437D18691740E95C6A0EA39B4A26F704343BBD89FAE9F702D0BF35386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807435, "uuid": "b7597bd0-b30b-4931-b6cd-c03e101cb3b1", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807435, "uuid": "213ebc26-85e3-4a8f-9d44-b8c61ca5b57a", "value": "6144:uNq1WXD5yiJI0xfsctUk++TO8iw+bwu5pIQP1wb+hYYQpqbZnaBb:uUWzTiUtUkdLqbwc/1wb+hYYQpqbZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629807435, "uuid": "c68fd3ba-93ef-4f73-9ce2-c6665f0bcb06", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629807435, "uuid": "2d0be1b8-5fc3-4516-832a-463ca3b30617", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807435, "uuid": "c0f8ee7f-0aae-46c0-ac11-50b7dc7a9df2", "value": "5c8050e907434066c6857344215641a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc60f1d5-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629786666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786666, "uuid": "b6adc7d2-0239-4615-95e1-c340ceea2119", "comment": "Malware payload (RedLineStealer)", "value": "a20f5887bc06dda3e4c4d59d9b00f3ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786666, "uuid": "acd870f6-8e19-473f-98bc-e9c24a400bc5", "comment": "Malware payload (RedLineStealer)", "value": "2b3c1a836d3218ccea9f8b01bb6be6949507298f2da9625f8315aefe89bed30b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786666, "uuid": "b77788c9-1bec-417d-82df-42237f6f3171", "comment": "Malware payload (RedLineStealer)", "value": "837d2cfdb935c67f5c018bcc15e2ac4ee8c741a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786666, "uuid": "8c470dd0-c0cd-4d07-89fc-cddc4c37fece", "comment": "Malware payload (RedLineStealer)", "value": "86f2ae7235ec17504577d8fa2883232b953e8b9c570bcf90d1b820fc10e74a0e4cad3352f85d162c2b1b8b109d1cfe95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786666, "uuid": "5b53e66a-6e59-4540-983e-e547d131fbc1", "value": "T101263328C77CBEAFF10D9C7141A745633AD94B54AE48071EB1EE2E653536F92812BE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786666, "uuid": "f0ed002b-7123-44f2-89dc-039a299fcadd", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786666, "uuid": "264b19ba-4f64-4f5d-a873-0d29bb257fc9", "value": "98304:vAQTMV6gJfxdnDTfwPyI6FuWlz0O+SBlnMgxNIopqBwwpU6k:vAPVlfvnDkGFuWImnPxhgrpUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786666, "uuid": "fbb06dd9-7421-467d-98f8-a922827189cf", "value": 4772920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786666, "uuid": "7903222e-0c60-4d84-8b97-db72af549762", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786666, "uuid": "e52de09a-a07a-4c22-b3a9-1b82a4a3301f", "value": "a20f5887bc06dda3e4c4d59d9b00f3ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef91840-04f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629819607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819607, "uuid": "0b4d47d7-24d8-4025-b1e4-2c4f6580fc96", "comment": "Malware payload (Vjw0rm)", "value": "a89fe76f3a4a948ed06f3025f4f0a1d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819607, "uuid": "c62ea796-a1c3-425d-8472-41879fc6d3d6", "comment": "Malware payload (Vjw0rm)", "value": "2b72f018808ce809de7cc73ba997d14b3c9acbe3ce6d13826d3b98c8eabe2cdd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819607, "uuid": "7247dd90-6641-4bf1-9709-6843d0d1d807", "comment": "Malware payload (Vjw0rm)", "value": "f747e3602aad40383aad9b3623033d6af082d380", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819607, "uuid": "cb66a64d-1934-4c63-9239-8e56a5689a67", "comment": "Malware payload (Vjw0rm)", "value": "f9eb532fd7597127a09b9aeebeec765e6ad2787cfb9159881c71c1acbd3a73a7cde12fb1134bf40bc78ccce4b43b5b85", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819607, "uuid": "4c9d7417-f10f-4034-9d46-1c758a716855", "value": "T16412339A754B75BEE19310359BFF814B73349C81DA8D6128C1C1FC8439789ACD32AF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819607, "uuid": "b5d7c6ed-66a6-4f80-a68a-1d399834ea77", "value": "192:eHcOgeLYvTE/2gx/4sorG6RkbA62+vph+JxmTVRmfmdbBzWXioSDmmNXd:e8ZeLYvTEO64G6R16BphMgjmSTmCXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629819607, "uuid": "5892cf5f-5c76-407e-877e-e20a05a56399", "value": 9364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629819607, "uuid": "01b31503-2c11-43d4-bc20-6aa311881a8e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819607, "uuid": "304dba34-75bf-4576-aee9-fb59ac5b6293", "value": "#W001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a121e7-052d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629845306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845306, "uuid": "f6724dde-9803-4b4d-8228-dfd51675cef4", "comment": "Malware payload", "value": "d7bac801eb5714764619180f30251796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845306, "uuid": "13bc370c-f1b4-45ef-8db1-36c2029489ba", "comment": "Malware payload", "value": "2d308933203744252691fb15fb6c02fa50bed49da96c68d8159ff8b911f5e235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845306, "uuid": "f26eb2e7-cfdc-41f8-8065-665e7f568b63", "comment": "Malware payload", "value": "85fd84c1cb196529a83eaccfb251f524335b14af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845306, "uuid": "f3b48d94-ff1a-4455-92be-903d61abb29d", "comment": "Malware payload", "value": "15ae9cc988cae5a719384b8a8f5fe3558234852b063ada9cccd35ce41f3bd8c654a411146d5e3e40d1d2dc462cc66bc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845306, "uuid": "8f7f5994-0de8-4eaa-9a2b-a4ec3afd18e2", "value": "T15D27BE53F7C2A0B3D49306714A1BB373667DAE351921A64BB3497E2D3E71281FA2C643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845306, "uuid": "e30384d3-7b7b-4fd6-b2bc-e749cf76099d", "value": "c5e47cbdeb1fcc88f1f7e7b8fb8ff58c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845306, "uuid": "9a49233d-8d2f-4f4b-9a50-35fdc679d7d4", "value": "393216:RcCM4/joZEE+U5umBJQh3wvj08XEBCfGdQb8/N22t5ktAD:mCMwoZf5uAvj5EBH5N22v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629845306, "uuid": "19dbc410-61cc-4403-b9df-aad5cbda527f", "value": 20416512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629845306, "uuid": "483329d3-cdf9-4c30-b417-32f11ab6c26e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845306, "uuid": "74e979c5-94fd-4ced-a054-cc957e6f46b6", "value": "ebb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314bea82-0481-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ServHelper)", "timestamp": 1629771346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771346, "uuid": "981e81e3-23bb-4f8e-b39b-f8553cf37a93", "comment": "Malware payload (ServHelper)", "value": "7da32cb215ffcc2f7152dfc497ea93e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771346, "uuid": "ca551fad-9475-41e6-80cd-e006059b24d3", "comment": "Malware payload (ServHelper)", "value": "2df9231da4895e7fa788e0f4312cada439b7c3607c4894e29cab40dc76ab8bf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771346, "uuid": "7db66db6-7df5-4b25-b666-b012da883030", "comment": "Malware payload (ServHelper)", "value": "b25d01e33f0d282eb5bfd1617d6cb4e63385a511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771346, "uuid": "ed6b328c-ec37-40d2-809e-6397f87ea272", "comment": "Malware payload (ServHelper)", "value": "d35b96c7ce2ea64cb8971b246eaaa9c93ac2c8e92602c297e92307c150b08fda242d3e965e5b123b00b4f3519b05dee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771346, "uuid": "51de15bf-a5ad-4a90-9b24-a8820dcadd0f", "value": "T1E8A41221F4B0FA73C1D341354CA5F69336663A0112A9D40B77AA6B6F4F70BA16F2B24D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771346, "uuid": "df58ac37-e113-416e-9985-455a9d440284", "value": "c07c5f8b51cfbe666b5660939365cb2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771346, "uuid": "aaff3581-9c91-4b29-8043-bc99e206932f", "value": "6144:mtP3UcV+Z7aLqSTLdT4rzkqBYqFnbmP8LgESUMIKbJ053zJSjx4aMDWh57JQch:mtPkcrLdTquqFb+8LgLIz3Ab6Wh57/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629771346, "uuid": "8879762d-cd42-4e94-9b05-6c183a8d80c5", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629771346, "uuid": "5a83eef4-75b9-4643-a7d2-ca63323c53d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771346, "uuid": "8813df4c-1d51-4d4a-9731-9f32aafdc986", "value": "7DA32CB215FFCC2F7152DFC497EA93E7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3531eea-04da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629809843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809843, "uuid": "9ea3fad9-6b55-4d40-8e43-85e9d12cf01b", "comment": "Malware payload (Vjw0rm)", "value": "279ba39874bda6eba21ce2ec81361659", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809843, "uuid": "0e8c0bbe-820c-47f7-afcf-aea3475a6bcf", "comment": "Malware payload (Vjw0rm)", "value": "2e60c3ba7e545ebb75f91c51b085be7b61d34374f178f9bca45e96624727dc9b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809843, "uuid": "007a3cae-de13-4032-b2fe-0664ac278ee3", "comment": "Malware payload (Vjw0rm)", "value": "4d44cefbfce10930858e8a0f9ee8510e27152dcf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809843, "uuid": "3b66e5ff-772e-4214-9596-b6ecb9a7b4e6", "comment": "Malware payload (Vjw0rm)", "value": "62506656f97d1919ac0331b34d980572920467599c098de9357094c9180dfca76dcb015b05be822b90dce60e03dc82da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809843, "uuid": "7b3b4599-12b6-4e95-a682-2ed225759b9b", "value": "T11A14BF1CDD807EF787644320B567D749D3A1450FA8C8258AB67D6A00CB73AC7E16FB1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809843, "uuid": "44685195-6209-40df-a86e-ed6cfba821d7", "value": "3072:GIUkZFN8yRu8pXSn77+oFyLELt0GV3hfQYPGUba:fFN7Fi77rFeC+weYP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629809843, "uuid": "e3693982-3776-450f-a441-aa197d0025fb", "value": 205933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629809843, "uuid": "594de3cb-60c5-428f-bdf5-6d369ba9d9ff", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809843, "uuid": "364ea4aa-aa70-42a2-ac71-5a1162510bf6", "value": "Payment proof.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38dd62ac-04fb-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629823757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823757, "uuid": "ddc78746-5dbb-4d2f-9400-322b8a18a666", "comment": "Malware payload", "value": "72bbac2c87dff558073e6306f1552a39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823757, "uuid": "7fe2cf24-18ae-4f34-b840-5107ba4bc05e", "comment": "Malware payload", "value": "2ecb4724f6f253e573bf038b47709f88c862fd19741a1c65da13d45b597a2097", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823757, "uuid": "50e2868d-1165-4a7e-8e8c-acd5a4236a99", "comment": "Malware payload", "value": "bb9c08f0c261bc100b447c6b662770a2c518fbd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823757, "uuid": "82f4ffc6-a269-4d5e-8b97-b1ecbc0295bd", "comment": "Malware payload", "value": "96cc59d4ca8cd310787d9eb550a2f1127d478e606d49d8446c083be966f5203e5db2ea173ce4891bd6d56cb9a030a7df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823757, "uuid": "187dd77c-348d-424a-ac51-ea3b08dd1e0f", "value": "T1A1763381F2441ABDCC34C67CC63B659759473E24A97AA1DE333CB5C33A33A65643162B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823757, "uuid": "174211a3-0c5a-4dcd-98e4-4149115f43bb", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823757, "uuid": "0898921a-c32b-4756-a0aa-879f486fc6aa", "value": "196608:TNw5s8BKUnGIt4BPiVIr3vI8CDSuhJmqs31hCbR3nN:TC5z3GfI8tip+sbR3nN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629823757, "uuid": "31253ce5-de78-4bde-99a6-e391b54b2e34", "value": 7510230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629823757, "uuid": "e52d49a4-62f5-4bcf-b3ac-b41bfff290eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823757, "uuid": "d95dd47e-f347-449d-8db6-21806514b04d", "value": "72bbac2c87dff558073e6306f1552a39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0c29b8-04a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629787309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787309, "uuid": "01f79ea8-ab3a-4f71-81ba-9e9510476178", "comment": "Malware payload", "value": "3f2d7f9831613f8dd50c62e6baa4fbbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787309, "uuid": "692a24ab-52ed-4f41-bd98-aec66757363e", "comment": "Malware payload", "value": "2f62b268cebcb3874241be7b5bf9a307bd0bbc481946772c5411ee9b45baffab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787309, "uuid": "358bb464-3496-4edd-a0a8-1439604c597e", "comment": "Malware payload", "value": "63a8e6831b18c131dd8c65b7191f9e97b53c9a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787309, "uuid": "9ff52da9-b227-4b97-aac5-6d5b98652e12", "comment": "Malware payload", "value": "102260e495dd5c25a459c9f6ddd02b72a0a5c3202d49ec389507a44ed845e36f7f175588281d6f10870c2992373e3d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787309, "uuid": "9b2fde58-1b3f-4190-8021-d0831d0b84e9", "value": "T186753369679BC17DC6608CB52D87A77806764EBCCBF49BDE1E44A2802094EFF9633C11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787309, "uuid": "e3e20445-8b8d-4fd9-9e86-0f86d4bc5b71", "value": "f8d9e6f58bdad8d3f277d01c805576b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787309, "uuid": "397f4fb9-838b-47f5-b433-36d1607dab6f", "value": "49152:cC4McpouDoYZFn9PhD0H+TQpi0skvCduYN2aEf7hC:V1czEkhthD0LkJUz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787309, "uuid": "5a54dc1d-7395-4eb5-a387-b20d508a7eb3", "value": 1573696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787309, "uuid": "0a2488b6-324c-4840-82e6-a031cfd0fb36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787309, "uuid": "cbe42933-fa81-484e-b598-e63a623569ab", "value": "3f2d7f9831613f8dd50c62e6baa4fbbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef5fcf8-0475-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629766242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629766242, "uuid": "dd9aee04-1bbf-40e6-b6b4-9aa5e4a0588e", "comment": "Malware payload (RaccoonStealer)", "value": "7e2971bf931f65e61bf33ea671cc8b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629766242, "uuid": "bb5e0afb-7e45-4369-b795-57d02f86747e", "comment": "Malware payload (RaccoonStealer)", "value": "2fb28bf59adc3f11c4643a43bd7583df849c22e59c0185efde750a354a9aadf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629766242, "uuid": "d500c0fa-15f5-48b2-81a3-424777eff431", "comment": "Malware payload (RaccoonStealer)", "value": "5d091c2fc7b8bbbb2c7da88ff7f9f119ac78032a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629766242, "uuid": "86485ae5-dbc9-4b74-afa9-e5839b979896", "comment": "Malware payload (RaccoonStealer)", "value": "bc351fe7a2adb4a742ee29e1a0a1b9db78a0b737e5bc2480d3e7e7b1395ac7825ad9cb032404669421d8a90b00e12bbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629766242, "uuid": "b277338e-4f11-4b72-a049-3d7c39b092cb", "value": "T104941230B250C23BC081A0785DE6CB91E56BBC601B3597473ADB5B9A1F367C1B62637E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629766242, "uuid": "b93ad9ba-6183-4a15-9ef9-09aea55f072f", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629766242, "uuid": "4e3bd74a-5873-4187-a10e-253ed328f134", "value": "12288:ioSXbgyjDA2toAvdrDkiWFVoV/iXMEXSagH:ioSLgyw+d8DXyKAaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629766242, "uuid": "ece70120-092b-4326-839d-9b5169dfeeda", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629766242, "uuid": "dc49a63c-a11d-49b9-a9b2-332dcda711b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629766242, "uuid": "24e60fba-b78f-48ef-8f33-f645781ffb70", "value": "7e2971bf931f65e61bf33ea671cc8b0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e44dd4-052a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629844231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844231, "uuid": "466f0e49-755b-44f5-9660-f7223e903698", "comment": "Malware payload", "value": "b4bf0c6fc4462e2f160665b57d9671dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844231, "uuid": "a9e14b9c-3db9-416c-9a17-6dbac049e696", "comment": "Malware payload", "value": "30c858105b00864bbb38f2ec543c2ac4a920ab61acc949d2b7d872ba14b5b120", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844231, "uuid": "b819fcb5-9026-49a3-a787-f46b2b145a27", "comment": "Malware payload", "value": "26a45e5e7985b5d5e09a99b90f6f2707b0842608", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844231, "uuid": "d019b515-2db8-4bda-84a2-54585cc54c7f", "comment": "Malware payload", "value": "65334303b45c2335aa132140a13991342b52b999452c611e2905bc74bc60fcfc4a89756e7fdffcfd1dec3a0406042b56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844231, "uuid": "0298fce6-9196-4e78-b5f4-663909b6c006", "value": "T140C32805D5508727C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844231, "uuid": "18b9603a-a7c4-48e0-b18b-8bc6fe350f08", "value": "3072:WkYPgPggnAb0JWaY/VfBEDx0dn+mTQOY5NX3cn:lYPgPggI4Wa8BEDW+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629844231, "uuid": "efcf9a2b-2cd6-42fa-b732-82575e82133c", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629844231, "uuid": "c7166e17-0462-4522-81e3-0d725c096669", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844231, "uuid": "e63074a9-f06c-4897-b60c-b4d0f418ff92", "value": "b4bf0c6fc4462e2f160665b57d9671dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd44d883-04c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629801699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801699, "uuid": "139edfad-7097-49fa-a827-6f90a9ea88e1", "comment": "Malware payload (Loki)", "value": "21590b2fec231afb73a1d134abfbdce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801699, "uuid": "122a0664-aa2c-4a16-8986-73d8f2710f9f", "comment": "Malware payload (Loki)", "value": "30e102e2061e351f30da3194a9453d2ef1c9af7f1dd453235555c7e6a21c20e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801699, "uuid": "eac56187-b779-48ba-95f1-e869db64f5c8", "comment": "Malware payload (Loki)", "value": "92cdcd544c856709e18a0984a81a1b73012a321e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801699, "uuid": "ab942726-8cbe-4cd0-9d77-c69e4e6d71ff", "comment": "Malware payload (Loki)", "value": "be2e6e835fa9e60d39498b4abde5b2cf392729a4783bbe2f66c2f58d9a62b0cb99cc56cdfd98b2bea1f0007853832056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801699, "uuid": "b59ecc9a-643f-44dd-9b75-d7868f0b257d", "value": "T12034F1A5A989A0E5C0048AF84825E5D81225BF39BA7440E331767DABFBF35CF4775C0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801699, "uuid": "c9f8f1f8-57ab-49a6-82dc-17f6ea65c294", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801699, "uuid": "df5368fc-2c14-4db2-bc7c-7e98c0aede12", "value": "6144:t59bQeblqDozcOGayRLjRDT3EDxaW/AUb:Vb1IDoz0ayRvR/ud/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629801699, "uuid": "f09378b4-7165-48ae-967f-dfc57b2b2c4b", "value": 250157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629801699, "uuid": "f0b81d53-fd77-433f-9e2f-7f6c9cc3ee31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801699, "uuid": "0d263dcc-3f8f-40ac-8dba-cd37287fcc59", "value": "SecuriteInfo.com.Variant.Razy.802650.2376.4514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede3fb5f-04b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629792708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792708, "uuid": "2f7e4ef8-074a-473c-8638-5d10e6492c99", "comment": "Malware payload (Gafgyt)", "value": "665a5cc64e6c8898601e177811213486", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792708, "uuid": "2261159f-9692-4409-930e-5b7a0e493ee7", "comment": "Malware payload (Gafgyt)", "value": "318c1a8c361c3dc6faa36fcd3d1d328799e8e10bb03a1161ba31d25d8b0cbb22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792708, "uuid": "16fea276-f243-435b-b51d-b86f483016d9", "comment": "Malware payload (Gafgyt)", "value": "ccd151e6dd84c301b4521142e94d568290aea49b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792708, "uuid": "f2bb6f49-fa73-48b9-8683-18b75f02993d", "comment": "Malware payload (Gafgyt)", "value": "f6ffc3e31eddf38c76d81f9aa272067520a1aba5532267263a9ec3230090d78bb403740cd8896c3e86331300ba53a848", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792708, "uuid": "1e9feb51-62a7-4480-acd0-6b2b401e675e", "value": "T13CB32B37A61C0B43C49B55F02CB77BF24F69AEA312A611C4A309FED04B73AB12551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792708, "uuid": "a59037f0-e598-4abd-99c8-6599f7d1bf96", "value": "3072:Uvc29uyIcxE/sZxw+OqmKZmm/QcuLmH26PNb:Uvl9jIg4sZxjOX4mm/QcuLmH26PNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792708, "uuid": "e922da37-66fa-46db-932e-1aeaad8c94fd", "value": 117027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792708, "uuid": "b9b9814b-5cba-4dd8-b73b-906b27054401", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792708, "uuid": "2ee74d84-3370-4927-b8ec-09a975dcce6b", "value": "665a5cc64e6c8898601e177811213486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe20e4ed-04a1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629785434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785434, "uuid": "2db423b7-769b-4239-9844-1e0a42470fc5", "comment": "Malware payload (Loki)", "value": "f726147c96d9766c17b636ee1572b48c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785434, "uuid": "a374a48d-d9f4-45fc-b16b-f69e7a4776c2", "comment": "Malware payload (Loki)", "value": "31f9982b2c0c9cc9017882eeaec57e7756aa0e9e4414a1483cf8fc72860f78dd", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785434, "uuid": "fd0ff960-f886-4429-95fc-881093a201c3", "comment": "Malware payload (Loki)", "value": "9c91561c0046f18ef885fce32e599126852c1c1d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785434, "uuid": "7b67a1bd-61d4-4907-a5e3-3c53bf76f3cd", "comment": "Malware payload (Loki)", "value": "8c03def44a138ff9730b9f9f033367b0b32467c81925e8dac57395429873d3171b0842ad06080161944aa7a794959713", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785434, "uuid": "2a92b59b-467c-4d72-9a1a-fbe8560631af", "value": "T15B55235E65B31E31EC89B8362401667762A07D7DF369831D5E347AB2137A33C09EB68C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785434, "uuid": "4fbbc6cf-c920-4ed8-ba65-cd2985014480", "value": "24576:JX/850NNO97DzIdXsp3GTNIO/crO9ZdwEahzg9nqo:FcbzKXscNcrO9yS9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785434, "uuid": "75fe296a-1f79-4655-9700-7a40ae768ba8", "value": 1289736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785434, "uuid": "9dc257da-a983-41b3-b42e-3a045969388f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785434, "uuid": "4f140826-54fe-42a8-8b8c-14b646a84202", "value": "Proforma InvQuotation 234000909.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04a7b8d-049e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1629784068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784068, "uuid": "af1602ee-2534-4b31-a36f-1d4dd58268ee", "comment": "Malware payload (QuasarRAT)", "value": "2fa857766a51190a35c523d1e668c419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784068, "uuid": "1a358606-580b-453e-aa3a-d10fad0e6725", "comment": "Malware payload (QuasarRAT)", "value": "32635c5f985aa62687009145f91b4523b781bea2faa94f7864d2ff16ab0a14ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784068, "uuid": "d9cad727-10da-4cc7-8e21-949c1db41f57", "comment": "Malware payload (QuasarRAT)", "value": "a03a3e40fea2601e2b745b6d111d8b50384f1bd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784068, "uuid": "12b306d9-8da3-4cc5-97fd-0caff4484c44", "comment": "Malware payload (QuasarRAT)", "value": "e08a340bd1e915b8722788031555797696a866c84c68cb3e4d61104f384770fe02b3f6767b1ba01632135b879ca4b2ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784068, "uuid": "15b41477-a73e-4ac6-bfec-85ee9b472b3f", "value": "T1D2D4CF4472B64F92EBBD8BF86A31201047F63A6B646EF74D4DC521DB15E2F004AA2F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784068, "uuid": "fcd9a9b8-ad5d-4219-8d88-687fa87a1734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784068, "uuid": "5c26d119-0533-4457-ab99-65cd45acc34f", "value": "12288:pjxXyjFxBYSk/XE+DF7ruopsW+grfBecYSDE5JVKV6m9E1/E:pjlyZxBAXdZ75CgEcfDE5kKdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629784068, "uuid": "5d6da265-63b8-4756-ae30-2ccae13aab1e", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629784068, "uuid": "73eea0a2-09a4-491a-9496-ef62d6384b51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784068, "uuid": "a4cf2344-3fea-469b-b79a-576064292506", "value": "INVOICE#0909000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf58ba4-04ec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629817320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817320, "uuid": "614ef201-c9e9-441d-99cc-8ed12599593f", "comment": "Malware payload (CoinMiner)", "value": "cf09f5d2105f7fcaaaadfff6e6060036", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817320, "uuid": "670e9088-ca28-4f25-9611-97d9b8c703d2", "comment": "Malware payload (CoinMiner)", "value": "33a236fd56543bf3915e16cfffb3c6a4b0f92c9ba444744339e3bcc10f285d61", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817320, "uuid": "367e81a4-0853-4c40-bc61-4fb6df3accab", "comment": "Malware payload (CoinMiner)", "value": "b825b5ebb20c2c39ce62ca73e7cec4f82df7578b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817320, "uuid": "162e94a5-f433-46ad-9c40-beec8fc35a99", "comment": "Malware payload (CoinMiner)", "value": "0c6d37ce6fc6fb812e7b4551ce1bb07faf56618b9eb2ffa90012749dd4ac53938e523a385f066ba1d9db3961de18ff81", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817320, "uuid": "d8800a1d-1cb2-4bff-a702-3ca4d13f5eb1", "value": "T123B5334E5F9ED3B8C6A9D7FC41E0D18FC57DDD92E31A8A04BCE8722B02A62934877151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817320, "uuid": "32abfb12-3e91-443a-b92e-3438c3004a8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817320, "uuid": "c6821ea6-1ac4-48c1-97f5-9c570cc38e9a", "value": "49152:IIEBBJy+EmKm3zjrYh4r/6Hn8q0C+1wP0CpEadgcoAEfj:IIsB883zjrYh4rNq0Cyk0Cp/dgc0fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629817320, "uuid": "20c1a07b-dbab-4b29-aa20-9719318e943e", "value": 2287104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629817320, "uuid": "403e8aea-19df-4b16-904b-103a4929fc4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817320, "uuid": "5faaa0ea-52e9-40e0-8a58-a26703db9a40", "value": "cf09f5d2105f7fcaaaadfff6e6060036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9e175c-047a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629768359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768359, "uuid": "b68a5e47-aed1-48c3-b9cf-d03deebe1074", "comment": "Malware payload (RaccoonStealer)", "value": "8fce4e6373dadfb33133391a99b6e563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768359, "uuid": "d9ba56db-8de7-4eb7-814d-1dacfcdcb69b", "comment": "Malware payload (RaccoonStealer)", "value": "33c1310b2f87420819dce65ad5804b459650076580e9780f7a8c755ce994968d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768359, "uuid": "e5cfdc31-7bab-43c9-82e6-c573536ffb8e", "comment": "Malware payload (RaccoonStealer)", "value": "ac23d7f071444326bfe0d1903b721fdc3a2e648a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768359, "uuid": "fdd362f8-2ed6-4da0-8154-10780b6f31c9", "comment": "Malware payload (RaccoonStealer)", "value": "94baab188df852fee77f2df7f0a9d1786f59533bcbdc2f60575a33f50c62e6eb028dab5165980b6940640712ef625d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768359, "uuid": "a225c1a3-47c5-42b4-bbee-af37f20fa796", "value": "T15B941215F990C033C0910A718CE5D7A1DF2AFD94AA77624B7BC82B6E2E312D17736369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768359, "uuid": "d753e844-534a-49d2-8afc-da6fb25ef849", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768359, "uuid": "7cd038e3-abc1-471e-9e4a-bd6adbd5ebee", "value": "6144:Su7DXmKAX9nozpsIw4ODg2Ajq1GIOdxy6xq04Nde6lXjtuasgVSXu750Bv:SuudksI6g5e1mdxyhde1BgVYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629768359, "uuid": "d7615b8a-c946-4882-a4ae-0a7f2181e43d", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629768359, "uuid": "eb679453-e7e4-44e5-b42d-baeb2ac958ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768359, "uuid": "cd24858d-1752-4d5e-b673-e7a673182963", "value": "8fce4e6373dadfb33133391a99b6e563.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f971459-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1629786483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786483, "uuid": "6ed57891-3046-4ab4-ac93-f14b8e6686cb", "comment": "Malware payload (KPOTStealer)", "value": "a3021a46091be8b849034db6395dfc65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786483, "uuid": "5d86e0d0-4379-4b3e-ac05-ba562d35dce7", "comment": "Malware payload (KPOTStealer)", "value": "34b5873621d4f24ea1ff0f45d19e4f0b448febc8a23997e1e52a6e4815d6af89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786483, "uuid": "b1a2d2af-ceed-4480-a31a-d2329ba57e7e", "comment": "Malware payload (KPOTStealer)", "value": "ee71f91939df0f375b522b7fefb300ea15492e8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786483, "uuid": "f28eb468-d752-41b9-9ab1-1fcf984a520f", "comment": "Malware payload (KPOTStealer)", "value": "2da3ac3a2d104e67d3d2e6058c8e46404e21fab79300843dfa2bf99e03111f88b2f2883154fae1816beb860dd414d046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786483, "uuid": "54052a2c-148e-4a15-8152-65eecd70cd94", "value": "T13CA4C030AA91C034E4B712F855B68378B53E7AB16B3490CF62D52AEE16387E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786483, "uuid": "b7fa6d3f-0240-4f27-8af9-9233cc20b139", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786483, "uuid": "278396b4-463c-42da-b26a-78334a1a9ded", "value": "12288:1/3Nmt53TPU+MoHDlAvcgzB6QTOWYye0jTXryH0:853TBIKUne0vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786483, "uuid": "d1ac2bfd-33bf-4c02-a6c8-cb10febcb2c8", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786483, "uuid": "1e4bfca9-0ba7-4daf-806e-871faceebfba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786483, "uuid": "dc5807a5-ac67-49b3-9154-969e8c68e5e3", "value": "a3021a46091be8b849034db6395dfc65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42d3008-04d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629808529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808529, "uuid": "2a592310-7930-4941-b1cd-c89c9e2db3dd", "comment": "Malware payload (Formbook)", "value": "d48fbec5c6a2edf4893023951dd6c021", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808529, "uuid": "455184e6-1786-4dda-977b-fd5c55a4b6b7", "comment": "Malware payload (Formbook)", "value": "34e32621d9d21c70cf705d5306ea55c636b4561f48a32abb91abe9c8ecf77f82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808529, "uuid": "e58220b5-220d-48d6-98e7-31ef840bfd33", "comment": "Malware payload (Formbook)", "value": "7e0eaae1a912cf7033601cdcc0dc561509970a0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808529, "uuid": "ad7243b6-5822-4873-a5ab-0922a7473444", "comment": "Malware payload (Formbook)", "value": "402488d9f9c62e565435081971a3fecadc473cbc822ed8e3bbb54e9c9a928679618a5ee7c85c55f9b41591dc2491b03e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808529, "uuid": "ded3b799-fc63-46f9-b738-46774a9aa552", "value": "T1E364D02537A08BE5F4A9777C8125810023F6DB2FE376C719BF9AC5DE04AE9918642373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808529, "uuid": "17622367-f7bd-43e2-b70f-83d095b590f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808529, "uuid": "c3cc8a75-529c-437c-8979-c310e705e9b1", "value": "6144:nP9bVJieaB7jiR7Y3rhYthO7umz72OB8wh1bNNcw3RybSx:nlhQihIGDLyVB8wTMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808529, "uuid": "dca20791-0f52-4313-a4f3-ad5e865984eb", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808529, "uuid": "78eb6a52-80e8-45f3-a144-560f44824b89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808529, "uuid": "524f452e-ffc0-40c9-b50f-b924c55c9bfc", "value": "d48fbec5c6a2edf4893023951dd6c021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00902387-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629786297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786297, "uuid": "fed8a936-8377-40a2-975c-dbf824bf7d7d", "comment": "Malware payload (Formbook)", "value": "e5d92d9d8c8b6bea5fff7c0fb1c2e21a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786297, "uuid": "4d7c0d37-aa29-4760-be27-f51859ef3214", "comment": "Malware payload (Formbook)", "value": "35517ca8e7a66a88a7243724e6c374d0a4a82878792536087f746bf33ab2bddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786297, "uuid": "fb2180a2-8d06-402d-aac9-702a9de3e2dd", "comment": "Malware payload (Formbook)", "value": "46ffd28bced83a839042d7a49e30b8821fdaa353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786297, "uuid": "b3d08a38-a73f-426e-84e2-dfc149cccc2d", "comment": "Malware payload (Formbook)", "value": "fa02a972c356741db74476f2f351f8adafeae309b5321a75a5e19de7fa1c0f431047333a7874c84bf4985bf01aba8f70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786297, "uuid": "9c68eda2-da49-4824-880c-e110e53dc0de", "value": "T10F259C706389C285EC1A8EF0167CFB9501F235E7B6C5CE7A0ADA724C8E5E9D1270758B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786297, "uuid": "9f4347bf-49ec-4d92-9d98-ea2cfaf38a30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786297, "uuid": "2b812b2b-9a1f-44a2-b78f-a34f4ffaa9fd", "value": "12288:C6X6xLna3JRmiH20QUeuJR04C+sgHvBn14QYOEBW5ZTW2EObbPsqU:9X6xLa3JRmiWFUk59CvB1WNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786297, "uuid": "2fb6460a-9ecc-4514-992e-e6a2c03b63ec", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786297, "uuid": "0ecdce15-24af-4d98-8c08-4d576989deb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786297, "uuid": "58a4baf3-8850-4574-abda-15ed472ba86a", "value": "PO#4500491796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33eb123-0524-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629841572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841572, "uuid": "051b3234-3346-4408-be70-639908f28d14", "comment": "Malware payload", "value": "f7b7d5d90a180524b97f9669d47a3d1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841572, "uuid": "708e253d-afc8-4500-a12d-4bc9e682bf13", "comment": "Malware payload", "value": "3554b54a6958f3cec772510206d7efa53f1925c647ff111b1da4675fbe2a8355", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841572, "uuid": "0208cad6-91ee-4f23-bee4-5a7c64cce6f5", "comment": "Malware payload", "value": "74985dcc980bd6f4a9d0a7e9f799a0331abda287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841572, "uuid": "27844f02-7928-4b96-ae7d-176f37be4835", "comment": "Malware payload", "value": "1404af2728784ac81f1c78645f50d3897bfa04b0ab53e6828b84e48dd529f0a56cb3d6af33e5dd9c37d99f08ef7644d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841572, "uuid": "7b4a81a2-aace-4f85-a6c1-191b972e5790", "value": "T1B7132A8595A3EDF8CC0019357077EF364AB6E93F1038EAD7E7D8AD729981A02D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841572, "uuid": "c4f711a9-9964-4040-8ed2-578a10055b33", "value": "768:36hiVRWh7hWCbZ6OzPBNbrGP85BJwXHU/HYLp/W/:36Ew7hWCbZ6OzptrGP85wXyEW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629841572, "uuid": "4d72e481-6871-4d65-938f-9a8715c9d22e", "value": 42077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629841572, "uuid": "9c757961-ac97-484d-8c94-140298bba47c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841572, "uuid": "325b8550-449b-464f-ad31-fde616b5ca99", "value": "f7b7d5d90a180524b97f9669d47a3d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f53b20-04c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629801870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801870, "uuid": "44807b2d-7a96-426d-b598-edc59f9d836c", "comment": "Malware payload (AgentTesla)", "value": "8f309e463c6a367dab6c55eec45b900e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801870, "uuid": "b5cb8c02-4e01-489f-9cb8-7dc73bb01bf0", "comment": "Malware payload (AgentTesla)", "value": "35a10e67e910e7fde6e1ac6a1337c544772dd866113fff9d5cfd4aefc9edf360", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801870, "uuid": "bc07fcb7-3aef-4e0d-9e10-3aeb1693e218", "comment": "Malware payload (AgentTesla)", "value": "c115235489d9f6acc4693662e17f1d326a3ea266", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801870, "uuid": "83436bf6-5a3b-435d-8030-83e52e0c2560", "comment": "Malware payload (AgentTesla)", "value": "a55c3081b15b57766f7f723e5ed02f05bf267cc2a447c47c1dc07860bcb9f183f086e05a83af76ad00b3a7db587b5f0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801870, "uuid": "63d35e7b-f4d6-4c6e-bbfe-df9ce7dd184e", "value": "T104259D7063A9C148EC1A8EF116BCF79402F27DE7B6C8CD6D26E9710C8E7A9C16607647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801870, "uuid": "e3266360-da5d-4426-9106-9ab2ceb4a81d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801870, "uuid": "e3634421-26f0-4e35-b56c-b1ee942c1202", "value": "12288:a2csGI/cWuo+rLKuNvrbju1G20HbH/SBI3p6tCwAEZvU++irAkGhwAYF52EObb0:aFrBvru1G20j/SUc+qPA5hwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629801870, "uuid": "49838179-57fc-42ed-9458-1c9c569930d8", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629801870, "uuid": "da10fc88-0565-46c9-9738-addd213fce71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801870, "uuid": "a04726d4-b660-4ad1-8e08-e033e40db683", "value": "hesaphareketi-01.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef43290-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1629805326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805326, "uuid": "fce68729-ee36-4c90-84b7-0e115872e9e4", "comment": "Malware payload (Stop)", "value": "db7abe57e9ce5051ce6587152ade37b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805326, "uuid": "1c08f656-3d27-4ac8-845c-87fc2c9a74fc", "comment": "Malware payload (Stop)", "value": "35be1a97d304ab4b045cb2e608c22dd2c7efb4df1e86cdd4e0b780bdf1c21838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805326, "uuid": "ac46fb62-b433-4e96-82bd-9c23f3f2d4d4", "comment": "Malware payload (Stop)", "value": "79aee29a57622c4043db0bbd2f9c293f0449ef21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805326, "uuid": "7a6b8b06-053a-46f5-ac1f-64b6088c37f0", "comment": "Malware payload (Stop)", "value": "a0b4a6523f8888406b67d6e5fba5ed2a4b3ca9d0c17656959f7a42861a809e4490c924300eb4004807b9535345bae31e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805326, "uuid": "f6dfb158-9015-4fb1-a582-b3bfba1c4027", "value": "T151E423213869857BF166127C98B98B71DE3BB652E770214727C4CA5F8F656E03B2F302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805326, "uuid": "5fcb47ba-e9a7-4218-8827-a96b4e1ec7a9", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805326, "uuid": "42c5d2a6-a09b-4c13-8b58-e65405376be8", "value": "12288:INduljpKyf9lh+C+SlZe6zxO6ZxM9oSnurRWwk6bP/yuMq9:INqvft+dOxOPoSnroyu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805326, "uuid": "b9d9f5be-bc9e-45a0-ad3e-f18dea2a2147", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805326, "uuid": "844f1871-cbac-4a76-acdb-4e6cd55ca509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805326, "uuid": "4dc2ca41-3bf0-4a51-8645-305d632f1625", "value": "db7abe57e9ce5051ce6587152ade37b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7437816-051b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629837821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837821, "uuid": "84cc6970-bf91-4df1-8775-ac923e4bac62", "comment": "Malware payload", "value": "ddc3327235ca7e61a1ebe4415a1068c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837821, "uuid": "147a9e69-979d-46bd-af36-fdc8545986e4", "comment": "Malware payload", "value": "35ec077718fdf7711c397446001197772093714c839abc2d32933da4f446b166", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837821, "uuid": "3c6979f3-320e-41c2-8a13-41f4a994c353", "comment": "Malware payload", "value": "d86cc178306b321c684a096527b299fe744e6290", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837821, "uuid": "b6d7c588-fdae-4937-b365-bb28d40b39ef", "comment": "Malware payload", "value": "e30e9e16ff6f9d92fa6d4f77e52499b2d01dee80ea3f81a16feae35a0089083db7c04b6cd3d37055f6bb76cda713a99e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837821, "uuid": "80d8d655-4c5c-4e5f-ba6d-f817d3bc1b93", "value": "T1CC831906D5608A17C2C3177EBB9F426D37236B68979B33115624BFB82FC279D1E3A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837821, "uuid": "f25169e8-5261-4031-8b26-9cf6ec429a15", "value": "1536:Vgnz8cnC/XyoaPw4YCMjichfD7v5IYkCCYxhwEPLIGtmqXPVRj9ujdAd:1/XyoaPMfD7vqfCCuLIomAVRJKqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629837821, "uuid": "17119aac-31b0-44c4-8cd5-fe1ad835ddf4", "value": 86012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629837821, "uuid": "56f84ecf-6167-4914-abeb-eae3b2ffbb3e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837821, "uuid": "708593d5-b841-4840-8ffe-28611b027c7b", "value": "ddc3327235ca7e61a1ebe4415a1068c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ce3d80-04b3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629793037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793037, "uuid": "87f47a8d-fc40-451b-92fa-d8cf92ac82cd", "comment": "Malware payload (AgentTesla)", "value": "afc4a137e6540e60e063447df2e0a01a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793037, "uuid": "b3371740-a365-4130-a198-9c92d01946bc", "comment": "Malware payload (AgentTesla)", "value": "36313c2fdb892e365b04da45405c26b853fd19523109ab0061636a886787d83d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793037, "uuid": "3efc5545-dcbb-4a02-aeb3-98a27558c261", "comment": "Malware payload (AgentTesla)", "value": "698cea0f6932132eb83daddeb32294868cdeb02b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793037, "uuid": "97bdbf67-1c10-43d4-9c78-825375881332", "comment": "Malware payload (AgentTesla)", "value": "3ae86232eafd81616b4efffadc291476c4bd157118291676c86a6e0bb4b69be6cc354237b9128256b4fb809a4e69fc42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793037, "uuid": "d72ae888-0013-4fa0-9294-cb1490ee064b", "value": "T1FE158C7063C9C294EC1A8FF0126CF79102F235E7B6C5CD6A1ADA724CCE5E9D1260769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793037, "uuid": "2d991a11-d698-414a-b7bb-2f447c982f7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793037, "uuid": "661cf417-d09a-4fab-8cd2-81237c09f3bc", "value": "24576:2trOrQsTXplSzry4mkdne67xKWZiTWkOFg:kryQsrplSzrL1K9TWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629793037, "uuid": "eca90294-aacb-4753-a1d4-e2a5cce1cb5e", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629793037, "uuid": "0ccdef16-52f6-4daf-889a-f62a3f1d4047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793037, "uuid": "ae9f31ab-468a-4e9d-b205-8266b99ca305", "value": "PO_DEA657-ARFT-HD510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697732e2-04c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629802364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802364, "uuid": "551cbec1-f162-4734-904f-9139895b968f", "comment": "Malware payload", "value": "ba72cdc906ee871998826bc29de80f4d", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802364, "uuid": "a026fefe-7417-4af8-8379-abaa69b5e8de", "comment": "Malware payload", "value": "3698290728718ee438713d90103eba94adae4448a04607d0d533c3d4e53d1290", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802364, "uuid": "65789a59-8f42-4def-9e8d-903fc2baba5b", "comment": "Malware payload", "value": "8736fd54bca97ac9905faadbd83d23b058eeac95", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802364, "uuid": "144c3175-dd25-4d98-8ffb-a8d92adf3c07", "comment": "Malware payload", "value": "39047284c6807b87707aae751510a0e9ccddef2644e40b9bdfbd1674f4ce6057452cd51cca98ff713c261038fcc5a45d", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802364, "uuid": "adf192a4-d1d0-4b3f-9015-639e94286310", "value": "T1D8F18DA64D40DA4ACA738374D2AD40DFAA1856252CF89ABF1C157B7852044E76BCE1B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802364, "uuid": "d3907a51-b6c5-4336-b0d1-beb4b88fac6d", "value": "192:xrXP/p6G29r6v/HnCg8Zt0+eX+1qvwmZd80H:dXPF29r6vfl8ZtvYICN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629802364, "uuid": "38acb30e-5d6a-4823-9357-01e5ba159b3b", "value": 8138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629802364, "uuid": "faca9b63-3f60-43a2-bcb5-e0fcad4f3049", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802364, "uuid": "ec1fee74-764a-4ee4-af35-cc5733871cf5", "value": "QUOTATION.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e6c8fb-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629805930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805930, "uuid": "90802b3b-f124-4863-aa72-4f734cf264d9", "comment": "Malware payload (AgentTesla)", "value": "a8d70f6abb5fc380a6c36dd60dedb969", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805930, "uuid": "b2931793-2efa-4141-bb26-682ca604db90", "comment": "Malware payload (AgentTesla)", "value": "369b2d937fd2d49721cefcfb3de491a27c3fa2685833e9b9c8c2f0db39caceba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805930, "uuid": "ba097ece-56ef-4f78-88ae-1894194abb35", "comment": "Malware payload (AgentTesla)", "value": "9a60fc71893bf9c4415865dce6dc0c29fda8d321", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805930, "uuid": "66389343-dc89-425e-8a3e-6fedd23ce1c7", "comment": "Malware payload (AgentTesla)", "value": "0c38f23bb65558444b7360fd403b9d4fac6260499210c74aaca93dd17fad6f1dcfd215069b78fabd2d85450cf4c15dc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805930, "uuid": "f520dcd6-88c6-443f-a8c0-f0cb3ce17a4f", "value": "T11AD45C9C765071EFC857C876CEA81C64EA6074BB930BD243A05716EDAE0E69BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805930, "uuid": "33603c27-d8c2-484b-adfe-38eb195df9ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805930, "uuid": "27b8e38f-2fb4-444b-ae14-6f6e066071aa", "value": "12288:goWGcRhSeKXWZKWCvDuxpY/KA8o2Bmandoq75w0GNsFu+gQf0WWdsgLxuV1b:goERh7KXW8WqUI8hBdoqCuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805930, "uuid": "fe1c3c8c-f201-485f-8637-67fad99935b6", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805930, "uuid": "8a321241-abba-41e8-b335-c94a4b9da2bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805930, "uuid": "15e4086b-eaf5-4807-851a-c072474909a3", "value": "TRANSFER SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d24bdd-049a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629782249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629782249, "uuid": "26553575-d491-4703-9919-1eb8b4854c06", "comment": "Malware payload (BitRAT)", "value": "f9ffd562970ec4e8ad6f48e354539002", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629782249, "uuid": "27bac67c-7f88-49bb-b554-34719eeeb0ea", "comment": "Malware payload (BitRAT)", "value": "36d0c6d5280a29e061d07ad6eac7236e063ee8023ac398bb6d3f34a3f8aacb83", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629782249, "uuid": "64192da9-f027-47a9-9f4b-54fb07a26f59", "comment": "Malware payload (BitRAT)", "value": "374028e361f5215e2c9087086fa6f5af6dba1ce6", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629782249, "uuid": "b81c02e9-bfed-43e8-babb-d3df8a8bbced", "comment": "Malware payload (BitRAT)", "value": "c86b57c3c85ef38928745b827a480d1f9fb38129ebc76578ae91dcb9a0f90d042cf0cdf6a25a3f490973a0c6fa333cbf", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629782249, "uuid": "24743813-af6f-41d9-9c73-a56b55528d37", "value": "T1EAD2C66C33F84B23C9BE9BF654B1222153B5741B1432F75C1CC660EA2AB2F608959F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629782249, "uuid": "0830395f-31f1-4a0d-aa4d-d17a4d846c18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629782249, "uuid": "99b58a16-2783-476a-b379-e65ca466a233", "value": "768:A2ERiX7UhNyv3OwwOHiz5w4pqPpKHdbcS+WBjc02n:A2ezzq4D2s2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629782249, "uuid": "dbfa60f8-e688-438b-9eea-9d60de9f54ad", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629782249, "uuid": "67ff0d28-2df0-4211-be8a-a89888c6a3c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629782249, "uuid": "a915fffc-5bd1-4869-ba7d-9cd78497cb37", "value": "excel.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e558551b-04c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629800424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800424, "uuid": "298591d0-9358-4fc8-b336-1b2ce676e69a", "comment": "Malware payload (RedLineStealer)", "value": "bf0459ad4ce419fa438e66382c1693eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800424, "uuid": "254f9a36-7c78-445a-adc6-c95afd356cca", "comment": "Malware payload (RedLineStealer)", "value": "374fe48e2677be33b362d63a5d0f306a29fd7cd0e19302b8bdf4dbbebf46b16b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800424, "uuid": "acee8d4e-5831-44c4-8f53-e87fe76d1365", "comment": "Malware payload (RedLineStealer)", "value": "92f29418449e7960821f7ba4f314085e4ffda4d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800424, "uuid": "89bfad05-a501-41d9-8662-39503c47efba", "comment": "Malware payload (RedLineStealer)", "value": "7c94e1817f90e0ac829da4c7bafc04a70bd59db4b5af2d16341a58e4926969bf37ad69756692cb5eab1b68fa89f816af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800424, "uuid": "553bdb3a-317d-4819-9083-abd686891c21", "value": "T1AF74AE30ABA1C034F5F212F445B687B8A93A7AB16B7450CF52D51AEE4A387E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800424, "uuid": "1191466c-b32a-48c2-ae01-37c547480fa3", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800424, "uuid": "f60fcd64-1521-4b15-b080-18ee18e65a76", "value": "6144:QErX4Swmpj3GtqUb41xUOYCKkKLWu1uDsNb/7G321USM/DRxkVqqRXU6Mj:TXvwml0qTCgEWSuDab/7Gm1USSDRxQdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629800424, "uuid": "7c50ce79-316c-4453-8929-6186fc3e39b6", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629800424, "uuid": "dcef2da0-67c5-4b67-839e-0610ce08f898", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800424, "uuid": "f18c8b37-ed10-4839-bdb4-ec8f7533b671", "value": "bf0459ad4ce419fa438e66382c1693eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44f13ed-04bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629797336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629797336, "uuid": "22386ab7-741b-4e72-8391-74651be17cb6", "comment": "Malware payload (SnakeKeylogger)", "value": "1c8a5b209f13e25d2ad65857192c1b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629797336, "uuid": "d0ac60c3-415a-437c-9124-8198286b2f8f", "comment": "Malware payload (SnakeKeylogger)", "value": "3776aaf0ca18645e4e245513a4aa3279cb6240221dac7f2401b63e8fba00ffbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629797336, "uuid": "a07e7734-0499-4cb2-adb6-5adb63e2e620", "comment": "Malware payload (SnakeKeylogger)", "value": "6d65231dc40867e4d5d5f5719d9fe4867db4c6a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629797336, "uuid": "dc38ffda-40fc-48ed-b000-31c340f58865", "comment": "Malware payload (SnakeKeylogger)", "value": "5b34b5ba1d9e74ac11e26fafe24ed708c63ad6184575ef7edbd22279f3bda270c65bd075143164a4fda6549eb2a9bccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629797336, "uuid": "5995c4c0-a40b-46c8-bff1-30ba92876790", "value": "T1A3057C3063C9C284EC1A8FF0167CFB9402F235E7B6C5CD6A16DA724C8E5A9D16B0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629797336, "uuid": "88512333-17d2-43db-a623-911d529df69f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629797336, "uuid": "d9e44211-08aa-4155-b009-408ae2a10fbc", "value": "12288:25csGI/cBRb6Ob0GAxWDxz277/1m57LndWOt1z2EObbn:2qb6qBaWDxkKFWCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629797336, "uuid": "03d92fef-7197-422e-971f-d9e822a2b8c4", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629797336, "uuid": "b34b2b8e-cbba-4783-81ca-0446241d0aeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629797336, "uuid": "e40f71c6-ac51-4cee-a1b6-e08d7a5564c8", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f10896-050c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629831108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831108, "uuid": "99864ab2-db79-4e58-ac8a-26a8aa7e21eb", "comment": "Malware payload (RaccoonStealer)", "value": "9dc9ba7c2a052ae0517109a56e04fbf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831108, "uuid": "2fded07b-cf8a-463e-a84d-7172ef3d0289", "comment": "Malware payload (RaccoonStealer)", "value": "377d7bd0bb633c59150a6166eb415c8ecfea50076139ec717c263e10b50869f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831108, "uuid": "77e20805-f40c-4e05-90dd-d3fa686f5fb1", "comment": "Malware payload (RaccoonStealer)", "value": "e456ae6391d025c3ba0bd194127f26b94f5fe031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831108, "uuid": "cd3692ff-7165-4913-8189-3c670334c058", "comment": "Malware payload (RaccoonStealer)", "value": "a85cd7bfff75ad0132da2b0b576666462785f70dab184d0d3a8a834bce8c73d16b38f1f9c037b6472ec6f9916434097c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831108, "uuid": "df38ecbc-b0dc-44b7-9a35-b9fa7c6ef056", "value": "T1AD940211BAB0D133D5A20C722C61C6946579FC502A7981537FBBEB5F1E222C0D72AFA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831108, "uuid": "399dbfd5-6161-4eb0-8ef1-f1e9f4f54e1c", "value": "ca5ba0dfe6e58a229ea3afad859dcc2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831108, "uuid": "2207dfee-ae72-4996-b1ef-81342cdcb5d9", "value": "6144:A99Wzt1TNP7AukyWZsd5C15pUW34PKfZHaa97zq8PLlKmROc2nEoA42HgFnL:Awzb97rklZsOJ3++6yW8hKFEh4ZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629831108, "uuid": "d8918ec8-7bb2-4568-a350-de10d551501e", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629831108, "uuid": "8f9dd8ba-1ee3-4fbc-9588-294f21cd1765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831108, "uuid": "fe30a298-4d27-4f1e-bd16-e001b5a4e4a8", "value": "9dc9ba7c2a052ae0517109a56e04fbf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272e12a2-04b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629794951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794951, "uuid": "d964a6de-ae41-4357-b820-4e80bbbdf287", "comment": "Malware payload (Formbook)", "value": "df4dbea736165e507e2daf6726ee2903", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794951, "uuid": "2807b11f-8ed3-4313-9a32-143148cd4260", "comment": "Malware payload (Formbook)", "value": "37d7d0735e4cedf32ffff58f24330efb4b9fd08cf836ca876350e69ee769ae66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794951, "uuid": "5957f6ab-5272-43dd-819c-7e0ce31a831b", "comment": "Malware payload (Formbook)", "value": "f82a7bc0b616304f54f527f94f28e0ecd5dee65a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794951, "uuid": "18035897-04be-4255-b559-30a97101e390", "comment": "Malware payload (Formbook)", "value": "552e1cecf219429a1f76d2fb058e740bd110accb44163ba394b5e768d2c803c31f2feff61c2586512570b2076f8da102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794951, "uuid": "a23e16a3-eb52-4b8f-8051-15aa3636ac92", "value": "T193159C306389C284EC1A8FF0166CFB9402F275E7B6C5CE6E16D9724CCE5E9D12A1764B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794951, "uuid": "183df0a2-23e7-4fe6-9ef5-ad14b630e336", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794951, "uuid": "8d46876c-6dce-4be7-86d7-183db17db2c5", "value": "12288:tccsGI/ce2aHhY9Sc4AWH08p1maHvZbbtphfRew/q8IhbjzmMpNQKVR2EObbD:tzcYbWfxbt7fRojzlpNQCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629794951, "uuid": "af2159da-7885-45c7-bb03-88e99265a6b2", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629794951, "uuid": "58cea214-84f9-4d14-824a-09e841e664d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794951, "uuid": "5eb3de77-fad1-4e5b-90d9-27d624e1c960", "value": "Bank report & payment invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95905059-04d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629808022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808022, "uuid": "2dd26cec-e532-4704-82b8-c1d8a8fe43d6", "comment": "Malware payload (ArkeiStealer)", "value": "3c0ff1476f4da58cc85553ab15fa03cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808022, "uuid": "617bd327-3d2a-4746-b048-1a1f2c781071", "comment": "Malware payload (ArkeiStealer)", "value": "386cb4a88b5c465c29db7093db94fe6b8e30bb41c2d994569b1fc05d9b1b82d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808022, "uuid": "2a80949a-00b2-404d-aa7d-d6f348bf3e6d", "comment": "Malware payload (ArkeiStealer)", "value": "b74fc29e44fd167f17f8e75f74bbc8fe1cf35d0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808022, "uuid": "ece24220-7b5a-441b-b225-9c7bb412e23b", "comment": "Malware payload (ArkeiStealer)", "value": "33b14a6d1df616015197e4c358af7b98231c242ad73267e151ecd51732e6df1edd6a55827322a3bf89a20651d19b4b44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808022, "uuid": "765ccee2-1ea4-4324-9e29-2cadcb83f98b", "value": "T172A30600E5A0911AD49813BBC1E653BEF05C9D7C836E61C3EF916FB20A75AF1297249F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808022, "uuid": "1eb5eb1c-e2d4-4fd7-9f2a-94bdb20be032", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808022, "uuid": "9e907005-1378-4f5c-9562-848a887edc70", "value": "1536:TGnHF3PKBF8cRjz1HR9HlKGDnIiRlgrquiZ7HxGIo3/e7pKGPXlagvH0Lraw3Rpl:TGnHF3P8u4VpDL/laSUjGU6xr9r0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808022, "uuid": "69e212c7-8d99-49c8-aa3c-c1c996192891", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808022, "uuid": "0abea0bd-92d5-4236-8d09-b7a5357230e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808022, "uuid": "24e4fc36-d1c9-4788-87f0-bdda014ba0b0", "value": "3c0ff1476f4da58cc85553ab15fa03cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe378f31-0511-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629833537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833537, "uuid": "aa0f6223-f7aa-47f7-af78-cc6131cc80b4", "comment": "Malware payload (RedLineStealer)", "value": "0c0198343ef7e26e81b383e2720f6271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833537, "uuid": "53d8e8aa-9ab5-4f44-9c40-aaf2f9d0a11f", "comment": "Malware payload (RedLineStealer)", "value": "38d4d2c705f34cdfa67e0084415064b07cc17f728b87fb787525605a4d1a26b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833537, "uuid": "9abacb92-a2cf-4ba5-aaf8-25b0fd31e4d1", "comment": "Malware payload (RedLineStealer)", "value": "b013f15f45ce40978dcebafaecf4038ab6b26e47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833537, "uuid": "cd444946-89e9-4449-b670-10a96eabf27f", "comment": "Malware payload (RedLineStealer)", "value": "91068ba4287d05cdd7b6bed122d3f1922391182a07dfb84f4349f0f911e26f77b66ef568ebe968c51effe0bb1828a614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833537, "uuid": "ac4f70fd-ca55-4733-9c20-ecc25982969a", "value": "T1AA6558237BCDDA13D29A3637C0CA550443A39E412622F64B7A8532D90A677EFDD0F789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833537, "uuid": "1e0185f1-f1d4-4a72-97eb-28272b09252d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833537, "uuid": "0d7d9d7b-0686-431e-b1ea-f43938388ea6", "value": "24576:aKXrBdlLXF2obDt+SW2h1W+2SdN2CWl/xsROP7soHY+uJmlHQGZeeJ:vrpnbDt+SW2h1W+2SdN2CWbscP7T4+Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629833537, "uuid": "d8761811-60ac-4116-98b1-15f833a8e76f", "value": 1517568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629833537, "uuid": "4017564b-c35a-4b9a-98eb-ec691a4c765d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833537, "uuid": "580ed9a3-c11b-4a2d-8aef-8769c3b1cc8f", "value": "0C0198343EF7E26E81B383E2720F6271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46dc562-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629805604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805604, "uuid": "d2ea531b-544b-4c2f-81d0-1479e27fbbb9", "comment": "Malware payload", "value": "0d956dcb4a19f1bb4825392a0c654ad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805604, "uuid": "d613f3eb-bfcc-47ca-9a0e-a9992785e19b", "comment": "Malware payload", "value": "38f32d4407d8fd264c2f5585340fb472325e066d335bcb7de398c4e033c04c84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805604, "uuid": "23f56f03-f1a8-4a15-bef4-bb7438a3f530", "comment": "Malware payload", "value": "52221329cb3a1c8485c1062af3175a38bc738926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805604, "uuid": "08d628b0-a6dd-4908-8d7a-ea36483adf7b", "comment": "Malware payload", "value": "1db0c66a225aa129291bef3d0650e2df026db813e5416a58d51aa11f0581efe47c61dfa8fdd9fca87dc7e7877e1785bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805604, "uuid": "dd33c9a6-7bc2-4276-9172-b5c466e0243f", "value": "T13C9412A23BC70655C34CB6B1CCA48B28039DD3E41E6D900FBE306959FD652ED9D3AE46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805604, "uuid": "e314802c-70bf-48c4-89a0-753415fee9fa", "value": "19d4e66d725c89ba6712b82bebc8196d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805604, "uuid": "3d371055-68f2-45bc-b3e0-c6578e6e6f99", "value": "6144:2SuxNOug5MI3KBau3EO8iZrEXA2czL6mWzdoZtAznpGuGEwJvfJ0s9VC:3ux9g5F6U2WOWczLygAzN6fJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805604, "uuid": "dcdbb2f4-f208-4388-b9aa-d23ee63cf2a5", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805604, "uuid": "326e3f61-3892-4c99-b01a-fc70e0932c53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805604, "uuid": "ec97d1da-c3b9-423e-a618-f72f8af5f7fa", "value": "0d956dcb4a19f1bb4825392a0c654ad9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac249dc-051b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629837827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837827, "uuid": "2006c23b-bbd2-48c5-91b8-f24ba7a36dda", "comment": "Malware payload", "value": "cdd7ce00861bb253c9839004770cdb13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837827, "uuid": "e601ae4b-48e3-4eda-b4bf-477acfb444e2", "comment": "Malware payload", "value": "3925a3aebf3a6fb70ad0144a3aaaff67cffc7ce1a2793d57463e073537d2ac0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837827, "uuid": "1ad67ca0-13c2-40ff-8e2d-3347f91fdd00", "comment": "Malware payload", "value": "5ca2ddd6eb5e5ff59f70abedea8a824b23a5cd2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837827, "uuid": "9c2c5d92-97de-46d8-b017-21c9cb977679", "comment": "Malware payload", "value": "3f62ccaeb11538e4189123b245ad2ad72170b758ac29de0c35b6a862693f2fc9383aee05dc5735c9e6441843e68431fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837827, "uuid": "81fc6dab-13e4-4662-87ed-0d7dbb68155b", "value": "T1F9431A43A9A29FB7D1965EB52AE70A300753F9154F4F1B8D713EA9F4074B9CCB81A320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837827, "uuid": "ed1b6427-7449-49d6-a27f-9d531d62519a", "value": "768:oVhPiuHmEXQMCUkKM3NsDaAo/ScGEhGxGfCOjsKCFINwkSKjL+X6l3:oVha2mEXLoKM3N3v/AEMOxCF+wQHEy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629837827, "uuid": "c0a4b0c8-4678-4eb9-9fae-a83053799c2e", "value": 55797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629837827, "uuid": "af05d1d8-3744-4259-87f0-af3ea19d6e3c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837827, "uuid": "8ade73bc-b1f5-4ec4-ac56-a4cb98d18359", "value": "cdd7ce00861bb253c9839004770cdb13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e59df6d-0502-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629826693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826693, "uuid": "63b9bf8c-951e-4063-a3b4-b723f8eb061a", "comment": "Malware payload", "value": "24d513394ee068f066ccbd604f4f718a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826693, "uuid": "69874db8-aecb-44a2-84de-0bf55bbb5dc9", "comment": "Malware payload", "value": "39a9af2e4dacff39613bf2e27af27ca9756c98e178d082337a28480c8bfcb1b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826693, "uuid": "95a00c4b-cfa4-495e-b002-6cc2748989b5", "comment": "Malware payload", "value": "656f25c0fe6fec97a15216c457c79ad7ee2ea832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826693, "uuid": "e8e4f93d-fef4-4a19-9d57-a226579edc83", "comment": "Malware payload", "value": "2b07082739a6fc68caa29d73141f200432e1be584c6da827f9ed5b2ac9d1d81def7b04bfa6dcbd70dd0d7fb5e8be1eef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826693, "uuid": "a717f54a-7653-4357-b132-243eaecd2291", "value": "T19AC49E3573CA224EF36895719D606B48BA7260BEBED3471F265F091C68F7528CBD120E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826693, "uuid": "533c9f96-9e04-4188-bbde-6d890edf6885", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826693, "uuid": "2e8ed065-792e-4e01-a017-37d80cb5802c", "value": "12288:wLDZDClI8deneL2iNF2iNi4QissaMJcR/V:aDZ2lt1j1esId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826693, "uuid": "260fa61d-c2c5-4828-82ca-ae249205aca6", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826693, "uuid": "d822146a-767d-4f1c-bd43-c9aeaa7e6b0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826693, "uuid": "2071d047-a7fe-4198-abf5-df29fd9e5772", "value": "24d513394ee068f066ccbd604f4f718a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd15a90-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629786369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786369, "uuid": "0f36474e-7507-40b8-9abc-ef774b3753a0", "comment": "Malware payload (TrickBot)", "value": "643a3593c00e5794a24840ae3a5fb11d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786369, "uuid": "2896d64d-f1d0-4b0e-91f1-9414c66521ed", "comment": "Malware payload (TrickBot)", "value": "39adc7e2ea2a22034a153bb7d5eaba75ac81a26ddb0407bab5108242d1878c44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786369, "uuid": "252a3888-f536-4121-98cb-2cabfaabc213", "comment": "Malware payload (TrickBot)", "value": "d8bc7dc887711d56897244547f19bec2b9669fce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786369, "uuid": "b3c1bcfc-3452-41eb-a806-83c4d1abcf65", "comment": "Malware payload (TrickBot)", "value": "20ef1562ebf678356b78597f1fa35ba21ba4f572d5265ad825f26a3f8e5c57ce65437f32d77c368bd6cd414aed9b38f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786369, "uuid": "d92e7415-b20b-4804-9f62-8b0d91c1b246", "value": "T16D0519D0634CCA7FD6C33130F3A61633D2538B4E1AAB919BEB58F59AA86E5467413307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786369, "uuid": "017705a1-2ad5-471d-b583-372fea0c0f94", "value": "884c251bdbb51e23564add248435ff5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786369, "uuid": "ae56f286-550b-4c58-ba0e-8aec4204b60b", "value": "12288:QFuLe4nHJm79H5Z51MKd3GydYLMcOCWvnJi7:QFF4nHJoVZbnJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786369, "uuid": "9e234f14-1d69-4a3d-aad2-d986b041017d", "value": 839733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786369, "uuid": "4aa1723d-1821-4ea0-9761-61706989ddfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786369, "uuid": "66235d88-4fed-426b-9ab8-f19356d77901", "value": "643a3593c00e5794a24840ae3a5fb11d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233bfbcd-04a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629786784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786784, "uuid": "d0de1039-4174-41e1-9f38-498229314938", "comment": "Malware payload (TrickBot)", "value": "09394345508176f927cc339bf9ce00e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786784, "uuid": "22299423-12e7-4836-9332-3071b68a7b73", "comment": "Malware payload (TrickBot)", "value": "39cfd701bd46e09a5491ab53ee5205cc06ad2c8d5ffece4ed84853fff01a3865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786784, "uuid": "788aa9aa-89d3-44e1-a308-697fdad58177", "comment": "Malware payload (TrickBot)", "value": "3cb7adbc32e5344b7039d2192bc95fbd663a05a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786784, "uuid": "613c1b36-e8e4-4bb4-a613-9b00abb3dbf1", "comment": "Malware payload (TrickBot)", "value": "6cf2b1b4cc83dbce865a51dce1ed9ef6b7c5fe453b8ebcd3dc68dd25db12ebaf2df40c03beb7441949c6ea108c071ed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786784, "uuid": "0a9eed43-bab5-46c1-95ba-c382cab0d3af", "value": "T1730519D0634CCA7FD6C33130F3A61633D2538B4E1AAB919BEB58F59AA86E5467413307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786784, "uuid": "556c781a-9d76-4e80-8c9e-8f22b7f90fb1", "value": "884c251bdbb51e23564add248435ff5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786784, "uuid": "a556799b-b883-4325-8811-3cdc9d088456", "value": "12288:QFuLe4nHJm79H5Y51MKd3GydYLMcOCWvnJi7:QFF4nHJocZbnJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786784, "uuid": "4b5f18f2-9da6-4d1d-8b83-62b31f8f8a98", "value": 839733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786784, "uuid": "d971346b-ca79-4493-b490-535a310b77aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786784, "uuid": "80270951-e60e-4e50-95ac-9dd1ea6a9898", "value": "09394345508176f927cc339bf9ce00e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5df92be-047d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Pony)", "timestamp": 1629769877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629769877, "uuid": "b11a6c7f-1733-435a-8b53-ed877c0319fc", "comment": "Malware payload (Pony)", "value": "6f9e2fac331924e5d8ba3311ef50fc92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629769877, "uuid": "764a5eb0-5d19-4142-a973-c551d056fe68", "comment": "Malware payload (Pony)", "value": "3a3e64a62b263e6c5438f0e7001dd25543c35d1335a2fdc925366f1deadaff07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629769877, "uuid": "ae6217ef-1b11-4e62-b812-945d086c70b6", "comment": "Malware payload (Pony)", "value": "ba4a3e441b9723be1574e42702410a6fbc5f5ceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629769877, "uuid": "2c94adfd-d86d-4453-bb80-8e31d7344ad1", "comment": "Malware payload (Pony)", "value": "065b880e7520dc4d8fb4f5b8ea90ecde6d1077e75c62fa4caa952a390ee03dd59a55cf9db1d6a98216bc94fd5138990a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629769877, "uuid": "8b98da3d-2124-41c0-8288-f3ca1cd2e136", "value": "T11814E008A6DB98D7DAEACD35F08EBA05976CB30F42CF1A2BD481C40585425A3FDDB6D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629769877, "uuid": "04a50788-011d-46b6-8982-44c4161931a1", "value": "9f9bcb7fadb6c2e8de6c0bd69a2031c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629769877, "uuid": "29f1bbb8-a444-4f47-9388-2b3b88012a94", "value": "3072:xb1//fw5EANorUUltQgf3exaGUc1N3A7rXSuoIkppc4F8snkW:ZF/I5ESuUSZeBUcDA7rXSvppY8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629769877, "uuid": "bf23b77b-0ab8-4da0-8820-02d129bdd4e3", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629769877, "uuid": "c50cf3db-f37f-40b5-93c7-3be3975de68a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629769877, "uuid": "14a1cd96-6cc5-4f47-be6a-c102bef83606", "value": "3A3E64A62B263E6C5438F0E7001DD25543C35D1335A2F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0690fdd4-0492-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629778576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778576, "uuid": "3eb596a0-234e-4a15-bfda-06d89c023217", "comment": "Malware payload (BitRAT)", "value": "a65c5d8268daf8603d3f4861991cb09e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778576, "uuid": "30fc383f-ee80-481c-8505-cb0038f75378", "comment": "Malware payload (BitRAT)", "value": "3a3ff370dac609a17ea67e35e81a3b82702afe6660bb3439a489ff8f4350d607", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778576, "uuid": "1c044d6e-f318-4847-829d-e7811f90a15e", "comment": "Malware payload (BitRAT)", "value": "8b22cbad5c3d38e4a683f1b68a3b9037eb3559f1", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778576, "uuid": "58901621-3f62-4583-b31e-a15c6ee1d8fe", "comment": "Malware payload (BitRAT)", "value": "e6bcd6b7a58af4a34ee77daff010eec1ec6393704dece03864bfa972e69d78fe75cbec7a0279209be722860de7995132", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778576, "uuid": "a32dc554-4f47-4a36-ba8e-ee12c3698065", "value": "T11475231168B189BBD0BA4D794C0F6F586A7D6BC83AD06913BF1463EA8C70184D77CE39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778576, "uuid": "b0e680e4-ed0a-4b0d-9b9b-ba013376d196", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778576, "uuid": "07e065f1-5a1c-49ec-a1f8-499e05243527", "value": "49152:7vzezLpGAOtBRskfPrJ5eZzZO+1AqGF4F/jSK:70V3OHskfP9QZjAq+4F/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629778576, "uuid": "ad1e0cd5-e889-4439-a51f-e9e07c23da57", "value": 1635840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629778576, "uuid": "edc55ca0-c289-413d-ad76-c247deda2319", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778576, "uuid": "4efc70dc-7830-48b5-bf44-560c3550c88f", "value": "A65C5D8268DAF8603D3F4861991CB09E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537e3b54-04ab-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629789442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789442, "uuid": "47484e09-3a10-4c26-9e98-7bc13bfe0ff9", "comment": "Malware payload (AgentTesla)", "value": "128430f908b8f0fdbdf2e97e74137e38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789442, "uuid": "e15f60bc-f5a1-4e33-8fab-a75256c8e904", "comment": "Malware payload (AgentTesla)", "value": "3c1e4ff41ca7ea571dac6473015ee944a0ab930324c07e257fa96b60fb983fcf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789442, "uuid": "bb0f9e18-ddea-440f-91f8-2fa8c972eb2c", "comment": "Malware payload (AgentTesla)", "value": "0e733e69376467547a9ed4c3aa38937ddbff6f80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789442, "uuid": "e9453e37-09dd-4eab-b6c1-2c8b8de87d59", "comment": "Malware payload (AgentTesla)", "value": "62bf984aaf8718483d5b4de48e20d7f3f4bed36d40905badbb98bcb5af90ace582834ed678f51ac6172efd4d1620f97a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789442, "uuid": "7a80a7a1-c13b-49d8-abdf-982f3d8a687d", "value": "T15C259D70A2C5C284EC1E8F701579FEA002733DA7FAF4CD6E1A99715C8E7B9C2161664B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789442, "uuid": "e54ee2b2-2536-4e71-8edc-5cb468fcf95d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789442, "uuid": "66bdfde1-ca5d-4930-880e-198dca73f883", "value": "12288:WGcsGI/c+G/ndfyELVsR7HKUyrPjBbV0BC/Y1NH0LAeiJrQu4h93S7UaMv+2EObE:W1nvxQ7HKfrP9h0DeiJ0u4h9i7UaW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629789442, "uuid": "abbfdcd1-d141-45a3-8b5b-fb11fa60677e", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629789442, "uuid": "50bbf663-bc05-4fec-a7ff-2b2481d85112", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789442, "uuid": "0bf8fd02-c659-4b19-86a9-fa66cfa3aeff", "value": "BH 2H3223ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c311509a-046f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629763860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763860, "uuid": "bab306c0-87df-48ca-8ff7-e998f489eee1", "comment": "Malware payload (RaccoonStealer)", "value": "52cbc6737b32e48a6695104e68cb070c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763860, "uuid": "a6da57db-6346-47f5-b1aa-176953685f50", "comment": "Malware payload (RaccoonStealer)", "value": "3c66a4abb778c15c78c9fad7e119a38d3dd423569430fa1d2a70c243dcf9044a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763860, "uuid": "b04f4ad2-7f6e-45b8-b297-01fa88ce0597", "comment": "Malware payload (RaccoonStealer)", "value": "953b3d7144f496aa206eb74226839850fba096d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763860, "uuid": "33ce98e1-a6dd-41a9-8b82-7061a8d4420e", "comment": "Malware payload (RaccoonStealer)", "value": "6cb89f4ea7f94945b3a6e1b3b46a92b30cfd5f374f4180c27f44b1967bb66bf8c164ffd2388eb18912f1bb3e435dce23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763860, "uuid": "e66bc3f7-3dd6-453d-8f59-f93982fc82fc", "value": "T123940210F290C9F6F14053700EE6CEA1E4EBFDA25A7191B377D8631B5D21194BA2A37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763860, "uuid": "e653b185-e43f-4d00-bcd0-aa93b08bb293", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763860, "uuid": "9b47ddcb-252d-4994-a9c2-ba8983025a1e", "value": "6144:qgRUXNt38l9kULNAZHDU9ydbvnm675UBXEQRgEZ3ZFVo3Wddc16qugZP6:qgRUL81NYDU2Lx5UBXEQOyjVoGK/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629763860, "uuid": "55ee6397-5711-4482-a3cc-6372ea7a6ba4", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629763860, "uuid": "6de10f30-164b-495c-a23b-2fb87b777bb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763860, "uuid": "dc275638-eb23-4d6e-834e-5fc564ed7cec", "value": "52cbc6737b32e48a6695104e68cb070c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91930f29-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629805008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805008, "uuid": "e6c93002-6dc6-4d7c-95aa-1117c325c4e5", "comment": "Malware payload (Formbook)", "value": "e81d94784ac7942720d6cc4d5b62e7d2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805008, "uuid": "ed8bca36-cb6a-44c8-90b5-9703ba67248f", "comment": "Malware payload (Formbook)", "value": "3c9121d12af2605c8a6b77568d629187c1212957144d8ffc4422ffd3117d294a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805008, "uuid": "ffd1504a-9e07-4743-b79e-1faefd0df5c1", "comment": "Malware payload (Formbook)", "value": "07869a20e90774811c396474eb865f84bfa6d4ae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805008, "uuid": "4ec12f75-daf2-49a1-9896-a957c4795c6b", "comment": "Malware payload (Formbook)", "value": "9135583909c7387087b12bf1ab150fbef057a1e2c8ea6b80226f47076b0a7acf10327cba55345ce29a88cf894b7827d0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805008, "uuid": "437e0be0-a035-433c-9abe-66a9e041434b", "value": "T113551227B4E45B21D4278D31288BC3852C355FD8DEFAF74F6288FA181876A7C99C2754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805008, "uuid": "980123ce-d60c-40bc-89bd-ebff016434ee", "value": "24576:s9QEcZtiTru3UYeo7xJUhH/3EMjpy2dfRUcjDIYofOP/cqkCnHmDSKx7qPpe/N:vHZtiHu3UYeo7x6hf3TpyknVkCG5WeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805008, "uuid": "684659d2-06ba-4e0a-a133-708b001a7127", "value": 1349368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805008, "uuid": "14ef2b75-03f2-46d6-83f7-7f26b058ac84", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805008, "uuid": "b13f8f53-f48a-4d03-b42d-9da555b5b946", "value": "SOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f268b6a9-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629805600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805600, "uuid": "88b6e44d-e160-4ca7-b507-89b4cac28d7c", "comment": "Malware payload (NanoCore)", "value": "14794350a3a737e04ee9093722f50e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805600, "uuid": "50bed987-4e42-489c-b07e-6168a820d7a7", "comment": "Malware payload (NanoCore)", "value": "3df79d186d0c86afa373fda6463964d5f09e0e669af0c7e85f783701dea87789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805600, "uuid": "894b4871-809a-47c9-b192-4b2ce2843878", "comment": "Malware payload (NanoCore)", "value": "f4cc8bc2cdb07cfddd94bf131f648e4c4294e307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805600, "uuid": "69a77635-8fed-4a70-9437-1c5d2e51d33a", "comment": "Malware payload (NanoCore)", "value": "511a5cb8ecfb16ffcbe8e1ca0152441492f36f39373b15e5eff142d52613b2fd9faec5091f99354316a5a114fa65ef4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805600, "uuid": "32f8d66d-62ae-4bac-a90f-9840fb16a33f", "value": "T166258D7063C9C284EC1E8EF0167CFB9402F235E7B6C4CD6A16EA624CCE5A9D1670765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805600, "uuid": "db2157b1-5b1d-4770-8059-223a0163d509", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805600, "uuid": "686c5eee-1306-4619-a842-3c22891d1b8e", "value": "24576:2GLuoElGNlSWRaVAgyuzPFwk4bmCDh99:LREfqUAgxzPak4bnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805600, "uuid": "da5ede2b-ccc6-4fc3-8ecc-bc3460bd7a28", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805600, "uuid": "979c0f4b-4d4b-4a62-b731-73b429fcd855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805600, "uuid": "7d69f9c5-1f38-478f-8eec-94510dabe296", "value": "14794350a3a737e04ee9093722f50e8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47be9138-04e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629813045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813045, "uuid": "0cd3deba-77d6-47ac-9de7-f3aa3ca3ae0e", "comment": "Malware payload (NanoCore)", "value": "03d3c63534935804f4bf67b841f795b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813045, "uuid": "d5bd0d48-14de-4ae8-a5cb-934407975bfb", "comment": "Malware payload (NanoCore)", "value": "3e262d76a5ca8bfc0891d860bc823b2869664858f8ed987a1d16a83524607297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813045, "uuid": "b8fcd7a4-b25a-43a0-b1c6-6c3809b7706d", "comment": "Malware payload (NanoCore)", "value": "9ebb1bce1bbec67701f1ff9e116432a3214ab9ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813045, "uuid": "923f6ead-1a60-42a2-88e6-0dbfbc2c8680", "comment": "Malware payload (NanoCore)", "value": "4f0b4b1a3cbc3f2ab0c31081002a6996249980151f90f88e225b88290452c9e24b2a5707c4478e5a16047fd780a241fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813045, "uuid": "9193cd7c-67e4-49b7-ab19-8791f8bdafac", "value": "T153259D3023C9C294EC1E8FF0167CF79402F235E7B6C5CD6A1ADA724C8E5A9D12A1765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813045, "uuid": "74941849-c68f-4559-a32d-7460c5ffcdc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813045, "uuid": "6b584f67-20f6-4c44-b535-2a3e2635ebea", "value": "12288:IwcsGI/cLmskomlHxOEb+EMnCCWaAt+KCjfLvdCU/F7CQvLNtDsyhL5EuvVmME2q:IAsEJxOhCkAt+pfZ5FfvLLGiIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629813045, "uuid": "63138cd2-1d2a-4a7d-be36-53af211858a7", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629813045, "uuid": "8d93736c-0ab2-4509-aec8-ad9b9186fce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813045, "uuid": "0c8f49d0-bfcc-4b7f-b6fe-633de4fb584d", "value": "Revised Document#089321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55aa185b-04fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629823376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823376, "uuid": "0dc74b8a-8635-4b93-8a4a-6926ed9a3616", "comment": "Malware payload (Loki)", "value": "2c7076da397ab6ee3b09e3e338ee7b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823376, "uuid": "d7b55744-c83d-4ab2-a022-5daf57e6aa06", "comment": "Malware payload (Loki)", "value": "3e36150936202506d3d8f59cf9ac7810dc1b3b0f7383e9dd9706cecb3fdaf060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823376, "uuid": "c03bcdda-3b51-43b6-b054-f45698e612ea", "comment": "Malware payload (Loki)", "value": "389c77e4066a43099cecd7466ecb5443d42e9b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823376, "uuid": "f26af177-73ee-40f5-901f-cbdcf30cf2bd", "comment": "Malware payload (Loki)", "value": "96cc5856dc16c46d800b8b6d5e6c170cad0eb9654a73602793e6a23fbd192dc1d77a4e3285d16eb9bd44156ccf3d3265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823376, "uuid": "a995da07-10a2-4ce0-a6f8-7acc99d07565", "value": "T13F24019E964F2C9CE5B60235535E549082BE2FB62272D3C71671BE0DB4F59E063383B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823376, "uuid": "7787d780-c372-47c2-8368-b65bb7be5078", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823376, "uuid": "efe9cdce-05e1-42df-8467-15d28066f466", "value": "6144:u+ZPiSax9njnO2cdw/4F3bSDt30xiiQucGg3FfM+8:u+ZPVYnAM45at3miiQpD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629823376, "uuid": "499579e8-e9e0-4796-90ad-e82aeaef37fb", "value": 228649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629823376, "uuid": "2012306b-6e2b-4319-909b-304d3b14ca18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823376, "uuid": "751229ca-a2e6-4191-8d19-bb46f9cfcc6c", "value": "2c7076da397ab6ee3b09e3e338ee7b68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9cf1e3-04b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629795605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795605, "uuid": "edcaa3dd-018e-431b-8010-5c40dd1f04ef", "comment": "Malware payload (Mirai)", "value": "2dd42350015bc91df0e868627a87e0ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795605, "uuid": "cdde1264-63d8-4a79-85ee-2d762298cf9a", "comment": "Malware payload (Mirai)", "value": "3e80e7ad6388e7554e1a8ff7669c804411a585a85b42bc8e6338ce739dbcc61a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795605, "uuid": "9b034780-46ae-42ab-bb16-f0fe034b9a10", "comment": "Malware payload (Mirai)", "value": "96b7daa2fc0d802ed7639209332f9cd39da98c46", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795605, "uuid": "a7cd8c52-5694-42a6-8f04-f46bbdf45051", "comment": "Malware payload (Mirai)", "value": "9538aadbaaa90129914650199f9a155fcbc5f067948566ec0872c98685e042d998c8a859840066afbcc647cb311ad210", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795605, "uuid": "874aa98a-d8c9-48bd-a3c4-cd0f71816f4b", "value": "T17433F133AE084D028D61BC73A9B946F3A1BBC3BEE01E59F4E6074CBDA540902D9F5947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795605, "uuid": "e1cf63c6-463f-4c71-86bd-85a229aa8d2f", "value": "1536:LBd49Pl29hwd14wElc8y/T71L4LAN/fBZ/q2l9:WPlRdFd8yr71L4+JJq27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629795605, "uuid": "c1c4d030-6380-443a-8c15-8e202b722935", "value": 51692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629795605, "uuid": "283c7010-33d7-442c-a692-d3418b2bc96b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795605, "uuid": "c4a0bbc2-a27a-451a-942b-731fdcb800d1", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75bd472-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629805528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805528, "uuid": "ad3d6f28-748d-4a4c-ad2d-44f779fbf7ca", "comment": "Malware payload (RedLineStealer)", "value": "62afe00ecb8eaabd1dc4127d36ffc310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805528, "uuid": "115cccef-13cd-48e8-b49b-468c54d9da2a", "comment": "Malware payload (RedLineStealer)", "value": "3f3fecd695146b28e051593aabcd535dc366932c08bf0011ae997ad6b7e39147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805528, "uuid": "df5f3456-1917-4684-bf56-15e770505d47", "comment": "Malware payload (RedLineStealer)", "value": "27161c116e6b58aa4e59e9ab5f012da8001bf20b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805528, "uuid": "8c606e16-a0e3-439b-8753-424349f3d95d", "comment": "Malware payload (RedLineStealer)", "value": "bc36dae0029716270a3de5be00f8e9eb7d8f4508e6b68eca6226d101604b588659304533e4d4211eb966fbfc0ae5da17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805528, "uuid": "70b1eef9-4f3b-46f0-a869-26761e0e2d0c", "value": "T17DE3BF11F69FC472C543543589E28690D62EBC61AFA1868F3BC8269A2F71EC0B735376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805528, "uuid": "14d3ec51-9c91-4369-997f-4cd7ad524213", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805528, "uuid": "5a88676c-f3dc-406e-9f53-b58575434098", "value": "1536:3uC+AOZZm7ekGd9TSz3iToPNnHzbPmvAhz2TcB08SDd15dv1y4EeE2JATEL+hIty:sm78d9TSsg1H3To8wd15dv1y8JQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805528, "uuid": "43a28c2c-eaa3-409d-81a4-15a9f1c7c23b", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805528, "uuid": "a8750f7a-a513-44aa-b1ba-8825bef05275", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805528, "uuid": "f4b6a7a0-9cfb-4446-9251-2ded57eabd5b", "value": "62afe00ecb8eaabd1dc4127d36ffc310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94ab847-0527-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629842951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842951, "uuid": "2ccbfc35-dac2-40fe-9003-a355ac0d07bd", "comment": "Malware payload", "value": "ae03778cf368977eea85419acfc768d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842951, "uuid": "bede54fe-94bd-4bec-87f8-f9e6d0bc0ae2", "comment": "Malware payload", "value": "3fe1eb9d42f269e15ac61afb0869f64ee4436d47521aee29035a8cff2c632af5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842951, "uuid": "f1446712-ee13-4b93-a956-082157a0c784", "comment": "Malware payload", "value": "3b93f3dacd6be2bfb1628c8071e143a2acc9e0b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842951, "uuid": "6ccb02ad-9936-4058-a150-b0a48b6abe36", "comment": "Malware payload", "value": "38432dad45525f66487b4fa8acd035b962f2ef23910af4f202e2a630713a9faae2bb757e5c4cb7061b9d95a1a5790532", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842951, "uuid": "5fe8deda-6342-4aed-8518-367181fc1e59", "value": "T15DB34B2163DCD629EBFE0B7574B0031047F0E09B6021EB5B8EC674DA1E76B81AA556F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842951, "uuid": "ba751f2e-fa34-4d81-afde-cebb4ca2c5d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842951, "uuid": "abfda379-c3e1-43c0-84e2-088e48dc4779", "value": "1536:Et9pmCxbtHO6sc+sdO7bJQHnMHZonCng31jbuqGdJnOuyq+d4VkdDjEGG6qTaoiL:qhbtHfJrUbCHnAZ4G6GJnlyjd4cYLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629842951, "uuid": "a72dff32-b2e2-4f66-be96-3ef22a15515e", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629842951, "uuid": "f7ada21e-d4c8-454b-b030-283c4190b486", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842951, "uuid": "605bdf54-4bf0-4668-9432-f77df25ede3d", "value": "ae03778cf368977eea85419acfc768d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee2144c-0525-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629841914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841914, "uuid": "b2ac56d5-59ae-46c4-bc44-01c260bfae76", "comment": "Malware payload (Formbook)", "value": "44e07e65592320653431e87050b8714f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841914, "uuid": "6ebb3af3-b190-4cab-b452-5f30f67c1384", "comment": "Malware payload (Formbook)", "value": "3febf03463e0e65ef9d0fc4e8a38f01dd7c6dfee10258876981539b7a319a620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841914, "uuid": "3bf02da0-ea6a-4538-9613-0f4a7fb855cf", "comment": "Malware payload (Formbook)", "value": "337bf5031b7af55d8086087055232b1f7478115f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841914, "uuid": "61631274-5988-4f73-b04c-5b8065f7b91a", "comment": "Malware payload (Formbook)", "value": "416263eed709b3159660b4b9f9f2ce30fccdb61bde13a3d7035edfbb12f3b2bf390d0d283241c6a5c84c68c9cd0cc5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841914, "uuid": "5aa86807-daca-4673-a0a5-efd6dff64909", "value": "T13926331E710011B6FBB392F06672571215B2EB1EAFA2819F4170D6B348BFE12B169FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841914, "uuid": "17c40634-ad2b-42c6-95fc-452af0ba0a8f", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841914, "uuid": "82cdfb2e-c4a7-4a1c-861d-aee9741887e0", "value": "98304:yZ1kDmwxdhbRSUnR1tooSvpKoLiRZmmYjWNiOm:yZ1kDmwxdh3Beps4JWNiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629841914, "uuid": "4551c62b-cb9d-45a2-8c95-0e9a77bbc0b0", "value": 4642056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629841914, "uuid": "790f0a9c-6249-42ac-8085-c5533f839f40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841914, "uuid": "56184161-48c1-42d7-89e3-cf5dcf9fd8a9", "value": "44E07E65592320653431E87050B8714F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d75160-052d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BlackNET)", "timestamp": 1629845234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845234, "uuid": "94204b59-f1c2-4f69-b769-def35123121b", "comment": "Malware payload (BlackNET)", "value": "bc15770f9c1c0735cb5cc9d800476ab0", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845234, "uuid": "6fa76b5c-f425-4814-b729-1ab24d2b1bd4", "comment": "Malware payload (BlackNET)", "value": "4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845234, "uuid": "5c0ff08b-107a-465f-aa01-9910885db7c9", "comment": "Malware payload (BlackNET)", "value": "7700f53b4de7abcd0aa28a1989f73aad394b49bb", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845234, "uuid": "54834304-5dd6-4648-8d61-d503ee7da6f8", "comment": "Malware payload (BlackNET)", "value": "d2fe219db2df144198d284228eb7dc58186030c76ad3eaf01c53ac57671217ec19fd58d2e85d35f1ce3033b1bcda433b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845234, "uuid": "1e76a649-5325-477c-b676-ee646c376462", "value": "T1FD73F812BBE48965D6FEABF4D972A6014AF1B81A5532DB4C0CC271ED0AB7740CD41BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845234, "uuid": "a630cf52-6cff-45f0-b76e-1fec6afd8a06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845234, "uuid": "f5654ea0-ed9b-4a4c-a948-824c41e9b3b3", "value": "1536:rRJABDWoKGVG6BOiBQAh4QiObju5FBHIIMLtfn:dJ3GVGdiBQAeQiObjsFBHIbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629845234, "uuid": "fecc7631-4150-45cc-959d-76d3ac88e30a", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629845234, "uuid": "3ba34e69-9ba6-4d97-8f02-25165c7e732b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845234, "uuid": "a33c1c55-87e6-4fad-a52e-d337ca35176e", "value": "4054EE21CBFC210489F119C2D717CA1AE43129FC0D07A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b85c4d2-0514-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629834607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834607, "uuid": "19040c00-7ecb-4b4f-b46f-94b1eafd28d7", "comment": "Malware payload (Mirai)", "value": "9bea7d91c91ebd335209d13888d52669", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834607, "uuid": "e76c9252-7a12-48f0-9d18-192550af7865", "comment": "Malware payload (Mirai)", "value": "40711d089565890ff9d12b0e6e1522633b231813a9049fbedbbc7ae12ce11328", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834607, "uuid": "ec40448f-2cd8-4c36-99f2-258de158ba50", "comment": "Malware payload (Mirai)", "value": "895627220cf825d6d13431324b9d49cbad1e1d9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834607, "uuid": "0c90f9e1-33df-4d07-ba65-693a6bd5d579", "comment": "Malware payload (Mirai)", "value": "580e0a1f000dbced4c36b2b7287e38df18a206e322fa9af753c99afe52c02b6496f0d105e3fba585736bc12a154f612c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834607, "uuid": "3d12330e-15e2-4da0-ae4c-22a919fe52cd", "value": "T1CC230222E5D858A1C2E4AC30E5FCDB4532A52FE4A24CF5606731C3D5D9839C272EA4F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834607, "uuid": "9a6d3ca0-c464-49ef-a666-71731da0f53b", "value": "768:GqPb4YOTeTx9krjuxxu0BszWd2FFq2oKeWTjq3UIaT2UemnahFIS0BWOPW9+4:cTeNCCxjBjd2FA2FebbhU8t0853", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629834607, "uuid": "c958e228-cca2-42cc-8178-ff07e17b715a", "value": 48540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629834607, "uuid": "818a02d5-c91a-4a17-83cc-ae5e586cf6f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834607, "uuid": "6853010f-5bc0-40a1-a245-b32fc5468e78", "value": "c0r0n4x.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4ee2da-0529-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629843713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843713, "uuid": "6826a746-da91-4427-b2ce-131b43796c12", "comment": "Malware payload", "value": "bd9d18cf3652c070836e57824d8275b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843713, "uuid": "08244b0f-0d4d-43cd-bbdc-d7b2902e1861", "comment": "Malware payload", "value": "40ea262c1ab9d3910560cd97388a9ff7d597d18fe4588337df609c7c405e08fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843713, "uuid": "97c4ff65-501b-4ec0-9461-02afd687aeca", "comment": "Malware payload", "value": "7c035c268deb57bfde42659ea6b00377f36935ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843713, "uuid": "a17b779f-69d1-460d-8483-78efc6acb434", "comment": "Malware payload", "value": "b2d6bb4f754ce9ea7e830fc1b9bafe677345533cf3b55fe0be48f48375e5c150010553dd4cf45c8189a1296a15383f08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843713, "uuid": "50a15975-9b80-497e-a0e2-da4ad9ad6eee", "value": "T11D032A8591A3DDF8CC0419357077EF3689B6E93F1038EAD6E7DCAD72A981A02D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843713, "uuid": "42b56b8d-a172-473a-9784-6f25ce7e2956", "value": "768:36hiVRWh7hWCbZ6OzPBNbrGP85BJwXHU/HYLp/9:36Ew7hWCbZ6OzptrGP85wXyE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629843713, "uuid": "0b3710f7-25a0-44e0-8ea1-66b53cc0d88f", "value": 40618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629843713, "uuid": "18f9ee8f-ccf1-42fe-941e-21c15061e843", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843713, "uuid": "88a09718-5804-4f63-a62a-31759f3c56f7", "value": "bd9d18cf3652c070836e57824d8275b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9cc005-0520-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629839791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629839791, "uuid": "782f10c5-5535-4dc4-bc8f-600690ff0cee", "comment": "Malware payload (RaccoonStealer)", "value": "3e5ccb6dcbb35257f07ca1e59bde0fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629839791, "uuid": "66e9db5b-ec2b-4549-8aa5-92d0ac2067c8", "comment": "Malware payload (RaccoonStealer)", "value": "4101bd379660a169d50442c9921d6fb0329620efbc5a163856c2f5e5f41e601c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629839791, "uuid": "0c59b7f5-c9d8-4991-aab7-3d54faf4f3a6", "comment": "Malware payload (RaccoonStealer)", "value": "39ecf0317a54a69a4454282984b1916787cf6154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629839791, "uuid": "cf31f041-2b50-4dd5-8ef5-1379271aa9f4", "comment": "Malware payload (RaccoonStealer)", "value": "0f69f17fe4d60310e454795a865e51ee54600c476514e1a2a4ecf85470f2801cc87578bdafff7ef82ba52d79bd884ebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629839791, "uuid": "b83a017b-4dd2-4d11-a705-65f145bb9779", "value": "T11265BF33A190803EE6FD0573A868A6307D3CEB241750896AE3D8AD5D6EB4CC167F7257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629839791, "uuid": "329c5261-2649-49f4-89f9-054d90a51431", "value": "9589ad8837113b4b31a6a8a07cbda1f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629839791, "uuid": "1899c8e8-40d5-4bf3-b1b0-6a3d91081eb3", "value": "24576:ifwDi9seUAsBeZYyYoMGYVl2Jjj/O3O3al5e6Lz4/9j3tC2lyUJaRyP:Zi9shedMfQGWal5ngFjdC2lcQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629839791, "uuid": "44a498e4-c257-433c-8a05-f7dd222f23e0", "value": 1539584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629839791, "uuid": "67da22ec-361d-4d62-9360-dde5536c34af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629839791, "uuid": "62ed75ce-3dcd-449e-858a-7ca41c760855", "value": "3E5CCB6DCBB35257F07CA1E59BDE0FDE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f01facf-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629805031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805031, "uuid": "3312255f-1ec5-4703-95fc-dfc6e09c35fe", "comment": "Malware payload (njrat)", "value": "f88564ad95f97097002bfa11a67d288f", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805031, "uuid": "44e6a3e8-6782-4765-912c-a68b939c2d49", "comment": "Malware payload (njrat)", "value": "410bfd3ac457f14f653b82ad2090dbdd24c5d689d4bb766f6c18e1c1ee8c171a", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805031, "uuid": "ec0ade8e-43db-489a-aaa8-6e748c1d1af1", "comment": "Malware payload (njrat)", "value": "49d1056e48981200f7674432c0562163a8d65db5", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805031, "uuid": "e0413114-f10e-456e-a999-506938b115e3", "comment": "Malware payload (njrat)", "value": "d74eb61abfe12aa4fc11df57208563702e73aa1baea3f18921495fd8e7f11b76bd5640a7d788726fed346bdc22d11db6", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805031, "uuid": "534599cf-c54f-43ef-88e7-98f7096c22ad", "value": "T12101F60A7D29CDDB0149F18642C38DE9C6604A67CF806E7A2478764B6DAD22F6DCCD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805031, "uuid": "10ed8dac-8e8c-4821-be76-cc7c139dc3d7", "value": "12:0ChGFWNgy2XNoxAbOJk82cG2bwELPdg3Nfd+aaiTC:HgFWN0XQXG2UE7kNEuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805031, "uuid": "80e40573-c83c-4d7b-8256-fb104ffd1f73", "value": 748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805031, "uuid": "6d6e63b6-fcc1-4cf0-97cf-6980881aff4d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805031, "uuid": "9fd102fa-149e-44a2-90d1-158bd9d75a85", "value": "Invoice#4110.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c43bae0-04a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629786907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786907, "uuid": "ab27cd68-df14-4663-9056-44e8e736e1e4", "comment": "Malware payload (RemcosRAT)", "value": "b3cbfb4b45563e3dc2cbfa9e9a5676da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786907, "uuid": "2a4ef7e5-57ac-4f01-a95a-b7b895d2c0bc", "comment": "Malware payload (RemcosRAT)", "value": "41ab72f9ce1e64f569029d8b3f8c2fdf680fb75113b8d7451bc8d988cd5f6bd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786907, "uuid": "7279b65a-f457-45c8-84a5-521935e605b2", "comment": "Malware payload (RemcosRAT)", "value": "98d5a3cc84b2342ad2cdc1edefb7b8ea353580c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786907, "uuid": "3b1a142c-078a-4e5a-a609-e6469a63151e", "comment": "Malware payload (RemcosRAT)", "value": "e8efc1de759d2d559e3030dca751c234325dd2698951315f78dae23af680caa289641009db32f969d1a80a6ea83b6dcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786907, "uuid": "3bcf7353-16e6-4b45-9426-dcd6789ecc67", "value": "T1ADC3C8E2A7611824D3B52C70A8B7ADD15715AF114DC3173F21DFDAAF29E0B86A0C335A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786907, "uuid": "b3e962d7-7f61-46a4-8591-7d86e7bff8e0", "value": "c65aff2bab39ef464a2bad0c06b18bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786907, "uuid": "b67f4e67-6bab-4ef9-99fa-ad2eeff8de57", "value": "3072:arwB82p7vxmvmYXXnsJnpDP7hrUQV3oD:arwBLp7vxmuYXXnsJnp+QVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786907, "uuid": "ffa42fd2-987f-4db8-981a-fdb71f0f8a1b", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786907, "uuid": "89dc16cd-ac24-45da-9b17-07d58bb84a6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786907, "uuid": "98bef365-4e5a-49b6-b16d-85b37d0bb051", "value": "b3cbfb4b45563e3dc2cbfa9e9a5676da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b53107d-04aa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629789080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789080, "uuid": "39a7c4dd-b1f2-4ec9-a694-4ed01cdd0da5", "comment": "Malware payload (RaccoonStealer)", "value": "4205ea3c1211991e6d906b243cca7589", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789080, "uuid": "d3e3598e-f160-4359-af5e-4792c7b4779a", "comment": "Malware payload (RaccoonStealer)", "value": "445bd1c221cff019e52db89d03e05a8c22509cea0ede28da6d55bff7fd840bae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789080, "uuid": "696f2a13-7e2f-4e7a-9644-5025bd2ca6e6", "comment": "Malware payload (RaccoonStealer)", "value": "fce2c4a2c95f1e632f774948b6d66cc5c34d2434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789080, "uuid": "9e701119-4ab2-4d5c-ae71-6de3e002f5cc", "comment": "Malware payload (RaccoonStealer)", "value": "74f2ff6855b208a94131460228bade79f1eef55dbcb1a160e77913967a54e92f578e03740618700084638a6fde4b4211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789080, "uuid": "dbf00710-8917-4bb9-84e1-97416d5506a0", "value": "T1C945BE7063C9C294EC1A8FF0167CFB9402F235E7B6C5CD6A16DA720C8E5A9D1670768B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789080, "uuid": "e5d9eea4-f78b-41b0-91f4-7f1b2b69df14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789080, "uuid": "f86c0e68-3ce2-4bbf-933e-c72f44db2142", "value": "24576:5XPz4mCbnKIBEDwtCvZsbaT/LHgwV69RH:RUnbnKIBE9vmbq6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629789080, "uuid": "dbf06661-7505-4108-b724-cdd62258be6f", "value": 1276928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629789080, "uuid": "9988d555-32ed-49d1-8495-2345c33e9156", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789080, "uuid": "9a2c1ef2-82f6-47d7-bff7-6552931f0827", "value": "Invoice 0045 & TT usd27,004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f208ee-04ad-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629790175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629790175, "uuid": "37a7c4c8-2454-4014-baa7-6999523dd808", "comment": "Malware payload (DanaBot)", "value": "fdb87cedd4a67744dbd55009c66d010c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629790175, "uuid": "32ee0b00-def5-4f95-bdf4-36f6fb66b4b0", "comment": "Malware payload (DanaBot)", "value": "4495ad86f35e4675936e07424ea74de153eac5c735eece3f6d7c62d4ca4fb369", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629790175, "uuid": "bccae561-83c6-40b1-a6a7-87cc3cd297eb", "comment": "Malware payload (DanaBot)", "value": "40d0b5fccc473996bd4c851afac2c6b607132d4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629790175, "uuid": "c3f0415b-607c-4b2b-bc8a-a9a4661198dd", "comment": "Malware payload (DanaBot)", "value": "3268c6ceece4f21e6f271e310d22c1adcee1810a785208277a4d781747b0e909430aab000d8c8fa998c1bf7abfd60090", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629790175, "uuid": "b917049e-b86f-4737-b6a3-42bbea323458", "value": "T1CF3523066DACD876E0E68AB11EB387710A63FD603576D71A8790FC6D3634063E235B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629790175, "uuid": "7eb67559-3eb8-4455-9689-831cfb3d0622", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629790175, "uuid": "8dae49af-6ac8-4548-a725-f51d9b8f56c1", "value": "24576:lU1Z/0sin7rvPmds+nx9XkOFDlerCkGhQZI5Uo3L6hgmED7m:a1ZHin7rx+xFkoBerCkGhT6o3jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629790175, "uuid": "be791d41-3127-44fc-8b77-f1c10ac198a0", "value": 1089942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629790175, "uuid": "4a5a2bd3-65f6-4180-b0f4-5f7fb6b58077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629790175, "uuid": "15ad89a7-0cb5-4e34-8ffe-b92cd36a9f37", "value": "fdb87cedd4a67744dbd55009c66d010c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594841cd-0518-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629836267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836267, "uuid": "5d0678e1-1e7a-4919-9987-11045c0dd291", "comment": "Malware payload (Formbook)", "value": "0caa142f1e1c055dbfd67a347677b2e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836267, "uuid": "ee67fe28-e536-4c2d-92a4-b7b3c5e914c9", "comment": "Malware payload (Formbook)", "value": "45278d169fd9dfd30355570aec0c04c274d71eec2543d0b33e7e2a641ea93eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836267, "uuid": "4972d8e6-04d5-4850-995d-edc960449780", "comment": "Malware payload (Formbook)", "value": "817220484acae331ba6d457a450311c29e52e0a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836267, "uuid": "1dffe571-501c-4eb5-9da2-265c21177060", "comment": "Malware payload (Formbook)", "value": "b75c08da5587ccbde2de77c77a5dcce5e03e60c8c41768af6e76fce3dd3c317e8ab550a00b3b90754a9d05d3a17ea088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836267, "uuid": "d54c34b8-e648-4031-a81d-a35fd3f70314", "value": "T129E4234456AE833FCB399D7D8196514440F4B7A1E6EAF3A83EAC4DD150CABDD0702BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836267, "uuid": "ee6246c9-fca1-449b-a447-a0435fb7b6db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836267, "uuid": "cda78d76-d6b7-40f0-b3fb-4a58ead97b8b", "value": "12288:L6WnAbC2kUtdt63rYVqxN47dy1qvvVAQthADAspvILIR41XTvPdW7y:uWnRUJJMsT3VepvyVvFay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629836267, "uuid": "abeb49ad-ff58-4002-92c2-979347f79b5e", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629836267, "uuid": "ad04efe7-94dd-43b5-9fac-99689aadd85c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836267, "uuid": "f7540394-d0a7-4f14-b943-bd4c9347f8ca", "value": "DUE SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7629685-04bc-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629796938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796938, "uuid": "9960b502-4704-4b38-abfe-527282d883fc", "comment": "Malware payload", "value": "eced9416ff233c5acf816129f2c95fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796938, "uuid": "eeadb846-b9cf-4b79-9fc6-579d162495b6", "comment": "Malware payload", "value": "45462ce7790d654558e4ff04aa169de1c573fe83265a142c00ec0060229989d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796938, "uuid": "064d5749-a9ee-48cc-8176-bada00b95c90", "comment": "Malware payload", "value": "e20cdc2ce2e61bcb57c3b8ae015fb33535adb2bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796938, "uuid": "44ddd01f-496a-461f-bef8-515dccd6c067", "comment": "Malware payload", "value": "edd01229d80e6c652ece9bd34a6a9a76de4d6abeefff0a1dcd0b256d593caea38859a659d6b1441628d68ac97e78fa8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796938, "uuid": "3cda2d55-4dc8-4230-866e-e88d3e2d9abc", "value": "T155059F26A820853AFD23167C880A9F9E5C20FF90B964658A9BF76C4D1F377C6311B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796938, "uuid": "6b733473-f07e-43e2-846a-6ac239cf9ee4", "value": "104178b36068d7abcd0d209aa6ec0500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796938, "uuid": "390aee9c-538a-4559-abce-a4800e9b9947", "value": "12288:B3vbnE3OJZiKAb1AIkjb/7rAOECrVpa0GGI7ACwxAc:B3vr6WMJbzkvAEpz4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629796938, "uuid": "ff5c6b70-096b-4a80-8db9-55f5526b381a", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629796938, "uuid": "4ebc3b4d-6280-477d-af14-37b86bf4f582", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796938, "uuid": "f653e93c-5a85-47f8-972b-d9fe2834467d", "value": "Produktspezifikation und Bestellung - Ramsauer GmbH & Co KG,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30af5f46-04a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1629785518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785518, "uuid": "a35ac483-ebef-4b32-9ae0-cf12946bd5d1", "comment": "Malware payload (STRRAT)", "value": "a2c3ec4f67755d54490d35200dd93e55", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785518, "uuid": "c64f5b16-981f-41e8-ae7d-369d11f46da4", "comment": "Malware payload (STRRAT)", "value": "46455d4c17db7df0ee626d487ac4ad5c0988460ae0f4c2db7847295ee25588c7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785518, "uuid": "4f782ef4-1e52-4267-9dcf-dcbb0e8048d0", "comment": "Malware payload (STRRAT)", "value": "8a9d2dc3e89d80d5637ff3e1397213b4ec834cb7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785518, "uuid": "1af48835-8139-406d-afff-aac26aba1ed2", "comment": "Malware payload (STRRAT)", "value": "bc006ea17081674e259330c15806accd97d9474fafaeca2a584eddb327013b1a41e38308bece12a35c8850ab3e6ec2f5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785518, "uuid": "e871747e-eedd-4d17-8959-33be9a4b7afd", "value": "T130A3DF0B3ADA90ACD00791339005122AA69E46C4DD7B552B6EFCA8960D71CFC6F53EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785518, "uuid": "b4e9c736-f81f-4741-b235-023e22b90755", "value": "1536:Wdl51OeweysVpVGuJD7ANc5OMsdgN1P1wIG/FfizLtxXud6hGu3M:WWeVnGuJfASsdW1qFYz/dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785518, "uuid": "dfe45d14-370f-44f2-a4b4-230900e4baf0", "value": 101155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785518, "uuid": "7f0043e6-a067-4915-8398-c86ee86fab67", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785518, "uuid": "a18c22b4-6453-4db7-911e-1e1e4cd59d6d", "value": "invoice_payment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c764670-04f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629819388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819388, "uuid": "fe746a61-2436-4f6a-b036-005ed4b65944", "comment": "Malware payload (Formbook)", "value": "632ebc5ea90f2312e61135ae6d1cd300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819388, "uuid": "a037e8d7-802a-4f8a-b75d-1ddb4f124522", "comment": "Malware payload (Formbook)", "value": "468008f5f4996c03b06d6e74a95469acee7a352f8d6bb5e718d86707da7c7c0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819388, "uuid": "c878563f-0b5c-4cf3-be92-f73d308d0a62", "comment": "Malware payload (Formbook)", "value": "7072d68bf8d3dd68e114da5e8054ea3eac448ae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819388, "uuid": "9530a29b-816e-4763-8a60-56d90bed6f4d", "comment": "Malware payload (Formbook)", "value": "586513a27df6a5345817b765635ddf5a9d346b69a698add02d68faa30ac4c5e795391e6bb677f113d87a9837e0cbc762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819388, "uuid": "f87d616a-525c-45ac-88a7-5eddde5baeb4", "value": "T14005B3BE1ABDA2278175C2B5EBE75417F0409B5F3411AC2576C203664232A7BB4F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819388, "uuid": "4e718b2d-c0b5-468d-8791-c6fcf97a2d49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819388, "uuid": "a564b06b-bb9b-4686-9860-8daba22a975e", "value": "12288:LWZgiayHnB3/82tabFKPNdGsIC7Uvwkz+7YeOz:LWZyK182+QNdVI8UokiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629819388, "uuid": "c769197a-e3d0-491b-b56d-871775049696", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629819388, "uuid": "f4ee0c80-86e4-4dd9-8a30-0d050c169b35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819388, "uuid": "8fb6a495-c45a-4ce1-9ff4-1f9e96be2a11", "value": "632ebc5ea90f2312e61135ae6d1cd300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7648997c-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629805392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805392, "uuid": "2d90e181-2561-48a2-b893-2adf7c834c71", "comment": "Malware payload", "value": "dd03368bcd0235bb8a47ef315eddd108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805392, "uuid": "8e2bd32d-af11-4686-9ab3-a9a7d411af58", "comment": "Malware payload", "value": "47dcc183ffb874c0549ac60c9889f693e4333e83f4b5b013b42394e26a826e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805392, "uuid": "2b1de955-c459-494b-8071-2a02e278bf11", "comment": "Malware payload", "value": "c59f40d035e2644f0467c1e80eaa69a8faedfb34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805392, "uuid": "4a40c1e9-ca91-4de3-96f4-6fe52b37aabe", "comment": "Malware payload", "value": "75b74e6e4319a904123c8bf4918c0f6372d0ecf32cab293ee750e43e79d1cd10dde46446875019472df064b88b2ee238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805392, "uuid": "f3c949bf-63eb-45c5-8375-e3205563fd8a", "value": "T1AA53E009E2E92317DB7A8337BCB66BD78EA36D7F61B0CC9D0CC616909851B23DE80554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805392, "uuid": "531a7d92-ae4b-4eab-a583-9b7bf048d73f", "value": "1536:2bvyHSvu8Y50an5hmrmiCLjrd7/e5lI9b57eho:2TyQu0an5ciVLLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805392, "uuid": "24a58752-6d6b-4957-bd22-94a3cf00a8cf", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805392, "uuid": "dd78217d-f439-4668-b921-d3cc4731e19f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805392, "uuid": "b7e8b58b-83d0-4911-8abb-23850807306b", "value": "dd03368bcd0235bb8a47ef315eddd108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009e35b6-0502-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629826670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826670, "uuid": "8160f2b0-a865-4a58-a0d8-dabda62be31a", "comment": "Malware payload (AgentTesla)", "value": "f09bbd4506987bc453aac855b8983af8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826670, "uuid": "4e0cee01-f7ee-46ef-b2ae-75430a079745", "comment": "Malware payload (AgentTesla)", "value": "48a29ce08e742448d8bc89fbe12dcfdda3e3a8542f3d03e91db4b7f6ed8c9c1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826670, "uuid": "3dc8c635-d622-4df7-8345-b4e1052ba971", "comment": "Malware payload (AgentTesla)", "value": "fda112b19c54f4e27657a2b0225c5f3182db9dd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826670, "uuid": "9774ec37-25aa-49fa-845d-3db3a3b218d8", "comment": "Malware payload (AgentTesla)", "value": "6605d7449ed7d5c0b2a17a22cae046f5935e8cc08bdcb5022ca676fda9f139608dedbcb7adc0002aaee5f4e72ac3a81e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826670, "uuid": "a11e650f-0a0a-4d35-a971-92af0b13787f", "value": "T1B405B37E1ABDA2278175D2B5EBE79417F0409B1F3410AC257AC203564232A7BB5F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826670, "uuid": "369bfd51-433f-4b33-8aef-6863589c7774", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826670, "uuid": "957f0531-cc7c-4304-b729-a20e54fb1eb3", "value": "12288:xgz+yjdGbHIYsGEA1YJvwhk4tmPG2UTLGp7GoS1a2Yd08zfPHMhf/:xgz1JGUYT1Av+BfZTuGhbYdf7/Mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826670, "uuid": "7f4734fe-eced-494d-a29e-bc84ce51238f", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826670, "uuid": "16a11257-7dbe-4fbc-bc05-3a341f269a19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826670, "uuid": "2dc1b01f-e5e0-42f8-911f-7690c7d35852", "value": "f09bbd4506987bc453aac855b8983af8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1ed29c-04e7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629815411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629815411, "uuid": "09d20393-0102-46a7-8b62-acb08fb37f26", "comment": "Malware payload (Formbook)", "value": "f5fa2e043b901e50f0e6e8ad0e4f7074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629815411, "uuid": "0510f217-e09f-4609-ad78-90ee19e6ea47", "comment": "Malware payload (Formbook)", "value": "4938b1c8ca1745b33ea6adc31b39e2003646370ec7f52fe1e89af6903a69aaca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629815411, "uuid": "2b2c3449-5d4d-4c4c-97c1-4c0d779f886e", "comment": "Malware payload (Formbook)", "value": "221c67c606a3a2e0c5bfa8b57d7c749e29b074d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629815411, "uuid": "fbf57628-8b48-4345-89d2-8c832afc501b", "comment": "Malware payload (Formbook)", "value": "19833cf63ff2b457624a8c7381dfa58964f2ba678d80e0fa2e9f6452b07544af88012efcddb45fb4a6c6a67555b52760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629815411, "uuid": "135f496e-c208-4647-95ff-072bba7d508c", "value": "T1AF2412A6D00CC458CA05197B143FF71A391A5E6B9AF1C9EACFA939E63E350E82D30C55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629815411, "uuid": "8e15bf2a-8d2f-483c-b580-7ff2510c9398", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629815411, "uuid": "adc8832b-4950-4b8d-b48d-fb6527abba3c", "value": "3072:vd+7xl60FFPbkGF+7IFNj84EvodYVnHkgZL1P/7aJ3NrXWPsZa4FSUqcUKZrVU:lOhpblSi/I991P/7aTzna4zqaVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629815411, "uuid": "706b26c2-43d0-4900-aac0-1a81081e8b79", "value": 229810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629815411, "uuid": "2d4607b0-e854-419b-9f5b-498c1c0a3d80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629815411, "uuid": "dc290839-8508-4a59-aff3-7c9368ca3637", "value": "raw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93718604-04e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1629814031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814031, "uuid": "b98c1a7f-47cf-49e8-bfbb-e7d714be0748", "comment": "Malware payload (Tofsee)", "value": "685e782b22890f2be6a858d10e182030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814031, "uuid": "b78b9962-e6d1-47cc-971a-09b3aa3ac146", "comment": "Malware payload (Tofsee)", "value": "493c4a7f6cdc0c6b3388b268aa38975c1bb52ea67f6415723a06a14213ee5d14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814031, "uuid": "dcdf7118-6556-4c8a-80c3-d86df0e9f457", "comment": "Malware payload (Tofsee)", "value": "d1e4a1ce2fd8d73f946b90f02fb374ee5f7396a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814031, "uuid": "0e3eb2e8-0713-4849-820e-c4566427fc29", "comment": "Malware payload (Tofsee)", "value": "c756f19ebe9513e84902d36f32c3f77861ddec1bba919a979ef75b1fd526145ff03c65990e401170b8f3dc1a5ee5be59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814031, "uuid": "950ef6cf-9222-414b-99e2-4f134e4bf9c5", "value": "T1F1E3BE1130A0C073D17346765AD9DBA0E92AF9226FB5498377E89B6F5F202D0BF2D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814031, "uuid": "ad6f0287-b4ee-4420-a2f9-719f44bf5583", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814031, "uuid": "fd5f41a6-c62f-4a48-b1b1-ce108c5530e6", "value": "1536:CXOTQ3b+lA4/CkI/MjwaodysjiAeZUam5OGhj1ty5NTEtptJWRBriobhO2Yp2:C+64CMzodR+GBl1ty5NiSgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629814031, "uuid": "e46692d4-dbfd-4525-9eb2-bbcf8cacfb7d", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629814031, "uuid": "899b75f9-0e4a-4d87-8fb4-f16cf709ade5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814031, "uuid": "75343bd6-9d27-4ee0-b5dd-eb048936af54", "value": "685e782b22890f2be6a858d10e182030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc89a122-0485-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629773405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773405, "uuid": "d07f0f53-3eb2-4963-afcd-9c3e0c7cbf4b", "comment": "Malware payload (Mirai)", "value": "49899a5b2527868c97df77b092574a48", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773405, "uuid": "816cb26b-94d2-4bb5-9070-543b571ccb0d", "comment": "Malware payload (Mirai)", "value": "4945741d830612853163154bcb944beba6b4b59ce871d9464cf16c26d401d61c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773405, "uuid": "aa4c5da3-2f08-4c2a-9d66-e099bccd1c0f", "comment": "Malware payload (Mirai)", "value": "caf945188e105b4346fa579ec2643e99406b8eec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773405, "uuid": "b515bb3b-3f0b-4ccd-9b4f-daa86c6dd628", "comment": "Malware payload (Mirai)", "value": "91923d492f8ed8d371806f895a81b0ebea60517d311d877591adf15136b716fe390df955cff257af373facd0f18331f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773405, "uuid": "7732b749-0716-453f-a454-be834d9f68a4", "value": "T19AC20987D983E4F9EC1915729032BF729F77E13E786AFD86C3AC90319892500D60769D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773405, "uuid": "1d0a5394-a2c5-4edc-924d-962e81ea1165", "value": "384:fhNtmekq7H5oGtlyZKgcmfnO0Ut15OZMM9rT41nf2PN3cC3UL:5VkKoG8c+qtPOlT41nf2FsC3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629773405, "uuid": "4fd47fd4-28ac-4bdf-8710-d9252c522ef5", "value": 25908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629773405, "uuid": "af422bc3-db31-4301-bc7b-30a735aea0e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773405, "uuid": "ffc79275-92c9-46ca-992b-4f24c34db196", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe77f30-049e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629784007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784007, "uuid": "ec7bd172-3824-425b-a288-92ae81258f8c", "comment": "Malware payload (Formbook)", "value": "29c239483fe4ca1fdba6d66721f378bb", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784007, "uuid": "247009d3-53a2-4482-89a5-3ae4338ae16c", "comment": "Malware payload (Formbook)", "value": "49e83b5fdead6b25991e09d65b0f7280a4ea773330e402df0aca14965fa888dc", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784007, "uuid": "4b5d2f55-aa32-4fbf-bdaf-074dac0883b5", "comment": "Malware payload (Formbook)", "value": "230ccd34f7b1b8324e277e530e4141952aaefb63", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784007, "uuid": "515fb487-bfda-4953-8aea-d1e70e65b7e9", "comment": "Malware payload (Formbook)", "value": "763f11a25e1b158726e83e9aae611497485f1dbd4923b4d05b78a06e0b858b337f1a65fc7ebfc19b9f2bbf6df38dec25", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784007, "uuid": "4525bfa2-07a8-4dbf-831f-073930083026", "value": "T173D42302F1E7588DAF54DD270835F4B6F676600C7A548360E42CB98B6EE1D73D46EC8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784007, "uuid": "c4fdede0-c2a5-4b1c-98fd-67848384e6d5", "value": "12288:UoSCsN5NEHwrTbUX5E0SvoJCs6+CEc2DSBF3+0Koz4:dSCWEHwzeEBvdsq2DSBl+i8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629784007, "uuid": "aec4b54d-fa32-4f10-a5c2-bb0faae3c862", "value": 639983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629784007, "uuid": "fb7fd42c-a486-4912-b6a1-24ac4bed2d11", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784007, "uuid": "89ef0bd4-123e-4733-aeb2-8bcd6fda0ef8", "value": "DHL_INV#AWB.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e68632-0500-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629825846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825846, "uuid": "abc3820a-0900-4696-83d5-9a8c9898318f", "comment": "Malware payload (a310Logger)", "value": "941ffbcc54a5826dde6e2d35f2fc761d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825846, "uuid": "af9ae061-25de-49e3-9782-9106a7326da5", "comment": "Malware payload (a310Logger)", "value": "4a0b8f4dbb3acd1bbab1527d90921061bef21f3422250dcc41b8046b77edbd9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825846, "uuid": "dee1f8ff-95f1-4d74-8bb2-465390b94160", "comment": "Malware payload (a310Logger)", "value": "fc892954c47237abfc7956450aa13e5ad2d97488", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825846, "uuid": "a13c5116-274c-4a6f-b364-74c7607a7b5e", "comment": "Malware payload (a310Logger)", "value": "013b8e489a746801cc21c525e44b34becc67fd66a0811e26f1f65b161c6b8fa76e926033de819e1173d2a66a9f9ad3ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825846, "uuid": "acab88d3-6cbd-4ff2-a6c3-e295eaf32666", "value": "T147B4129A2508724AED3F993F15B3C09AE22A0D75CBE4605BD257F748817867C3D2B0F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825846, "uuid": "36697315-9c17-4d65-ad87-5e4ef1663217", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825846, "uuid": "14698790-a8dd-4029-b751-7352b8d2349b", "value": "12288:+pxLkSqnEa1yg6PbvF1yC62hkh2pf05T70sZ0XNfM:jaZ1yQC5gXtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629825846, "uuid": "70072630-7a37-4a06-bfaa-33a8612c3236", "value": 501186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629825846, "uuid": "d8af3aea-cd34-4ba8-944d-80e4837fa397", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825846, "uuid": "8380e428-d002-4f7c-aa1d-a29ecb54a20a", "value": "941ffbcc54a5826dde6e2d35f2fc761d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383af55c-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629805717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805717, "uuid": "80a85c56-8edd-4850-935c-f23ea2ea00cd", "comment": "Malware payload (SnakeKeylogger)", "value": "a9b77caa07e0b08412619e0e3d3af6df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805717, "uuid": "010cf088-e2bf-4d43-9880-760347d1149d", "comment": "Malware payload (SnakeKeylogger)", "value": "4b8026ea252b9d9f1f7691b11fb65294837300eeec48808fd6561c914c2146e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805717, "uuid": "884df5b0-5514-41ac-9584-bc00746fe17c", "comment": "Malware payload (SnakeKeylogger)", "value": "0f81443b0e58a142c68639f959bef689d2adcdf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805717, "uuid": "fb6c3534-cb53-4da3-af02-6664808a9f1e", "comment": "Malware payload (SnakeKeylogger)", "value": "4037489d98dfecce2cc9ccae5a683d71c6dce7724eb2183868ddb80ca4eea67a084923f08b5eb69e4fcd429688d1ba9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805717, "uuid": "d8ad8075-57bd-46d4-8d09-dedabd2c37e4", "value": "T1AB157D7023C9C294EC1A8EF0167CF79402F235E7B6C5CD6A16EA720CCE5A9D16B0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805717, "uuid": "c33aac98-287a-4039-a6de-33dea4d28954", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805717, "uuid": "6c988b16-6517-440a-a63e-071c45d494eb", "value": "12288:eAcsGI/cTmAugz1ohzzRjPGVXEdRl+huCigj330cAHj5Zgd6Q2EObb+:e9fugczUXmRl+8Cigj3EvHj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805717, "uuid": "f1614fe0-570e-4f74-8e3a-f5b0a6eb8464", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805717, "uuid": "b70578dd-0b81-4fde-bdd8-9eb751828bf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805717, "uuid": "db4e018f-1756-4bad-85cb-1cabf721b5f5", "value": "00971-210426-0001 PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210bfde6-04e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629813410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813410, "uuid": "9c4a0da5-6e5c-42ed-81dd-f7e973e64c0b", "comment": "Malware payload (Loki)", "value": "070bc96d6d7fca84c4b4162d623d17c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813410, "uuid": "50cf426c-8708-4d00-a4bd-837f2cb583bb", "comment": "Malware payload (Loki)", "value": "4c30f91aaa8443b316c8ac2d0423bf5e4e9704c8ea9c3ade2d7f70e386a8e2c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813410, "uuid": "2e6824ba-1629-49a1-b89d-d1b3bb033ca6", "comment": "Malware payload (Loki)", "value": "2f1095a796a38b22e3021a7e89edcd04df36ae85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813410, "uuid": "7041fc48-1874-482d-95e6-f38220c35e0f", "comment": "Malware payload (Loki)", "value": "fd82569333b0ef5415c3a44e19a4ee6d91695c81f5e3e8fd75346caba8f6099da1093819a12fab797358f16611bc02dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813410, "uuid": "9163b5fe-84f3-4194-890d-cb5e6d26e581", "value": "T189340149DD74A059F612D6FFB8430AAA1368CF346F6608D1BA48FF5A41BEF0B35984D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813410, "uuid": "ef6690bd-003e-4503-86af-b8f9e9a07429", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813410, "uuid": "8d2c30bc-f801-4483-b91c-6beaf7750d01", "value": "6144:uq2EyX74GvTEW3lfS0cS8xukgLb2sRpSOu2rpQ:x217TvTnB1cS8TgLbxphu2rpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629813410, "uuid": "76440df1-1f90-425f-a243-3582c0f8e2bc", "value": 231152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629813410, "uuid": "2395a197-cf4e-41c6-a07b-ecd575a14223", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813410, "uuid": "9a1927cf-07e4-46e0-87c8-16c5b33bb594", "value": "RFQ_09123001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8063931-0502-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629827058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629827058, "uuid": "85aca97e-a742-4e65-89c9-4971135bef87", "comment": "Malware payload", "value": "b6cedeef95f754c5d51cbd16508c1765", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629827058, "uuid": "a5d7b3d4-cb32-4654-97d8-b087e369e292", "comment": "Malware payload", "value": "4cd65be2a6e5cff67c02496f16b87a0a1b4463e355f6f397ae0dd85079cdd854", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629827058, "uuid": "b55d9ce6-866d-44d8-955d-470c4a6b8353", "comment": "Malware payload", "value": "e098e6dcebac37e4333cf08ff43a176b6564fffa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629827058, "uuid": "491fa9bc-a8bb-4c97-a5a4-b035942a6a42", "comment": "Malware payload", "value": "cdcbada3bf74aca8087a39a2a2e45655470ec4af1135d0bc0b7510f0c9126bca70d518c8dbf87cd39fafdaded66acca4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629827058, "uuid": "746f442d-1650-4df9-b550-a7bc2bb09d90", "value": "T110352317AFB099B9E6D74AB005BC4A1099FFFD621D65EA3B4710BD8E3E70711D830A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629827058, "uuid": "21f70315-c96f-4e68-be28-caa203bbbe42", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629827058, "uuid": "0658de89-f8a9-45b7-9d68-978fcb21bb63", "value": "24576:b/1ZM17ZYqRbXhp2PQlKntfwcNlufvFobyTCl7OutHGSZYc+Q4:r1ZipT6QlwPruFyI8pzYG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629827058, "uuid": "bf7cc161-e06a-4c2d-a0b4-a32b22c8a040", "value": 1100098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629827058, "uuid": "5755944c-6052-4f83-90e9-671f7a1ede1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629827058, "uuid": "9ad0a3e8-2905-4a5b-84ff-5931d20b5178", "value": "b6cedeef95f754c5d51cbd16508c1765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c71c76-04c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629799559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799559, "uuid": "db875f63-7628-4d2c-8870-a80823e45ccb", "comment": "Malware payload (CoinMiner)", "value": "40c05a8ef279605719d194d37cf70a4a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799559, "uuid": "3c3846b6-205d-4dbb-ac1e-6dcf895f47d8", "comment": "Malware payload (CoinMiner)", "value": "4d2041a2a0df754a74123b251358abd1f981985d32103138943ee2974cbb6f1d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799559, "uuid": "4a458f6a-ce83-4788-a2a6-c48f2fafed5a", "comment": "Malware payload (CoinMiner)", "value": "5a295bfcb661642c5985135173450fafa416d43b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799559, "uuid": "bb15e1a6-a083-4b06-b766-09caa2aba97e", "comment": "Malware payload (CoinMiner)", "value": "499edbde2ac1fc14ea40fa25b1fcaf1f856a1fa38575ca6279007428216e2c387d6584d2c7351b7d79c2aaad8529f811", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799559, "uuid": "2fa5d9b1-a542-45a0-83f2-30d58002cd06", "value": "T176E3BD1135E0C53BC197487008E1CAA1EB3BB8622B61554F3BE95BAF5F752D0BB39352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799559, "uuid": "ea019319-a3bb-493f-beb3-f1274dcfeb24", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799559, "uuid": "8db6e23e-2fc9-42e4-a40f-87ec8b1ce898", "value": "3072:3+NLIbC4jlI729viELV95AwnYwiwjEgM:iWI7iiEKwvixb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799559, "uuid": "64eab952-a820-40a6-8599-3a8cc0759bd4", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799559, "uuid": "c6886ea2-9234-4372-83b0-95f37b265f83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799559, "uuid": "412fe189-1957-42e5-89ca-1ba5bdb4867f", "value": "40c05a8ef279605719d194d37cf70a4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2dd951-0497-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629780949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780949, "uuid": "abe8f87d-0b3c-4398-945f-ff47c4304b30", "comment": "Malware payload (DiamondFox)", "value": "a56c0274e6ea9bd32141634a92052d91", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780949, "uuid": "cc6b6c27-5b51-4713-8601-56c3b58cc82f", "comment": "Malware payload (DiamondFox)", "value": "4d6904b252c292f5aefe176877720e6e8520c977c9f27ba46c92e5a0b6796016", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780949, "uuid": "15cd6533-de93-45d6-a37c-867f5e1dbdf2", "comment": "Malware payload (DiamondFox)", "value": "0f69b4fcbda90184075b84d12217abbd0c07d704", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780949, "uuid": "c3831d4f-2f5f-4ae0-b29a-4c4c9d7dce11", "comment": "Malware payload (DiamondFox)", "value": "632ea0b94b77649aa4ddeb472035a7eb409c2a2c0ada65b2fbc580f1b73b9d88cbae7a9b7821577aad2ffd6e53c04743", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780949, "uuid": "f3df523d-1df9-42fc-8ad9-d12d31baf732", "value": "T1DE1633053BDAC0FBF213153165447BFBE6ADC3945A202EC32367AF1A0DB5A83613A567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780949, "uuid": "9981c96d-c934-49f3-aa34-36e3cacef20c", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780949, "uuid": "5ce9deb5-9037-4b2b-ab5c-3cca1b53e2b4", "value": "98304:x9Y2YE0JHHIvNIDwBlb7yTglmdg7T0FHxhXU0KusqWmF6soR6R:xa22gNIDWlllsgshXDKOyso0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629780949, "uuid": "af2e48ae-697e-47e5-a8e6-a7d13420a63b", "value": 4349459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629780949, "uuid": "3eb2b779-1458-4159-90d2-efac03a336f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780949, "uuid": "eb36b482-1e70-4a51-8646-59e13e269a88", "value": "A56C0274E6EA9BD32141634A92052D91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b945aa5-04d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629807844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807844, "uuid": "445db93a-bb85-432c-9e5d-0a0500adc4f9", "comment": "Malware payload (AgentTesla)", "value": "b9d220fa633d6c14af409afe9285b84b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807844, "uuid": "a1f092af-429e-49ae-bc03-0cbb71b38527", "comment": "Malware payload (AgentTesla)", "value": "4db3fd1342c99f9fdd38dafa68b9f13d4928b62fea7d7c0b6891982b312c14c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807844, "uuid": "3479f845-a728-45a2-a98c-827b5750a98d", "comment": "Malware payload (AgentTesla)", "value": "598cb69170ac4799fc2bcf95d40f1d9e34902546", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807844, "uuid": "f30a7663-1b06-4e6f-abd5-d803f54da7a8", "comment": "Malware payload (AgentTesla)", "value": "b648ab17b5b6f1d15ace6876c23a506d766aebe32332f47efa854de56e1f4c1634bf3289ed59e27c431f48d3c5ff0370", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807844, "uuid": "3e067ff2-8a6e-46b2-8c0d-f1e8805149a4", "value": "T1A8D46B33FE91F662C2BD423CCA9742F106279E35D5BB8707E0987E483AB26836137655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807844, "uuid": "6a8c0aa5-46f5-4337-add8-80ee5802b08f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807844, "uuid": "d9335531-615b-4dc1-83b2-9940fa77199e", "value": "12288:imrddwXObKRWoRdSO7lH9QlMvJs1lUnpr:3isKRfTtdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629807844, "uuid": "59841fdb-ddb2-4a8e-883a-1c95a043b4f5", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629807844, "uuid": "1d0a0ec4-e642-4de1-b2da-cc19d761e820", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807844, "uuid": "8c55f7bd-14b4-492a-ae02-d56760a05967", "value": "MV IMABARI_Vessel Desc.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d1f2d5-04e6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629814730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814730, "uuid": "9715b9e4-13c1-4501-8259-4f2f6a3d8554", "comment": "Malware payload (Formbook)", "value": "668d6246b611f9ce2d99a5fe7a5ea837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814730, "uuid": "1bfb5e09-7b7e-4d8c-bc63-bd9ab5f96cf0", "comment": "Malware payload (Formbook)", "value": "4e86e4c898bee9c454d8bdef33a2ece96c8da7c2605ec31560ed5006e1b9d83e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814730, "uuid": "91cbd5de-cf75-44a3-9956-9a614895ade7", "comment": "Malware payload (Formbook)", "value": "64977e62b942110eef63cb2bede4c9bcc5de734e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814730, "uuid": "f96c0b66-0b19-4971-8509-f93b76cb1739", "comment": "Malware payload (Formbook)", "value": "6a8436112b75268d8b4565414a712cadb153be86a467cc93076c025289693d93d4d00701a31b256b76df85da9a64dade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814730, "uuid": "0db0da26-8952-49d5-b6b2-e8df0fb7ada7", "value": "T1DB257C706385C198EC1A8FFA156CB79002F27DE7B6D4CD6906E5310C8E7A9D2EE0764B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814730, "uuid": "a8f60b25-9a5c-4ddd-9182-b75b3729e4ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814730, "uuid": "5ae92057-69c7-4dba-95aa-b35baeb377d8", "value": "12288:7/csGI/c1V56JizOdpUdrA9dDdxWigf5sAHixZqsokt2q2EObbY+AN:7A04zOdpUdrC/x7yqq+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629814730, "uuid": "27e1b9a4-5fc8-432c-ae36-d683342f5de8", "value": 994304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629814730, "uuid": "ce43af6f-5da3-4ec4-b52e-6b67f80a9b92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814730, "uuid": "3dce28e8-502a-4015-9d55-6035b97e87b0", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d015d24-04d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629808276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808276, "uuid": "a000effa-5464-40c3-b90e-90b242cd7792", "comment": "Malware payload (Formbook)", "value": "88edb353bbf9259f0e5eb0830df37086", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808276, "uuid": "6f537f10-7ec9-4a20-88f2-22f869a21f10", "comment": "Malware payload (Formbook)", "value": "4f611f4466203533e8cd92ac4c802d90ab056c928bcec7c470b8d61570dfc967", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808276, "uuid": "3828417b-b7ea-49fc-b43d-9fd3c4bb11ac", "comment": "Malware payload (Formbook)", "value": "29e472359fb82fe94ad05957a94636a13b38c28c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808276, "uuid": "ac72d64f-adb2-4b03-8dea-d3fedf19edb6", "comment": "Malware payload (Formbook)", "value": "7878603a2be36623e5f3892e907081f5c7bfb98e85764e1e4e31a6abb100946efe4ff221a1efe8b3d356eb17ce109341", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808276, "uuid": "40d1d9cb-1801-4ed4-b67e-8fd694f43078", "value": "T1FB159C3063C9C294EC1A8EF0166CF79502F235E7B6C4CD6E1ADA724CCE5E9D12A0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808276, "uuid": "b7d2814b-41dd-4345-acb2-4f84a70ccf65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808276, "uuid": "a4697ed7-4d22-4568-a2bb-3a07728e3869", "value": "12288:1zcsGI/cxWr4IdS31Bb4TudScrkNIPoZKU+l0/ZDznSvax05pA74wpvcYs01iABd:1jE3L4TudSckIPoFeGb05s4wpvcuH6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808276, "uuid": "9ec443df-1b6a-457a-8ffa-d976d6daa8b1", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808276, "uuid": "dad079e0-94e9-4acd-bd9d-a1ae090b0fca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808276, "uuid": "422a186f-aea4-4f0c-9303-e17edd5917fe", "value": "88edb353bbf9259f0e5eb0830df37086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004787d4-0479-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629767828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629767828, "uuid": "f5a5ae5b-90a1-4d46-8be3-3771f5581c01", "comment": "Malware payload (Formbook)", "value": "c4ee18d4a484321620bef6ddd00fc620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629767828, "uuid": "31450bc2-4eb5-4e36-b2a2-7b5de4f1d194", "comment": "Malware payload (Formbook)", "value": "4fa4620f075ed6875b96da8c661287fc12c586ddc524c866a6861a6a94a26bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629767828, "uuid": "1f7cf28d-6d5d-4945-aeee-a16ab17d0bb2", "comment": "Malware payload (Formbook)", "value": "0bb6e51bbd66dfa5afacf3e12ab9789252f2ff57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629767828, "uuid": "b07b5090-047c-4a30-b569-57c3fb4e63c0", "comment": "Malware payload (Formbook)", "value": "fd9e51731cbacea82414c5c1f1fcfc3195c558fd7ab160044db29540d788af52d21d339eb57c7f49700137a9607dd439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629767828, "uuid": "59b0a9ea-ffb1-498a-b6d2-36902d82b00c", "value": "T1903402451E0CA60AD074843EA80F66BF41CE7FF5DC1F456BB79831AA1A7A3E0E52D911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629767828, "uuid": "e05ae035-2ba2-4773-a8a2-34a6e0af61ed", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629767828, "uuid": "9ea150ea-fea9-4469-a21e-5af4ae6b309d", "value": "6144:qK90Si3cX/ljsdbhmuUhmA3gOETfcfmcb2pY:q50XidohmdOufcOcb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629767828, "uuid": "9adf5f24-145f-44c8-8300-ced9ca8b071e", "value": 237376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629767828, "uuid": "f794355e-10ff-40f4-b43e-ee930e45819a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629767828, "uuid": "bd0019b4-4bb8-4c5c-9bcb-f04910743207", "value": "PO082021.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f912b9f7-0528-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629843407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843407, "uuid": "0304ae5e-b5dc-4de2-9c70-9370891e6ed4", "comment": "Malware payload", "value": "93f3eeeaf5b6084a68efaabd5df2b965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843407, "uuid": "fd5f1e23-469d-47d7-9de3-d74a9a449d41", "comment": "Malware payload", "value": "4fb81072ca8f80457066415b2ab895f38ef9b48d57261faf7491c0777d8642a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843407, "uuid": "79252037-40a3-4a86-abb4-fe58199a7c80", "comment": "Malware payload", "value": "4f65b42fe6536511865f980d3376c87d3e64ad51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843407, "uuid": "16b1bfdb-afa8-4b3d-be84-e587b5d2b33d", "comment": "Malware payload", "value": "18a67fec3debc902a623995b2312b3970ddcda304542756d592d62040e71e9c8992f521c374f76f78965b64a5856de47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843407, "uuid": "eb2640ea-356a-4027-a5d6-fffa56fcf2a9", "value": "T13E858E203EEA501AF173BF754BE8B9979A5FBA732703541E1061238A4733A42DDD263D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843407, "uuid": "743df36f-be03-44c4-a082-cb8aaa746e87", "value": "18946384365d5a11c8502099bc226d8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843407, "uuid": "130be718-5674-499b-bd56-e38f2fe354bf", "value": "12288:CUcgvbwRKwtpdv2u32Tc9PuDVma2pEKWA2VMFa9DVQrr+TQXfK6r4c9wtS2KhXbO:vaJlmDR2Kx49/mYXpIi0PyWzHt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629843407, "uuid": "aa099611-319f-4bc6-aca0-4df0f3805ef6", "value": 1757184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629843407, "uuid": "f3a615c1-613c-477b-b7ca-de7804e011b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843407, "uuid": "27e647f9-2429-4e7c-8dd6-28b0ef72f5a1", "value": "BANK Cert.8955-04 WIRE DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7484e8-04a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629787179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787179, "uuid": "44ec14f9-7a68-4c27-ab9d-94acb7947d09", "comment": "Malware payload (Formbook)", "value": "e24edf75d66ebc56d83e2c94cb885c02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787179, "uuid": "3c1bc874-8d3d-47b3-94c5-4005d85084bf", "comment": "Malware payload (Formbook)", "value": "50b80876f6d2a05b4bd054c3207319b11b2518ae4ef3f0193027356e26f856e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787179, "uuid": "1ca54cc8-a726-4a18-a7f2-ddf8ef1c3567", "comment": "Malware payload (Formbook)", "value": "46c043c9d659aeb0c59d84462429a69acbf3168a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787179, "uuid": "d32cf812-6f65-4019-a38f-f277262e7fd5", "comment": "Malware payload (Formbook)", "value": "6a4aaf3dec712cebbd3ababf72372b22f63aadd62337c46a7b191879a917a826e01285b31f323c99b92c1279337317bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787179, "uuid": "fe583825-1d1a-4f40-a05a-aa1237da34ab", "value": "T1E7158C306389C294EC1E8EF0167CF7A102F235E7B6C5CD6E16DA720C8E5E9D16A0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787179, "uuid": "bf95e877-b2e3-4440-807c-3a59bdee5246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787179, "uuid": "2991ed76-894a-4b1b-ae63-083436edb46e", "value": "12288:IDcsGI/cWQA889lMOlC8sZLsAqxqj+EUeKDWH+JBhlUim9zzTAuV2EObbq:IcAhlPTXAF+EUeKMGBnUj9zzTAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787179, "uuid": "dda3700a-599d-4d9e-84fd-2915abe2807a", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787179, "uuid": "a6b71134-c0d5-40bb-93f2-486aa8556e02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787179, "uuid": "d66cca9c-514d-41ea-b616-056a042ee7f5", "value": "e24edf75d66ebc56d83e2c94cb885c02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfec60d-04a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629787551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787551, "uuid": "10dd37ae-0d6f-4525-ae95-4d266aa4501e", "comment": "Malware payload (AgentTesla)", "value": "b019452957c79b6a34e89c1370f87a44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787551, "uuid": "5f355373-363e-4105-9966-68950c071af3", "comment": "Malware payload (AgentTesla)", "value": "5183db71417c4cad1ef9bf8700ceb84c0c62db94474cbe602490128ea1197755", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787551, "uuid": "881c94fe-cf99-47a1-b3d8-cff276ce46e6", "comment": "Malware payload (AgentTesla)", "value": "582b3df3b3bfdde23e9aefe9b350dc4681cf16c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787551, "uuid": "aff771f8-8033-4386-ab10-e554142253d8", "comment": "Malware payload (AgentTesla)", "value": "6239c5c59e124510a8f1c672437c5b294ac7b7554f2b8b00726b0589b7c7dbeb08b16c4b0afd91672a8c2ca75ac2a8aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787551, "uuid": "0cad54bc-918f-4380-a766-007dcf5c80ff", "value": "T153355A743384E19DDC1B8EF0566CBF9452E135E7B2CACE2A11D7224CDE4E8D29A131A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787551, "uuid": "e80416e8-97f0-422f-b04c-dc41473f6905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787551, "uuid": "d3f0ed40-dc52-4f29-9c66-32839462f67b", "value": "24576:Ox/1tQ0w6G78VZT54cpBik1uHH2csrYyJ3v1:4NS0D39/ik8nOYC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787551, "uuid": "431f1335-b4b8-4dec-bc29-a396077b859b", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787551, "uuid": "f69125c6-d8e9-49c1-925e-aa54a883fd8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787551, "uuid": "6fb7fe3c-25f8-4e65-b611-ca5da255a0be", "value": "Payment_Swift,jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6b7696-04e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629813615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813615, "uuid": "2ff9bbc6-cef3-4975-a12b-4f5b47fd1ee4", "comment": "Malware payload (RemcosRAT)", "value": "b1f9ca6cfc95de7d290ab0adba751b38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813615, "uuid": "a3bb08fb-2e4a-4d09-9182-23551e6b9edc", "comment": "Malware payload (RemcosRAT)", "value": "520a1fafe109d97b5de985e81fd16cd2d45a61ed00b523c3dbdda6bc3cb9998b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813615, "uuid": "9cd880e1-7b55-4613-9a20-e2bd1d6b6df8", "comment": "Malware payload (RemcosRAT)", "value": "317ded507d1ba927195d9f9c32c3c7e3e08d107c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813615, "uuid": "9ced7e6a-5f4b-42e9-a7fc-f443dcab8272", "comment": "Malware payload (RemcosRAT)", "value": "18276d0d83318bb2c447f474023ffec2ba0fc1c5b56f26fa3665ac4440c7f1a5f25d5699865c0eb43d235c4f75d254f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813615, "uuid": "5e2be1e0-d7e3-4639-816e-b2c12c41c497", "value": "T1BAC5896C8C9871CCB41EF7C80E62C6D8535FEBBB2455EA3271DEA731195395DEBA2800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813615, "uuid": "aaf5f565-bfee-4dea-9731-6829a1d893c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813615, "uuid": "281f33cb-46d6-4498-b5b2-5eff1b467bf2", "value": "12288:S/WlEeIBhOmH6gv3xetnYnV0ca89b6U8zkggF:M+GH6g5/BAjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629813615, "uuid": "3f54482b-5544-4f59-8949-98b884725472", "value": 2611200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629813615, "uuid": "3aa56803-ce16-4c8c-bffa-0173f64925b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813615, "uuid": "a793bd19-2f76-42f6-92ff-20513a5efdf9", "value": "Order_Specisification&samples_for_Octobershipment2021Emma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cdbfb4-04e6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629814709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814709, "uuid": "f8e33766-35cd-4247-a577-1299bb5dfc8c", "comment": "Malware payload (AgentTesla)", "value": "560f9c1f4b2cc8c7555ecaf8a208c5d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814709, "uuid": "7826982f-e18b-47b8-8cec-c6dc45ecaabc", "comment": "Malware payload (AgentTesla)", "value": "521ba617fc0127595e019b4988da3e4414e64a53c1aa3635799af862d35c289d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814709, "uuid": "43e71895-f053-482d-8cc0-a191d1416f2e", "comment": "Malware payload (AgentTesla)", "value": "73e268d63f497dfc303393cf25b1b03e53b0bd66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814709, "uuid": "b958e7d2-a8af-4511-9689-fedd950bf960", "comment": "Malware payload (AgentTesla)", "value": "e8e6d62012e331e62b423d81384a0a26f3a3115fe44e3234bda873d0bc37aedd405fd6ac70534969e1dd860dfef522d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814709, "uuid": "076de9c7-700d-47ef-9afd-6a682148d849", "value": "T1E0259D306389C254EC1A8FF0167CFB9002F235E7B6C5CD6A1ADA724CCE5A9D12B1765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814709, "uuid": "4826abc6-1330-42a2-aeb0-d8b2244af1ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814709, "uuid": "6b5ac64c-877b-4ecc-afe5-c49d2de09672", "value": "12288:/ccsGI/c1zdUUh/RsQXUX7jrMzKC0VpLj+z1HgsIgAATptaplTqCVZYgu4O/LY2I:/37h5stHozKhps+sIOptaplOCHYpLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629814709, "uuid": "bd5b4044-deb4-4833-8949-b32553b09003", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629814709, "uuid": "a087f54c-81be-4163-a8da-287e70a84d82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814709, "uuid": "d45c5d5c-fc05-4448-b0e7-b18f65126946", "value": "PI No#2122356578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12c2977-049e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629784097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784097, "uuid": "b0b86d9f-0e72-4515-b5b2-b9a672dd923a", "comment": "Malware payload (Formbook)", "value": "e6d37588f293ce0b5376f85d250291a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784097, "uuid": "0ee0f2e2-9e35-4368-bafe-2b4e688f255d", "comment": "Malware payload (Formbook)", "value": "52ac8ef8454aa3c6b7ea0b3332ec4f88640d30d27e276133197c5d00c85d7252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784097, "uuid": "cb0b6e59-da5e-48cf-9e71-0c2823206749", "comment": "Malware payload (Formbook)", "value": "ce0554eefd90d72b03a26d007cf11e703b34fe0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784097, "uuid": "5f084068-42a8-4287-b447-434b37067c02", "comment": "Malware payload (Formbook)", "value": "ff7b93776e79393562603b00e8cf6756f3ba24812584a51e72a9b3ef39ae474014a1e35ccc854e3e8318b981ee822095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784097, "uuid": "19a7d371-5186-4bb9-84cc-5ef03ad7bbb1", "value": "T11FB4BE0A235C9DF6E1E6287103916E7928ADD5712F2F54D3FBC69A8FC13EAC0523474A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784097, "uuid": "22b97f1b-d2dd-4b94-8f79-91015c43e679", "value": "3ab99f80f2c8285ac5250dfc008fb5a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784097, "uuid": "7c294b52-1e8d-4edf-9045-27976bc9b33c", "value": "12288:0yIpu9c4cH46Z/do6fkWlZgvOWyLuLFMVCI:0yIpu446ZFoskWl8OWywFMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629784097, "uuid": "0d3c0b42-b168-407e-bd40-761c003c9f7f", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629784097, "uuid": "8b30bcf8-85eb-45a0-b6b4-3fe9cd32fc5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784097, "uuid": "c45e351e-a70e-4b3f-9d07-c3509eb3acfe", "value": "our company profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3315b4f7-050a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629830190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830190, "uuid": "c756e3a5-8040-4cef-a249-9dc9d40be165", "comment": "Malware payload (CoinMiner)", "value": "6f2962df624ae420ce81e2daeb6866ef", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830190, "uuid": "957087f8-71ca-49cb-84d0-345f9a56a9bb", "comment": "Malware payload (CoinMiner)", "value": "54c2e3c5484e1309a01502c601e0ef91c90909d231fc03bbdc49f20d78156077", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830190, "uuid": "5f537242-257d-4c07-b4f0-982b91741ef4", "comment": "Malware payload (CoinMiner)", "value": "8fe01c9ffa2d970d6aebe7e71277832a7a15e635", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830190, "uuid": "3c43881b-d288-4dad-a3d3-687d1c74033d", "comment": "Malware payload (CoinMiner)", "value": "264c6cd9101636798d52b07ab60ff7574a54820cdeb4c2e19443b2d22fe6b9c6fabe891f5db9045f64a9e993e6af1fb9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830190, "uuid": "4b69e437-8d09-4066-ac51-b87e67471cfd", "value": "T141448C20B6A0C138E5F711F4597EE3AC69297E706B3050CB62C62AEE56372E4DD30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830190, "uuid": "d505eb50-0170-4987-a1af-ca0f80986da9", "value": "87931c028561c299d538d462f4889ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830190, "uuid": "9d16fa0f-e994-4340-b487-c492f0e75b56", "value": "6144:gHTDykYHXCaSxxd4BiVPQ3LveLXL18mnz:WDDYHXCaepVPsDQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629830190, "uuid": "5282aa65-7bea-4056-8e3b-21701345a701", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629830190, "uuid": "9a7d3a01-b9ff-4535-8473-ca898e39b13d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830190, "uuid": "d1a2c881-ae27-45a4-b412-abd3e3f9256e", "value": "6f2962df624ae420ce81e2daeb6866ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5148db2f-0501-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629826375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826375, "uuid": "14065b8f-49bf-4984-b8a9-cab779ccd937", "comment": "Malware payload (BitRAT)", "value": "369ed95e8e86dadbccfacde57d55cf8b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826375, "uuid": "166854e8-86b1-4809-a61d-ce4796f62e8c", "comment": "Malware payload (BitRAT)", "value": "54d90bf7f12a3b1369e8ef4f708a58fed9d7950e1a87c9d5d805b974a148ce9e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826375, "uuid": "1def87d1-fa26-4fa4-bd16-e01d4a786268", "comment": "Malware payload (BitRAT)", "value": "5f1d4d191fd4f56d0e9c37d635ebf09938a2369c", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826375, "uuid": "42db41cb-41e1-4131-800b-f83dc7276f94", "comment": "Malware payload (BitRAT)", "value": "af4ae921ba436df026059babb2dc0377531c0353e745f93d103fe09e9283f64744637e8e46bbe1112f7b090bbec93f20", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826375, "uuid": "04b3a2da-4eec-4bcd-8d88-01d20b62f1f7", "value": "T109853334BB2846B2F5654AB448795451C2AE3F065D27DE83700A7F9C7FB13C823A86CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826375, "uuid": "cd337613-52c2-4728-aca3-d32026f26397", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826375, "uuid": "b05fa741-d1a7-460d-9ceb-0f791dd23be2", "value": "24576:Rb+uLsUsZPINUXCe1g3CJJMYz2+7mOqhYj0t/EQ6CTQcN8uizIoMTjoeT90D+jXA:5+LUf+S8g3SMI7u+08c8cN8I7vp0mXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826375, "uuid": "4e8cc764-9347-41a1-935b-e9ba6b591720", "value": 1839104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826375, "uuid": "616c3f55-204f-4fae-8556-711ccad35ef5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826375, "uuid": "aad56344-a2fb-4d8d-9d34-18a181b5cb2d", "value": "369ed95e8e86dadbccfacde57d55cf8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979704f3-04bc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629796858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796858, "uuid": "0080e919-cdda-472e-a2c0-79fd186fa315", "comment": "Malware payload (RaccoonStealer)", "value": "b79b4e61f5805c0d91d79cf7374ae7c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796858, "uuid": "002fa65d-b897-4354-8635-fdbb632858cc", "comment": "Malware payload (RaccoonStealer)", "value": "552f188d43cfaa780bd675e6bda5cee09343d7e4f141eaec8d716aa1d62694e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796858, "uuid": "62bde813-21c7-4af2-a688-5d3cd23c3ed4", "comment": "Malware payload (RaccoonStealer)", "value": "2d1f92d7b7dd5eaebadded62b2618584b1e6538e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796858, "uuid": "17dc9ddd-7d92-4b98-8f1f-808e13bd83d9", "comment": "Malware payload (RaccoonStealer)", "value": "7463327ee2997d535e07cc4dfb445233857e748bf32f777a0d25c77562cd4ceac136865b2121f78c7ff54878e5fb019d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796858, "uuid": "eab5b7ab-b8e3-4e5d-9c1e-444ca6bf290e", "value": "T144940231FA91F936C482CCB4CC92E391A7AD58A5A574424F339D7F9F6BBC2805716382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796858, "uuid": "a09cdf97-352b-4c28-8834-7dca6539a97d", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796858, "uuid": "f2d7c205-de2a-4560-bb22-b832304e1bcc", "value": "6144:U+NBEodZBPEjcHYoNJVnoYHsE/WIcj6J8rA5xYllh+HIYmna6Yacn9+auAVZjnx:NzZtEjcpJpRME+Is6yMql+Ipn2Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629796858, "uuid": "e67bb6da-1aba-4087-9645-f3473dd1c7cb", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629796858, "uuid": "282d60c7-88eb-42ea-8d43-67e4d400c669", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796858, "uuid": "0a3a1500-56dc-43bf-b22f-b0639e176019", "value": "b79b4e61f5805c0d91d79cf7374ae7c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccfbae8-04c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629801591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801591, "uuid": "def3cc66-564c-4c54-a044-f7e7efc42d96", "comment": "Malware payload (Formbook)", "value": "059d92b876948ff3102b8c78e26621d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801591, "uuid": "3db9a329-cf52-4c4b-b206-f3c8a1ce2501", "comment": "Malware payload (Formbook)", "value": "55dc099e790b76a62f56ef105ca53205ea69d9f4027a93554b03d573f112d643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801591, "uuid": "17dc17de-5f5c-4751-bd58-4ed2b45654e7", "comment": "Malware payload (Formbook)", "value": "e6bece6beffcd17c46750905bf89687de514af0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801591, "uuid": "24710cb9-78d8-4760-9f5c-eee703862f70", "comment": "Malware payload (Formbook)", "value": "aa4cb14794e25055fcb259289c5b3610dee6aa7b1e8da707ce8b0269c0bf7425186fb041f02fd64f70f5953a2d265d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801591, "uuid": "da7b0e0d-209d-4bed-a92d-754b6ff0ef4f", "value": "T1C1159D306389C244EC1A8FF0167CF7A402F235E7B6C5CD6A1AEA714CCE5E9D12A1765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801591, "uuid": "4836e9ec-adf9-467b-89d2-dfd65df6ab11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801591, "uuid": "463b9941-a62e-45a5-9c7c-7c91f54cd0cc", "value": "12288:UYcsGI/cSU+zdTGN/u+I7tTduj0E/VE1/SvmzgLcYz+V77ntOURyawjAJEp2EObk:UcnzdyhmtT879E1aHcE+tDRajr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629801591, "uuid": "cff49c6a-81f5-43a4-aec9-5c3e39cd8047", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629801591, "uuid": "8d6896db-424c-459b-a0fc-93fa16b6bea4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801591, "uuid": "51f80596-eb25-4bce-af54-4dec17c6f94d", "value": "REMMITANCE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7061d7c8-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629812684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812684, "uuid": "8821b225-2916-49a0-9519-17704935f01a", "comment": "Malware payload (Smoke Loader)", "value": "8905c96d588cd083bc46fae8fd019049", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812684, "uuid": "7ab02533-6c62-444f-ba25-9b47dccde7a0", "comment": "Malware payload (Smoke Loader)", "value": "57b6d02c4b8d4153680004aecf35f8328a6f33c59b2ac7c7ee4ecb4e5af46465", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812684, "uuid": "8934699a-89ba-4dc5-9a9b-653c68098e71", "comment": "Malware payload (Smoke Loader)", "value": "cc5bf2092a79cb4fc5c129882c6ef80cecaddfd3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812684, "uuid": "f8320555-64f0-43cc-8815-b362cd44f4a6", "comment": "Malware payload (Smoke Loader)", "value": "fde232980c75116d3f5bdb88fd5387cd46b3a745d1729fb13fa81e972c7e9d5512e8ed0b6557a3821176eda58ca7bd0a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812684, "uuid": "67d12505-3c45-4fff-81ef-c92b33982e38", "value": "T1A4D3AD1131E0E077D45249B148DDDAE1F63AF9622BB54C8727E89B5F6F303D0BA29352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812684, "uuid": "a6296206-b6f2-41ca-a662-190abe22de96", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812684, "uuid": "f8efe981-c8a6-4a39-81dd-a1525d82d053", "value": "1536:B5hDN0FQ4I74Q99kiRygOY1PIT3JNv/jjYYvexu5Z0Nqeo799BriobhO2Yp2:Y24QOgOYWT5p/jdIu5Z0Nv8BgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812684, "uuid": "5d7abe28-775e-4819-84c6-49465d1e108d", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812684, "uuid": "6bb0db14-1134-4eae-b606-ba1811d16b9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812684, "uuid": "da07d780-de09-483d-8f54-4ccc871426ee", "value": "8905c96d588cd083bc46fae8fd019049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110620ba-04f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629819396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819396, "uuid": "5afe73d3-6f69-46bd-97e7-401c62f5918e", "comment": "Malware payload (Smoke Loader)", "value": "231871298cc5d5fe7445dfad16f2dbf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819396, "uuid": "6e576903-b204-4db9-8b0a-a18fbb94d249", "comment": "Malware payload (Smoke Loader)", "value": "57fb96b12db08b18906ce22c7e55b81a214ede326166e772ae87412281044497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819396, "uuid": "af960269-5497-4bb5-a046-230878759209", "comment": "Malware payload (Smoke Loader)", "value": "76ab68f1517d039d9ea6d7ab3bca9aed456e4466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819396, "uuid": "6164c960-1599-4e51-8860-7c6015d955a5", "comment": "Malware payload (Smoke Loader)", "value": "375954d8cec520c5acbc861552d3d9460009526aff6c037dfbcb75fe5de9868eaa02699e84549e03c9795421d62af0c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819396, "uuid": "da33db87-40cc-49f3-b6b4-002d6b91f3fd", "value": "T17ED3AD1235E0C437D4564A7148D1DBA0EA3BF8222BB55B8337E85B6E7E253D0772D3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819396, "uuid": "c6c56971-64f0-43a6-a061-54e9293560ce", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819396, "uuid": "733aff74-e71c-40af-a673-b4651959cf5b", "value": "1536:Fah9990FQ4Ir4Q99k45XxO9/EBJKMbBW8aIyznu2xAB5PfmeDKcBriobhO2Yp2:AgG4QFQxEBMUBRalnC5POw3gM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629819396, "uuid": "af31965d-296b-4f7c-99b9-f7a3aef9b8e6", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629819396, "uuid": "f9b6aea5-5b74-40c7-84b0-6cafa73f7a77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819396, "uuid": "c3880caa-3d29-493a-9417-e01bc3700012", "value": "231871298cc5d5fe7445dfad16f2dbf9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea219f4b-04cd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629804298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804298, "uuid": "99f9ce30-c0f9-49c0-925e-696c7d75fc09", "comment": "Malware payload (Formbook)", "value": "7f6bc5f41f5190704ebfac8d666306ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804298, "uuid": "6eb9e999-1fa1-43ab-8488-d2d76f96709c", "comment": "Malware payload (Formbook)", "value": "5823174ff78f251ac5b1b8cd1e1727aaa72f8523aa1aace4b59c9ef549d22148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804298, "uuid": "d318e88a-8074-404f-b8e2-cb72ef69cf27", "comment": "Malware payload (Formbook)", "value": "1ae3d6d99ee0462619799dfc722f0bfed442b231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804298, "uuid": "a2827a0e-eeb1-4751-8df0-a6c58deebf1a", "comment": "Malware payload (Formbook)", "value": "f720b3897662aa56b6636149a802fa3585995d7f889931b023d23f5104da5d56ae3536f982003c1a2d35e1bf54264bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804298, "uuid": "1ef4bd0e-c84e-4d5a-b4ea-6cae4d14459b", "value": "T195158C3063C9C294EC1E8FF0167CFB9402F235E7B6C4CD6A16DA724C8E5A9D16A0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804298, "uuid": "1dac9211-8735-44d6-ba24-3b845051f05d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804298, "uuid": "b097becc-e756-4783-b100-132574c60186", "value": "12288:SvcsGI/c4fvh8VtkwODi42tTvwRPdywkYyzXlI8n3dYt2EObbZ:SjHgODjmzVXywtYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804298, "uuid": "1e3badf4-7e7f-4482-b056-5863042bb2aa", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804298, "uuid": "2a54e1b2-00bf-4498-9a6f-4a23204e6987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804298, "uuid": "480d73d6-9a3c-448c-b31c-c357e4c85b4c", "value": "D190a.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93576a5-049f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629784432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784432, "uuid": "7d01a1a8-69d8-4c73-b8bf-502f693a8674", "comment": "Malware payload (AsyncRAT)", "value": "36851699890e8d2ed92224eaa6d8661b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784432, "uuid": "43acb98b-c4a6-488b-abd1-232fd9a2adcf", "comment": "Malware payload (AsyncRAT)", "value": "592dea4eea3a4fc6540a4c677253f3936822f9040add569257eb1878cbafecca", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784432, "uuid": "55b848ad-3bb2-4594-9a91-b0c9f7536661", "comment": "Malware payload (AsyncRAT)", "value": "5998d5f3aa5953dae2898054b76da6b5a4c12442", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784432, "uuid": "8677c9a5-87e6-4d37-918e-6efd2e250596", "comment": "Malware payload (AsyncRAT)", "value": "73f550ed4bed4fa90890cd1c0c49b2d627c2e75f5391e2bfdd3bfdc2391ef04487138218196ce5f803bbb376ed79be57", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784432, "uuid": "5a5bc17c-0650-413d-a66c-19ff8d0032c9", "value": "T1CDE533DA972FA379D88853B1BE55C7A6035B3143061E93BE314B6CB08D93388673326D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784432, "uuid": "ff700d64-2661-4031-807c-d8bcb7cb05e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784432, "uuid": "fb183e62-6205-4d45-a1d4-e4f0830a3461", "value": "98304:9p31ZVRYXDG9EGbkXJ8RaScZSYZYDPZjxoZ4MQk4d:9pjgipF/GZYs5Qk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629784432, "uuid": "9e2c15f3-f952-442b-a4e4-a5f4835bdfa9", "value": 3267584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629784432, "uuid": "c4a80a64-6d5f-4639-99a3-24f2a0044304", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784432, "uuid": "42a6bfb1-5b32-4908-893b-6419a81058ba", "value": "36851699890e8d2ed92224eaa6d8661b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7ca573-04bb-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629796385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796385, "uuid": "cfea1192-9151-4cc0-9da0-07819d20b55f", "comment": "Malware payload", "value": "55fac640e01a0b3728dfd9bdab7e7eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796385, "uuid": "80b91210-5889-4f35-aadd-f33506b242a4", "comment": "Malware payload", "value": "5a4217eff59b3aeda8c38294b2882b6ce5db1f8d7ae599e92c285a68762bcdd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796385, "uuid": "a4d03c2e-0a01-4038-ab1c-d327aa43a4b8", "comment": "Malware payload", "value": "1b4db61ea9aa60bf9e08c27fca820c3df9c76023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796385, "uuid": "3167360d-dd6b-4136-b04b-536147803555", "comment": "Malware payload", "value": "d834af304196f7b87f330b2d67ada9fd25e80c19e07c350a1a4bee851b61dbe213f3069ffe7363305ab6ba0f7dce3bf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796385, "uuid": "39f37329-8f1b-4a87-bb0b-146ccbffb6c2", "value": "T137C1A517EBE84B37ED6B0B328C73A31122B8FB1589428B6D3484510FBD173590A62F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796385, "uuid": "f4a896ab-71da-4d3b-847b-fd61827029dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796385, "uuid": "84122309-1f97-49a1-af97-c7758bde780d", "value": "96:oA+XALoN9c5t5GgNcjXZtJnImdESOzNt:roqn1cjpjlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629796385, "uuid": "06891c01-c732-492a-a23e-082e05f51ab6", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629796385, "uuid": "2dddb953-7183-4403-8569-39308228723e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796385, "uuid": "de71c8b3-3a26-487d-a723-e00a1b7dec22", "value": "6403084-OC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ef58da-04a1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629785427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785427, "uuid": "96d4cb95-d576-4a59-8785-8fef36f0e400", "comment": "Malware payload (Loki)", "value": "991e8aa6e973d2ade250363d8d2992fa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785427, "uuid": "40f44601-b2e5-44f9-9496-f3b78812ad09", "comment": "Malware payload (Loki)", "value": "5def5898cfc275a12533bcb3365ca85ae0d250845de402e8f62274c7c657fbb8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785427, "uuid": "bac70b0c-c245-4f14-a93b-828b271fe5f6", "comment": "Malware payload (Loki)", "value": "124cd96117fb3b5871bbfac968a2181dd2a1e066", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785427, "uuid": "4ce5aeb0-6a1e-49ca-b5dd-9bdbb0686ece", "comment": "Malware payload (Loki)", "value": "129aa0b3e3c321d2c20ceb100087a28bcb148b6130d3debc4d0352f442a578d59d083f50a737ead60ad2f9e670dd13cf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785427, "uuid": "7e09b5a5-79a8-4a15-b852-1c03fa31a14a", "value": "T1551275BCD45742988F85AAF8271E9B44018C7B2DB79CA533363C97351B92E7A5023D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785427, "uuid": "2e446837-ed16-435d-8f2e-5082c138999f", "value": "192:SCXRaBofL+ta+hZD3YUav1McidLqkQ1eKxuxgo6BrN/5:jaBii45BuZqVnAt6Br/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785427, "uuid": "df22c6e2-da29-4145-bbe5-a52d531711dc", "value": 9861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785427, "uuid": "6dd54cfc-c2ea-43a8-9163-b3fd18389972", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785427, "uuid": "a1e91f10-ee5a-4b54-9aef-b354f46d0716", "value": "SOA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea19ae71-04d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629807734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807734, "uuid": "e5536338-d0ab-4351-833f-3a4e39c09436", "comment": "Malware payload (Mirai)", "value": "de79f67ea5d22fdc07f7d2778357e43b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807734, "uuid": "712b33ec-ae72-4862-ad19-ecdf947b28e2", "comment": "Malware payload (Mirai)", "value": "5f6cc2b1b77a508a68ebb3a7ac3dc48be822d31723caa9ae0985b5ba9191d495", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807734, "uuid": "9cbfc49a-df85-43c0-90aa-8252274b35fa", "comment": "Malware payload (Mirai)", "value": "c1c42f78f3a61285f2b852ebeda653777c6c2eb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807734, "uuid": "a79bdccf-c052-45b2-8596-80ec7a6fc6db", "comment": "Malware payload (Mirai)", "value": "c60962c71fc9c3da00c8ef5f6f2a70f2f0f4986c906d0c4d7758b781f20bde2a9327d706e21d845fa88d3890acc8cc6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807734, "uuid": "bdae1755-0cfa-490f-8b52-bbe8ce0ad439", "value": "T12563284AF9C19B11C5D111BAFE1E124E73234B3CE3DE72125E24AF25678796B0F3A909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807734, "uuid": "afea49b4-1177-4913-bc8b-c9e12b051446", "value": "1536:vtn6PpNM7uidKiir+OQeCvH9MI0bWuaBBZl5SYJhd:YPrYdQ+OQe8FaanZlcCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629807734, "uuid": "97b3916f-d44c-4923-881d-a223308cc7aa", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629807734, "uuid": "12e1923f-2a75-42bc-a7c3-bf95bbcabf57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807734, "uuid": "f59ee591-1f07-4bd5-9fa1-3321a34cc88b", "value": "de79f67ea5d22fdc07f7d2778357e43b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c32975-0513-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629834117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834117, "uuid": "31839148-6784-42ff-b359-38ced14c5a8c", "comment": "Malware payload (AsyncRAT)", "value": "b3d8574a20c22e2c2cf0cfa6783c3609", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834117, "uuid": "9eeaa586-b908-45ac-a7ac-f94dc56adb9a", "comment": "Malware payload (AsyncRAT)", "value": "60333b9138bb30f9a4d5d48a699ad137fe46646b276b55e1dbec71f8cf1b1d2c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834117, "uuid": "16a39870-9efb-490f-b473-5578fc4d9015", "comment": "Malware payload (AsyncRAT)", "value": "432ded5332aa04810b817acf162e0ebe06871d24", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834117, "uuid": "c71b7c73-62a4-4ea9-b9c8-a3cc51d019a0", "comment": "Malware payload (AsyncRAT)", "value": "53692dadd52875495cce08060dc42442396b40438bf7678d2636f427eb265c604fbfec47ab56a4cefd8c0c27e5bb9a0d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834117, "uuid": "a5318da2-8c09-46c4-86c9-baaab1427537", "value": "T1DEA4F4919EDFDECEC26F667FA01A0C8614DED3060787A2E08B464E31F7841239D661E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834117, "uuid": "228d68cd-58cc-47cb-9ee4-678eccafcdad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834117, "uuid": "69a72a61-2f62-4775-aae6-c42747a76b62", "value": "12288:hDciVuNmzX/Ctyr8ZxJXTeBXQIEPGxcb7uVlSk0:hDciVuIFWL0gIEe06jSk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629834117, "uuid": "3549c809-a7e6-4f56-b425-ee78ae3e82d6", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629834117, "uuid": "40afe4f4-fc43-40f6-89dc-8482a32072f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834117, "uuid": "379262d1-95b4-4b98-bffe-67524e5e27e8", "value": "B3D8574A20C22E2C2CF0CFA6783C3609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee071ec8-04ad-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629790561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629790561, "uuid": "d1811e74-caad-41f4-aeb5-6a82e632d687", "comment": "Malware payload (RaccoonStealer)", "value": "8d7c6ef297af6dd1f637f4bd925baa01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629790561, "uuid": "2021f368-83a3-40db-882d-8ceb927aa3c6", "comment": "Malware payload (RaccoonStealer)", "value": "60ab0131b6fa420a6a8039b60ac948db87033e9a8db69b16344e3d9222859556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629790561, "uuid": "4abfe929-3124-4be7-b2cb-73673ba69e70", "comment": "Malware payload (RaccoonStealer)", "value": "4e2430251bd235583027e21dc5086569e345ee79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629790561, "uuid": "bdedfb7e-2e38-44a7-a6e7-a77a3d403251", "comment": "Malware payload (RaccoonStealer)", "value": "7b3400a91a1b5cba7339d151a5d224a4f0538110af4a445810428acdcfce9b0d903fafa70f4ab8d101be62d769e039fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629790561, "uuid": "ade490b0-29ef-4825-9cae-f783edbda752", "value": "T105E3BE103990C87FE483613178DDD6A0D62AF821AFB1994737D8665E1F312C0B63AFE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629790561, "uuid": "d93a15d1-0fb0-4b8e-ad7e-7dd750d7547a", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629790561, "uuid": "d577f430-170f-4333-a220-ae2f75815f94", "value": "1536:SVxC7UJ9eFYKkC+yCVLamHIppCxYJu1v2C5NR0w6VRLyX/lVeJATEL+hItC3nf:ugYTzLamHIpp8n2C5NsyKJQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629790561, "uuid": "984e278a-a963-4a3d-a840-89181d19bac7", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629790561, "uuid": "db3edb58-fa4b-4f40-b1a5-ff328ec8b319", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629790561, "uuid": "8c9d51e7-9c6d-46c3-afa3-afef2e2d73b7", "value": "8d7c6ef297af6dd1f637f4bd925baa01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f80989-04f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629821228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629821228, "uuid": "38195227-4957-4eb0-9138-38d0eac2239c", "comment": "Malware payload (RaccoonStealer)", "value": "d6a85c49b8672fd9b80cc96d05f8c631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629821228, "uuid": "4681e5f1-2e22-4888-88a0-32b8a9586e98", "comment": "Malware payload (RaccoonStealer)", "value": "60ce6215a7799a4661dea4709e402707cc6d54d30847fd336d038512335424bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629821228, "uuid": "1392956e-bee2-4c0f-b53b-3784dca1c2c8", "comment": "Malware payload (RaccoonStealer)", "value": "9191a57c208dd6e01db0399fc1cd1010832e2119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629821228, "uuid": "7b6350ba-05a5-40a9-aa60-b6748a7ca417", "comment": "Malware payload (RaccoonStealer)", "value": "6c402e16f52602e97fb97e733484eb693e8c686690be87be6fa10449e8b3d1d4d96d35b662c22f46083dbe3017c8111b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629821228, "uuid": "2c0d8f48-0f83-421c-bd4d-8cd1e0280ff7", "value": "T101A40200B6B0C533C495557188D5CEA0EA6DB9726FB059873BDCEE9F1F312E1322A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629821228, "uuid": "a0b0c090-4ac1-43a6-a8bf-284b75a34c10", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629821228, "uuid": "52bf4336-c9a1-4453-84db-cb1f4e339a1e", "value": "12288:MoioHfTuzovtIjw1oRIz8jTxsTIgMsVuEcF:MoRHf5ujMoOYjTxsT84O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629821228, "uuid": "4d64c778-a71c-4501-bd4a-fa498a0d7aca", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629821228, "uuid": "3319c311-341e-4008-b1a3-2fc87aa449f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629821228, "uuid": "c19d5dba-a001-4364-8da1-458088ecbdc8", "value": "d6a85c49b8672fd9b80cc96d05f8c631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed802f6-04fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1629825083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825083, "uuid": "8a39b0c1-39b9-450e-91d6-ec23e43accc8", "comment": "Malware payload (QuasarRAT)", "value": "b3d0b8c065ad75dfd646829bc7c87735", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825083, "uuid": "5bec8d98-b0e9-49ff-8b97-7ca621b017e7", "comment": "Malware payload (QuasarRAT)", "value": "61560f470822a249950e3d35574aae0ee9c93da31c1fd6f001c0cec97069a4fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825083, "uuid": "3c6ec22d-6992-437b-bb8d-97b4be094d9c", "comment": "Malware payload (QuasarRAT)", "value": "629655f03b356ad46ae106855eb004c7be7098c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825083, "uuid": "eb2b0eb6-111f-4d89-a4d5-5d69d3cf5253", "comment": "Malware payload (QuasarRAT)", "value": "aa7a26c4cd0124f488c4257bdf48d5d15c94ab25aa26c9d9a70c4e7c0e7ab7ffeca69c67d110a91d81d1fa285f38d11f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825083, "uuid": "56e8a0e6-252a-4ef1-8ff3-5dd99743b117", "value": "T15363174177EC9220F7FF8EB9A870442407B2B827AD22E71D1DC5609D1A33B9495A5FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825083, "uuid": "48e1693b-e4f2-4282-a293-baa1e72ab890", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825083, "uuid": "a6516dd6-fc9f-4dbc-8a1e-ff5433b95046", "value": "768:Xb5fzfrnTjUzYZzZbvINP2hTlCio1cIBB6zTTCkvbIcwlwLHT1C4kh3ZsXULI9eN:L5bTnBIrio1cKeTDvbIcwqdUEPR+pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629825083, "uuid": "58ba889a-f087-4a31-80c5-98fe444d9581", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629825083, "uuid": "5ba196b2-7b9e-4e7b-af08-34d58bc7bf6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825083, "uuid": "ae960df1-9c18-46ec-83ab-8595fefbf9f5", "value": "ChromeRecovery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859bc4ef-04b3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629792962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792962, "uuid": "b74021c4-889f-44e3-a025-86289384239d", "comment": "Malware payload (Mirai)", "value": "bfa1b2e1e4956610924e36dcff9af89f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792962, "uuid": "b332dc2d-0f2a-4133-b9a7-5e2960e53bfb", "comment": "Malware payload (Mirai)", "value": "61dfdcf6eb9dd0fbc56573f4d41cee8a6c7cf9ea960c0338842a416e1a3977df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792962, "uuid": "668052a9-0592-4fe2-9638-982249606c9f", "comment": "Malware payload (Mirai)", "value": "639baa992b8c9ce44e415f61d5147c4b1095e3ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792962, "uuid": "1baef935-16e3-4f93-b472-61ec875068dd", "comment": "Malware payload (Mirai)", "value": "c396a8c64ec11100648ceb56572a7341ca8f2e4906adb0099177d0b99dd6445d9f8ef12010ce9624f9f56fbff2278e08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792962, "uuid": "5d5a34d4-8abe-4536-b9ab-e03d1cf594f8", "value": "T1C8F37436B7619E77D80ECE7305A985121C8CD98712D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792962, "uuid": "c3d962b0-1967-4b05-95d0-3f9b916517bc", "value": "3072:1LNqrhHZ0P6bRFBQiAfRjHkLwmrThPaLEne7rNb:1Lsrr0PeRTJigLwmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792962, "uuid": "59a11c50-b9a5-45c5-87b7-33454f0cef41", "value": 159493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792962, "uuid": "8efec973-efbe-4e89-b015-f40e4d7c5e82", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792962, "uuid": "227ad4a1-a018-4b22-a8a4-35522a7577cb", "value": "bfa1b2e1e4956610924e36dcff9af89f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbd24b1-0485-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629773404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773404, "uuid": "0d68adf5-8cc2-40cb-81b3-5587313219db", "comment": "Malware payload (Mirai)", "value": "cb3129975e749a001a25792587795250", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773404, "uuid": "ab3a77fc-d0a8-4385-ad76-7ac57a20d318", "comment": "Malware payload (Mirai)", "value": "61f0841a4b160514d88df5f416f9d647b455948b9291d8161a2818561d71d144", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773404, "uuid": "0d32adac-17da-46c1-918d-da050f18c6ab", "comment": "Malware payload (Mirai)", "value": "48e6344e322fef558c3f9cc9a93d473f61c11583", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773404, "uuid": "047c1f5d-9245-40b8-b0f4-b4f531b87748", "comment": "Malware payload (Mirai)", "value": "2841d0b9766b908db499e34b8ad4b525507681c628356931d40f5f7a7771de37aa22b68b6ee449fc1b1289ad60dc4938", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773404, "uuid": "882597cf-3e2a-42ba-9e67-cc68ac257743", "value": "T1DEA32A47E7408B03C4D22B75BADF82153323EB55A7DB23065618AFF43F867AA4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773404, "uuid": "c37491a0-a707-471b-b554-1270c51f8405", "value": "3072:L6eHOpO7H/oazr0h6VNxSWm4M/9wHm5wGxow:L6IKuH/oazrI6lSWRM/9wHm5wGxow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629773404, "uuid": "764c53bc-aeb4-48c7-99c4-c2975284fcda", "value": 102770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629773404, "uuid": "55b08a62-3293-45cd-ab45-182ea80511cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773404, "uuid": "b6f66b00-80d0-4df4-866b-42cc51b4416a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc767d15-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1629805537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805537, "uuid": "b4b31297-782c-4990-a97d-df717223e406", "comment": "Malware payload (KPOTStealer)", "value": "3e4ddca3a0d8b08f50b28d8983ecb80f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805537, "uuid": "12f474cc-fd62-4899-a7bd-00b5a5a1873f", "comment": "Malware payload (KPOTStealer)", "value": "61fe734407cc70105ccbe489e4a70a72f2aaa7591619a6338a34a2f7606bf0b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805537, "uuid": "243dfd5c-b946-46c4-b98b-6961750eb3a0", "comment": "Malware payload (KPOTStealer)", "value": "9898808a0223846a4cf75549fe925368d0bf8f84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805537, "uuid": "c5df8b5a-5da0-4272-84ae-d1e0c52192ee", "comment": "Malware payload (KPOTStealer)", "value": "355f07f85c7f1d5998273eaddc7b9f63028a03740f01922058ac7b25888677409c98ed6de2d30ac18354d809da1c5340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805537, "uuid": "b9805590-e4ea-4bdf-aacd-2e05965b3d3b", "value": "T1977401C13A52C073D262413089E5B7A0D62E7854EFB0D55B37F4665E1EB02D1FA363EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805537, "uuid": "31b82b55-dec8-46cb-9696-02cbce4af4c6", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805537, "uuid": "f1f6ca7d-b59e-466c-9593-4bd8a202875b", "value": "6144:Cw0rMMorByie/YL0LiSRGo62r4Wylezm9zRMqt/b:YyeAgLuLjWeeAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805537, "uuid": "0197f02d-c112-48e8-ae2f-85bb81f1b78a", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805537, "uuid": "f2b5f270-5346-4c91-891b-7f421a286092", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805537, "uuid": "85c98b71-b8b4-4213-8d33-967026dfa2ad", "value": "3e4ddca3a0d8b08f50b28d8983ecb80f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2f0285-04ab-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629789673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789673, "uuid": "8ce93772-9f10-4877-9514-56ef0a591d36", "comment": "Malware payload (RedLineStealer)", "value": "1f6e49e83b13758948915b43fb388a94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789673, "uuid": "dc8f7c18-4a02-49e6-a4f4-b5315a96083d", "comment": "Malware payload (RedLineStealer)", "value": "624cfab55296eb7e9d73d9478455f96d4861ca92d45677909a7f2fb8532b1f63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789673, "uuid": "861488c0-02e4-4b78-b808-f70516801141", "comment": "Malware payload (RedLineStealer)", "value": "c38876024e6e3cf46f804fc3d0aca553a263ffaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789673, "uuid": "9ac62419-e85a-4acd-9917-8c6bdc94b856", "comment": "Malware payload (RedLineStealer)", "value": "1b7ee6951799ad32e128ad656e925cf32b420810c4ca3103bf8f638a8c8cfb71b7ad5afb7e218ae6e044213f2149a143", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789673, "uuid": "89b1e0f0-366e-4284-bc81-8142971f81f5", "value": "T1CFC512413794DB02DAAD063191DFD33007FB7E82AD32CA502E8974DB2ECE7527976694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789673, "uuid": "9e55e2d4-9515-4960-bcc1-9fdb1f5ab00e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789673, "uuid": "60734d3d-9652-4604-9492-7350975c22ae", "value": "49152:YFjdis+kUP77u1iviFrauJtnu8ejPPiYybtpA6R/JiJRNsV6zXd:Ed8junFrru8OitsJoV6zN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629789673, "uuid": "29b824f8-8517-489b-b4e4-76d17e6e85c8", "value": 2581432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629789673, "uuid": "daed0340-e3e0-42f5-af84-1a5a02532bc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789673, "uuid": "03b991d0-dbdc-43ed-8879-b87a156d2c8f", "value": "1f6e49e83b13758948915b43fb388a94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f0afb9-051c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629838065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838065, "uuid": "5a5d9300-242f-4d76-b84e-1fbad81a9b97", "comment": "Malware payload", "value": "cb5c005800541de09bd2c80796a4288a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838065, "uuid": "c0e8de20-0ce3-4a81-8112-02244616b086", "comment": "Malware payload", "value": "625b2138f23ddc4f1af3a6b7a6484717b3fc8971f3e084f089a6c53dc44fd778", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838065, "uuid": "b95f6113-67e1-484a-b6db-b537acccdd88", "comment": "Malware payload", "value": "9af2833960fd6f7807f45216663a14c89d2cdb0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838065, "uuid": "5b41c0df-7d72-4d60-a0ef-63f91c87c5c1", "comment": "Malware payload", "value": "8a06d45a1331b450528f234d04c0e17da2a457d795384847ed3200ea371a72bbd34b84e54c5bbcc7ba7b9703cc1675e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838065, "uuid": "54bda358-4213-48c9-a181-5717df583132", "value": "T14C631C45F9418B17C2D32BBBF79F039D3B36561497D773016A397EB42B8279C1A2A220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838065, "uuid": "7d629819-f296-4ef1-8513-6402d316c336", "value": "1536:itq1czlgBEk/4NYgfTNFmzvOF7LqG4brtDN8+1Og:bczO/4b5sOF7YtDNrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629838065, "uuid": "b140d0a7-5820-47e2-adea-752d6e1f787f", "value": 73231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629838065, "uuid": "c1026f7b-3f82-4015-8be5-1c680426644d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838065, "uuid": "f718d9c1-4530-4677-99c0-7c2659b3e8f5", "value": "cb5c005800541de09bd2c80796a4288a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9368c1e1-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629812742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812742, "uuid": "96da1c62-07d8-42aa-88fc-f76c958f2e64", "comment": "Malware payload (Formbook)", "value": "c96e20a9c8c98a97fa40d8bc01b84791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812742, "uuid": "95efd7b1-b8ad-4d77-8695-b143e41338fd", "comment": "Malware payload (Formbook)", "value": "6279bda546364cbd9bbeb7344824bf2a3efe3e016fde11ebe033987bd3e3a5f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812742, "uuid": "b7c82fdf-83cd-489a-894e-c838a2ef9ef3", "comment": "Malware payload (Formbook)", "value": "4d51eae7ce4a92faefbdd9f102a88387db1a3ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812742, "uuid": "57b1583e-0129-448c-a608-9d9cf489286c", "comment": "Malware payload (Formbook)", "value": "cb118d5aed4e1d0a07c255aafe2407e4bda1572857e6c3d91fe66962a86f0af5871721b3c2e9719f9e4825deffe78e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812742, "uuid": "5df8d1af-62ea-46ac-9c46-0042d120633e", "value": "T1AF159D7023C9C294EC1A8FF0167CF79502F235EBB6C4CD6A16DA324C8E5E9D16A0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812742, "uuid": "471faded-237e-4f8e-a45d-70f50fe67bb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812742, "uuid": "24896ed3-b2e6-4a75-9655-26fbb2627178", "value": "12288:K1ocsGI/c/e70/kwV4qi1OmwFrSD4AdXxokYJdWxVAj+P1f9Sc3Ay2EObbq:KS4Ms9o0k4AVxiJcbA6Zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812742, "uuid": "c6bb3a56-91ba-462a-9e80-98bf275c037f", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812742, "uuid": "a52438c2-8a68-40f8-b5db-aa9709bc2e5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812742, "uuid": "312883c0-f41f-4167-9531-e559efe39f98", "value": "c96e20a9c8c98a97fa40d8bc01b84791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a214fc71-0527-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629842832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842832, "uuid": "be32fb49-ffea-4b0b-aae9-3e3db1163d86", "comment": "Malware payload", "value": "a8bc96cb058592c8fe4d5523e04a1e13", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842832, "uuid": "94f4ddf8-3591-4ee0-8ef3-9c8c2858147e", "comment": "Malware payload", "value": "632dedb080f98999e247bf85ca5195ecdd625e498926bad54a1e3560021a33ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842832, "uuid": "9b08ac9d-b9a9-48d1-9cb5-733fa1b09c4d", "comment": "Malware payload", "value": "407296cef4e211af59b9283d94ecabe14b9789db", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842832, "uuid": "a6724cd9-bb36-4713-be01-106f6e3406d7", "comment": "Malware payload", "value": "0859b0dbbd23d7318ec2821075acb78b07ea1b078c2513073561321e38189bea140f0f9aa764cc8c241890c31388965e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842832, "uuid": "4186987d-19fd-4350-8629-9be3df2d3574", "value": "T13F6263083295D612E2665E321ED6EAE737B9BC116F56433B3288732F2D3FB618D16341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842832, "uuid": "d5ec5f33-8e23-40f4-91a9-18faa6e26fb1", "value": "192:us0+9XoFG4KCdY7qRvaFG9p/SypFsBGuv/heccUmN:uv+kG1CdY+vaFG91XFb0hec3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629842832, "uuid": "21975507-2694-4687-84a3-acbbfad2df5e", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629842832, "uuid": "817f557b-91ec-4204-a164-889283a6ece9", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842832, "uuid": "29beabc0-76e5-4abf-9601-5b769c43fc0c", "value": "SecuriteInfo.com.P98M.Downloader.12.15755.8813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab880ffe-0470-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629764250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764250, "uuid": "99582522-369e-468c-a643-f0a53488deba", "comment": "Malware payload (AgentTesla)", "value": "ffcc5b706b0b93377f48dddcdf313f58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764250, "uuid": "96c087af-534f-451c-b9f8-dda895cac0e7", "comment": "Malware payload (AgentTesla)", "value": "6488830ea72cbcf3cb394e786d5102c8a6cfb5025c40e63fc537e323322f9a4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764250, "uuid": "5759bbdd-e7dc-456a-a42b-38ab14c2eb90", "comment": "Malware payload (AgentTesla)", "value": "2553a80823041e8000de3cb22da2977d37a8ae90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764250, "uuid": "3dac2c99-303f-4f7c-baad-08dfc80a8dcf", "comment": "Malware payload (AgentTesla)", "value": "4a4f4ed12cb7fbd8f6219ed2d06a6dbd4cc67d2f377d52f6a045ace87c4f08defe45f960105f293203f38d5d7f972d2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764250, "uuid": "51629abe-a1ef-45ba-9731-6a8bfa7d8d14", "value": "T13EE48E817A9C529BF53AD5B37E4BC23112BA19CFE0E0C209B942E33E5476331594FA5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764250, "uuid": "f51ddd53-aa7e-4566-a3d3-dd7b6cc6db12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764250, "uuid": "9fc127f4-c651-41f6-b8ab-0d4e695cdc42", "value": "12288:0MFKZgviW5mkjPsJ5KJgWX7207rXd/HnVdeoaXBkzUuuL/bE3:0gviWzPszKDK0d/HhaRUUHLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629764250, "uuid": "ba55b54a-a33d-453c-92d5-5956ead7f187", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629764250, "uuid": "5b695cfc-1351-497a-8a4e-3aa8653d30f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764250, "uuid": "124dc587-88e4-4b6a-aa70-22263f0f9575", "value": "CTM USD 96,800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076c031f-0496-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629780295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780295, "uuid": "ce4fe658-4f87-4d87-b794-82f399b222ba", "comment": "Malware payload (RedLineStealer)", "value": "310fc892fa9cf3e0677a70b8ea8951ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780295, "uuid": "e9bebd5e-54a6-4871-a360-a8e7414e3b37", "comment": "Malware payload (RedLineStealer)", "value": "64eb44d654d183e8f4736bd96c1b487e0f7b39243fe1016fe5d108b6c3f98bad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780295, "uuid": "11d8d68f-60ca-4b13-86c6-91c0efe42f57", "comment": "Malware payload (RedLineStealer)", "value": "6cb3e814e46153e8deb01a5d1699c34b58e90b1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780295, "uuid": "4c76c675-1944-4978-b526-91bff1848808", "comment": "Malware payload (RedLineStealer)", "value": "65e40eac54f5f178f41f4d3ca8c01d20b67a050757fa6ccec83760aa8fa2f6cb55be63f8b1df891f0a99622ac299a6e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780295, "uuid": "2860cb2b-b26f-42b0-b475-bdf59030c103", "value": "T1FCD4F030BBA1C035F1B651F845B6C2BCB83A7AB16B3554CB92E116EE46387E5AC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780295, "uuid": "cecd64ea-41b3-45af-9c8b-2e99a9e26d57", "value": "9d905009ce289bf09ec9a9fc544fc23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780295, "uuid": "b9428127-52fb-4371-ab9a-209c2ae99839", "value": "12288:3+sOOD2fc1od7jYPo60mjr31JBrE+BDPwWbaBGSAW6uuaWlxMim7yARnkilEAkzj:fD2ffs0mjrFLrE40W2ebxhmGQk204YNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629780295, "uuid": "0d6ecc04-558b-4e20-97f9-252436c73caa", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629780295, "uuid": "18add101-9e4d-4db7-b094-9bdf23d083d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780295, "uuid": "a01dd2c8-7107-44e9-9f8d-b54406ac45f8", "value": "310fc892fa9cf3e0677a70b8ea8951ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69517e20-046e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629763280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763280, "uuid": "3256fc44-adce-4b18-9641-8cabef15b1b1", "comment": "Malware payload (RaccoonStealer)", "value": "b815e9660d05b37f07cb084c051577ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763280, "uuid": "97c1a87b-108d-41c0-b270-261771742ee9", "comment": "Malware payload (RaccoonStealer)", "value": "659054eed025866186a4bc0053730c5a1c0bba695dc019fa558b29d018e9d055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763280, "uuid": "952afe70-f2aa-446a-b58f-d523ed0c55c8", "comment": "Malware payload (RaccoonStealer)", "value": "d9d387e9b506a51a7e950ecb8ed5e1b5729fe487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763280, "uuid": "e0596935-4d4f-40cf-a217-2dbd7de3f2e5", "comment": "Malware payload (RaccoonStealer)", "value": "62ba53dae358aca0203b6615ec301fb696a3483f691b568d4e98d96dbb83d1b047e7b00da0f74f1cc6c4ff13308c59b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763280, "uuid": "d9fa5a94-52c4-4383-a2c7-f0fef28c5272", "value": "T116B4D030AA91C034E1F712F845BA83ACA93A7AB15B3490CF52D51AED16387E9FC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763280, "uuid": "7cfb1c72-5a78-4bba-acbb-2ee9f8af16a6", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763280, "uuid": "dfe133e2-c84d-4b40-a90f-59d5b44a6564", "value": "12288:SeGImKPhhwZ9OKwzD/TtLFjOwKWpOZvqYfHk2w8j0V2SerT0YDSn:Xhhwk/TtLQW8ZFfE2c0p/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629763280, "uuid": "ecd6137c-d1a3-45f0-84b5-bbffd7b83a5c", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629763280, "uuid": "c6cc2e68-14b8-4b0f-a251-2c2bb07e21a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763280, "uuid": "baa1feb7-6e96-495a-bf5f-1a693c679a65", "value": "b815e9660d05b37f07cb084c051577ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb17dd5a-04e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629814607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814607, "uuid": "8c04efd5-46ef-4663-a1e4-a6a26a1faa1a", "comment": "Malware payload (AgentTesla)", "value": "65ace95d7f6adbdac3762f47771b6d9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814607, "uuid": "c3816afe-cdd3-4206-ac23-fe9d720f4e6f", "comment": "Malware payload (AgentTesla)", "value": "664b941eed9ef562426f2e8282aaaf429a160f838020686eb6b10eafc882cd2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814607, "uuid": "35c29eaf-4f7a-4931-b8a9-93da8a78192e", "comment": "Malware payload (AgentTesla)", "value": "b428c333706a8f932f6b4f873b726fa814f968f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814607, "uuid": "f7708617-48c2-48f4-8e1d-6bac117b3f05", "comment": "Malware payload (AgentTesla)", "value": "0525feba4e2feed3eae89ba7491e2cc5f990be4e473a1bc1f2249bad9e681d7ca3812f7f516238dcc1316a92c5f3102e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814607, "uuid": "30f6ba27-e46a-4f22-b346-e8d56815cfa1", "value": "T1D2B48C043B98A92BF034E5379757913242B20ADBE4D2D754DD40E37E7E313B0AE4AA5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814607, "uuid": "27392faf-5396-438a-8c1b-d955667fab95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814607, "uuid": "d88ecbf1-4896-4636-af4d-ac6bb50c4839", "value": "12288:tYhCV7nQlXvJm3uqB5yhgwNlnlQCkX1k:3nQdvKuq/wNpA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629814607, "uuid": "86b05ae2-141a-4f0c-a672-d38f7326abfd", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629814607, "uuid": "3bdc43d4-da51-4503-a3b0-a5b905a47d19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814607, "uuid": "5ab06f62-e339-453f-b5d1-e02a1e9667c6", "value": "AfkpWnWcMRI7ydB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18046a5-0478-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629767776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629767776, "uuid": "e0655bc9-7d0f-4a3d-aa87-cf516a85a7ae", "comment": "Malware payload (NanoCore)", "value": "87bbd2771b899230125379caf2c7f037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629767776, "uuid": "e2620b9e-5b88-455c-9ed9-70d30d412ba9", "comment": "Malware payload (NanoCore)", "value": "667766b63d76d01fb9e9dbbf7b0fb7e74b5b2eb46411c6aee11e56347d1742ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629767776, "uuid": "7ccb48f8-bc78-4b39-a3e0-97cdc54b176c", "comment": "Malware payload (NanoCore)", "value": "e583fbaf8d7759b2bf11d7d39bc9ae42c70187ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629767776, "uuid": "bf7712e9-0fa4-4d0c-b959-fefd92599988", "comment": "Malware payload (NanoCore)", "value": "bae512dfc2267b247a3bdfe8cfeadb7add3c3bceb8ae6f1ed99ad6602ee8e9f6f4889f4a518a2723adcfc09cf18d1602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629767776, "uuid": "9dca9b6f-5d6f-40c8-ad6a-8e2c88c77d28", "value": "T1CD241269DAF691BFC40643B58D50A9A3F58F1CB193838ED6A385388ECDBED119231172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629767776, "uuid": "db19d96b-6256-4c03-8803-54eb3cf53d99", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629767776, "uuid": "04eefaa5-e7e8-4315-8a29-e789cc296331", "value": "3072:HL09OLrkcCAMl1/odvW2wjJAhAxXXP6RMCRaZoUjpeDthruSO/7sqFxT62LJpprF:g5A+wdv4jmhScQaUSzspzdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629767776, "uuid": "939af7fe-a93c-442f-bfdd-a8763542c227", "value": 220926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629767776, "uuid": "d77679ef-8667-48a1-997e-ce1532bc252b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629767776, "uuid": "19d301e5-21af-41a8-9a6a-e9887d9041bf", "value": "Delivery status - Failed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f006ff-04d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629807750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807750, "uuid": "a163ed2e-afbf-4d65-8fa3-5b724ee7d7a2", "comment": "Malware payload (DanaBot)", "value": "ccc8a65d24b48b980ccb86482d5e364f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807750, "uuid": "f297d8c4-33d1-46d5-8c34-b099ce7d2f86", "comment": "Malware payload (DanaBot)", "value": "66e12cf607f737464145d65eac50070d62982266c3ca8843142384765fec91bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807750, "uuid": "a1f6a7ad-b57c-4232-8917-46362c37c1b7", "comment": "Malware payload (DanaBot)", "value": "0853c337aea321d4650e5afaa46b018f0e2dd6e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807750, "uuid": "c825305a-b6f6-49a6-a8c1-f1bcb5a620e4", "comment": "Malware payload (DanaBot)", "value": "a0301271ee647239c8c3593b3d28de5ac5002421cb7fa41a458738e80dcf8b8e8b6cee0ba40267794994357659952582", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807750, "uuid": "710a2ce4-d15e-431b-9874-55b383bd153b", "value": "T14E352317EEB999B9E2D345B005BC4B00CDBEFD661E74DE2B4710BD8E3A71660C821993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807750, "uuid": "1659755f-b56f-48cf-ac21-8cef4779edff", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807750, "uuid": "44c6a4f4-929d-43c8-9054-374143859846", "value": "24576:bR1ZM17ZYqRbXhp2PQlKntfwcNlufvFobyTCl7OizYGB8jGUmIVO:l1ZipT6QlwPruFyI85zYGOaUmIVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629807750, "uuid": "4ce99043-fb67-46f9-a5d0-2eae1fe8a928", "value": 1061003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629807750, "uuid": "1cb35383-8ffb-424e-85de-75f8383ffef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807750, "uuid": "270f68b8-e273-4d4e-8401-2cbdd88ee03b", "value": "ccc8a65d24b48b980ccb86482d5e364f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21629e85-047f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629770460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770460, "uuid": "e66d02a8-b176-4bc5-97f1-7aebf3d03dd0", "comment": "Malware payload (RaccoonStealer)", "value": "22969623be1f678d39ab1df708469407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770460, "uuid": "9c992f3c-5ccc-46ae-872e-d4a8bc0a0486", "comment": "Malware payload (RaccoonStealer)", "value": "67c798fa66f431640bbe46c525ac2de543a2c2e7b6cc59e5967d8bc5d37b01cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770460, "uuid": "40cae189-d332-4a05-882f-747586216c60", "comment": "Malware payload (RaccoonStealer)", "value": "fe7aaf6f961e693880721dd05dfdff8fb2e0fa59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770460, "uuid": "8259512f-1950-4b2f-b563-69628d2f11a7", "comment": "Malware payload (RaccoonStealer)", "value": "41c9c3cf18570b6f73a3976110b6746e03535719497071cacb1a59bec8bde6f9ecc78b596ff27586ad81194834fdc849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770460, "uuid": "0e5199e1-e812-4cc5-8fe7-5784065322f3", "value": "T134941200F791C032C196A4758CD9DA61E727FDA46A6593473BD83B9E3E7078077223AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770460, "uuid": "8253ec1a-5f94-4b48-9a74-62c356cf40f5", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770460, "uuid": "cc308953-e97b-4359-9bcb-137ed0eec558", "value": "6144:5y9wpA9az+lm+y+BtQbrk0cGXfKSa/DIH55DEJqMTuFcb6wUM9n7TyaHbG4o:5y9Oz+lrjQH1Xs/DIZ52n7NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629770460, "uuid": "4bc45e65-2775-44d1-b4d5-223f68eb63c7", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629770460, "uuid": "fc2a6c94-bc52-48c1-b53e-3304bee0c06d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770460, "uuid": "a9062289-1dea-4b09-bf03-36b4172f6e65", "value": "22969623be1f678d39ab1df708469407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d88a951-04ac-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629789969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789969, "uuid": "54c4ad78-a25b-4a91-8509-90bbd799069c", "comment": "Malware payload (RaccoonStealer)", "value": "eb7b5911cfc0a95a5066f39ed22aee0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789969, "uuid": "50a11eba-3740-46f1-8850-818dce69ded2", "comment": "Malware payload (RaccoonStealer)", "value": "67ebaa4e613b155a8584614552de369a48d854f8b38e9c6f6319d71f287ea0f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789969, "uuid": "299bbab3-fd8c-41c3-931e-8ff4f706a5e6", "comment": "Malware payload (RaccoonStealer)", "value": "afadeda0c47ebf866bc55fc6b78d69d475d5f333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789969, "uuid": "bb4c86ca-b3b2-42a3-bd9c-b7cca9047b38", "comment": "Malware payload (RaccoonStealer)", "value": "ae9d7735ab9c2f42accd8c4fe1634fe7480f6aef70963929d3d41bc488bebb07cd898a92236e228527c2d10cb2970a9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789969, "uuid": "f3127af8-56e8-47c5-9fd4-76ddb8382368", "value": "T194E3BE107590C473C0715D3149D6C6A0EA7FBC63AE618947FBD8276E2E712D0BB2A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789969, "uuid": "5e9f6977-7ffd-4e4e-b131-fe1dd2652e24", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789969, "uuid": "d5256884-3a61-4e2a-a18d-dc2bfc7656d8", "value": "1536:Bey+wOZJm7ekxQG/UGbikmE7befYGwGYO49UDP95w9ZV8lP2JATEL+hItC3nf:2m7UVGeHfYGmO9P95weP2JQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629789969, "uuid": "e67bd945-ef63-49d6-bf75-3ce5e5316154", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629789969, "uuid": "e7070375-a46b-4b40-845c-3b9973206db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789969, "uuid": "3b485d08-bbb7-41f9-ae2d-1835defbd50a", "value": "eb7b5911cfc0a95a5066f39ed22aee0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9918ff7-04a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629787117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787117, "uuid": "fa77d564-258f-47ea-b771-6327cd1e1d70", "comment": "Malware payload (Smoke Loader)", "value": "0102055c5fbd724bf28bc696ca22f06d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787117, "uuid": "011710db-02ee-4596-baaf-abf7f928c05f", "comment": "Malware payload (Smoke Loader)", "value": "682ef52e3ab62fc62e75477915bf98a8da2ef787676c0d9dfb05de1875195885", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787117, "uuid": "b9c35e51-69c7-4792-95c6-a6c1f478f76d", "comment": "Malware payload (Smoke Loader)", "value": "254c0c655937c98d415cd67097824d5b0c381329", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787117, "uuid": "2930f26f-294a-4f80-8bfb-040bada9471b", "comment": "Malware payload (Smoke Loader)", "value": "9fa684f86ef5a9870ba9f04aeba2a59922c5db344a9cde3deb444be5e2dfc7484c6d39330798269d12b827a86f9cd11d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787117, "uuid": "6ef6a4c9-10d2-4be9-ab27-d04afa48cde8", "value": "T1A3E3BE0139D0C5B6CD51817048F5CAB0D6BBFC62AE7156073BD8E65E2F613E0772A3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787117, "uuid": "2e4fd81d-e9d5-49ff-8511-9d6579ec9299", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787117, "uuid": "087c87fd-392c-46a8-a214-02127718bb02", "value": "1536:2huZ3/M/yYQ7kAglqRi6awWjs/5jnkx5EaUGSJATEL+hItC3nf:prYQZawCs/Nnkx5EadSJQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787117, "uuid": "6c92277f-f876-4a36-b157-88c89f77d418", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787117, "uuid": "8767af08-2bda-4a1e-bc8f-8da3753deba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787117, "uuid": "dae3772f-bd22-4ebc-97e3-ba46e5d60491", "value": "0102055c5fbd724bf28bc696ca22f06d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526a7d9b-050c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629831102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831102, "uuid": "ca1c8091-0502-4968-b5c6-0d26e388061b", "comment": "Malware payload (CoinMiner)", "value": "8584500ae44d83f7f92f865e0e3631aa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831102, "uuid": "7117fb69-c55b-4375-bc62-15a9f5d5e6f2", "comment": "Malware payload (CoinMiner)", "value": "68e731d3431bc9223c2ff57b2d319194c4a6b8027e15c75f16b841bc78499172", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831102, "uuid": "1149053d-8b0b-4ee6-b63c-0fa910360b14", "comment": "Malware payload (CoinMiner)", "value": "e8f64a1c0546ad1393ca26aceb887a72d7d9f46b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831102, "uuid": "b8b7eee6-6c6b-418d-a470-360cb50cc19a", "comment": "Malware payload (CoinMiner)", "value": "b7bc454a9f399b8a7fa969a83f3186e18b5a48a854ba27a9e7d7f474a280052a40bdbbc91ab0be9491af3440ee40f49d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831102, "uuid": "e7a1efb4-f192-49df-8a13-27318c34d127", "value": "T129547E207691C035E0B613F558B683B8AB2CBDB19B2050DF62D637EE67382D49D7076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831102, "uuid": "c1e59f64-f00c-45fb-9316-51ba2aedebd4", "value": "8a6418b2bb39e9edb3ac9aabaf7ba016", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831102, "uuid": "c936761f-dedc-47bb-a40f-eaf807bc58d8", "value": "6144:gGTdJB4mWzVMFrOaTVPJrLWysOOgbM3c:xv4V5MFzTVPR+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629831102, "uuid": "9d2ad7ce-0d95-4046-a74d-f5017828184f", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629831102, "uuid": "990fdebc-9a4a-4e62-8852-113ccebf3574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831102, "uuid": "58956de0-31ad-4a36-8976-1aca980d0f30", "value": "8584500ae44d83f7f92f865e0e3631aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fe7ec2-04b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629794597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794597, "uuid": "a12ee4e2-8382-4b2b-918b-1058a4234715", "comment": "Malware payload (Formbook)", "value": "5c4854e07591e1fc7daf8fa3de192075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794597, "uuid": "99715fc9-01eb-487f-9a7c-4c88b566ed5d", "comment": "Malware payload (Formbook)", "value": "690e0f94302aa853194cf182b4abc2f35d1ca8a81125ee64512c54a304a1431b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794597, "uuid": "0d8313f9-521f-4523-8143-044f223565d2", "comment": "Malware payload (Formbook)", "value": "6aa3b3c6fbf10243b900df9e9e30193c2b07e227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794597, "uuid": "54865691-29b3-4908-8d04-21d8aad94076", "comment": "Malware payload (Formbook)", "value": "4d5783d53bd1b17b1f4f6d47115442cd80507439fbd2e65fe3b273a2b284b69f245514b75316d5f7066c6ffad4904a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794597, "uuid": "a68b8508-daa6-45c9-aba3-d89a59a403d8", "value": "T1EC256B206B89C1D4EC5A8AF415ACB79402F33DEFF6C4CD6916D9320C8F7A9C1AA07657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794597, "uuid": "c8cdb7cb-17f9-47db-85b7-846a4da21ffb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794597, "uuid": "7381d223-080d-43c6-9974-6dcd73da96ee", "value": "12288:+IcsGI/cRlp9HANZttGG9PGEzWDcdcNk+1+XSn11qoVDYWhSJ8FNhjQP+z2EObb2:+dDHs/r9PGgsS47+X81QUSSlQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629794597, "uuid": "b606001b-a47f-4773-9330-90eb3c8dc8a7", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629794597, "uuid": "8fa57f20-a01c-4ff1-bae8-85bb807d8523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794597, "uuid": "a06cefe0-d777-45ee-b6fc-76a68dac4200", "value": "BANESTO_Swift_eStatement_Mx0917b16_24-08-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c31bf21-04a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629785484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785484, "uuid": "b25468c9-4a06-4244-a73d-a62341867add", "comment": "Malware payload (Vjw0rm)", "value": "7371063acbfacc81ffdeaeea7e75eb99", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785484, "uuid": "44c84ef5-10c2-487f-98dc-85a94ec197b1", "comment": "Malware payload (Vjw0rm)", "value": "6915f06eb48cc9d71dbc136313c6a935b36844641f9b2ae1e85e08ccc74d8e73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785484, "uuid": "e2d003d0-525d-41d9-baa2-78b9d5cce44a", "comment": "Malware payload (Vjw0rm)", "value": "28ee63662467f1ab7c682eec227b66db7ccadeca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785484, "uuid": "2e9d4c73-770d-4e77-a8cd-7ff1153f5411", "comment": "Malware payload (Vjw0rm)", "value": "0668c97f7db7fa5982f0ab84ad8321cf6d0648503210aa151a88082a1a770f7e5ae28287a43b31527f4ab9d465a06023", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785484, "uuid": "2efc25a4-4ea3-42ff-b71e-125111e5c2d7", "value": "T1F614AE8918C029C98538D72750B7397817B0C856A8CA2DE8BC2D7F3F4FF6B88E549657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785484, "uuid": "db56357c-5310-49a1-8a69-b6724f5b473d", "value": "3072:g4XSfd1uBfPamtsz6VVKDllWtfjKNan1a4Bbn8PUyBJAN:ofPK1fVaWhONi1J78PMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785484, "uuid": "83a30bcc-6c60-4ca9-8066-ba7c0a104d6b", "value": 205934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785484, "uuid": "4a06a341-b6e3-4cc3-b52f-cf819ad32230", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785484, "uuid": "aeda9a1d-c157-4621-8330-66ffedbe3a83", "value": "Payment proof.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad97affd-0514-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629834691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834691, "uuid": "eb6fc142-edde-4f55-ada0-47eba558ca06", "comment": "Malware payload (RaccoonStealer)", "value": "228a5335d126e6480fb3106fa04f3483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834691, "uuid": "3997d389-3b02-4970-a7fc-4c25345fe9e1", "comment": "Malware payload (RaccoonStealer)", "value": "6977a2df32c4fc8b2db35f556fda16abfd724e1c72df6a145589a2158374444a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834691, "uuid": "90dc3f42-7606-43f5-9df2-00a47aae6cd4", "comment": "Malware payload (RaccoonStealer)", "value": "90356734444bf7bdeeadefb4c6d6f1b3779710f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629834691, "uuid": "6278e0cc-8a14-47e9-b983-5fa7fcb24055", "comment": "Malware payload (RaccoonStealer)", "value": "9893a9c4ccdf78afc6fdab058b22cba884138d9fedf77df44a5c793c7636d5ac1a1735dd5891c6222c055ea6da565ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834691, "uuid": "924bde5a-be20-47a6-8040-d5693f7d5087", "value": "T152A402427260C433C1A105728CC2D761FA3A79E69E26864237EDDF7F6E712C07B1A396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834691, "uuid": "c53d6862-f1d3-40bf-bc3b-d5b95da8c74e", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834691, "uuid": "7f01edce-2ef5-4fc2-8332-086a74f50b3b", "value": "6144:OV6hzlYoCRzn7swfmStzXxRDpdmW+aoZuao9KZxAo5jUPfBYghaPEK5ouSk2R8bj:OtRbDfhRDpH+as2IZyo5IGP75vSmEcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629834691, "uuid": "38e646c7-12ba-4e53-a4f1-765b912050e4", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629834691, "uuid": "580971e1-73b2-4b8e-9782-1fabf33add77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629834691, "uuid": "f4960976-41fb-4c2d-9d93-90d0f2753c5e", "value": "228a5335d126e6480fb3106fa04f3483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644b60e7-04a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629785605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785605, "uuid": "e4bdb48c-e67d-47f3-aaf9-56b4d240576e", "comment": "Malware payload (a310Logger)", "value": "54fd4c25a6a9bfa5f54a6b77fb1a8de3", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785605, "uuid": "4f18d6d2-591f-4fb8-923b-b47c0ebf9183", "comment": "Malware payload (a310Logger)", "value": "6b747506cd4c9f9807084784cc5c67b5b134258c059d8089c6406e3585db5275", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785605, "uuid": "e9041242-be23-42fb-a038-6583477146b1", "comment": "Malware payload (a310Logger)", "value": "3ef6347026b0269bffa572f41a0c8f666d5ab5c1", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785605, "uuid": "ac1fc2a2-96f5-4b0a-a51b-e86129f73468", "comment": "Malware payload (a310Logger)", "value": "98334c0486d01d041ead3bf89239603531b9cbb868b3409770bc65bbf54fb25aa5293b3f0468a2869a5c448d55b8eadc", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785605, "uuid": "5478ee15-83ad-419a-b79f-96cbf1ff8ef5", "value": "T17BB57483EA3AFD27F96C38F5D888D9A12C0D7D650AE3747239BAF76E94335115B00192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785605, "uuid": "ee170684-1aba-4df3-80db-10a06cea9395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785605, "uuid": "4193431a-3ee5-44b5-a327-eb640da5c920", "value": "24576:6K1ZYe0/8W5p9NIaP7jefuYXeT7IPulgxXN/odo:PB00kpgaPaDpPulgxO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785605, "uuid": "8eb49cc0-15a5-43e3-b6b1-9402652b80f7", "value": 2439168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785605, "uuid": "6aaf40b0-0e9d-420a-b011-ee36e95cabdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785605, "uuid": "ce04840c-a256-4ed1-9075-0fa376e0cee1", "value": "QTL_0060460780112IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b0eae9-04a1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629785419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785419, "uuid": "b786a6bc-57e1-457f-95bc-a14238195714", "comment": "Malware payload (RaccoonStealer)", "value": "b577489c8ecf79a275b748995f35f51d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785419, "uuid": "fdccb360-7041-4f8c-a8a2-879c730d7e4d", "comment": "Malware payload (RaccoonStealer)", "value": "6b816f1e3cf9ce01d809738d838f2d8817125b9ef1f2f853dfd8f74209590f15", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785419, "uuid": "f973140a-9c64-4a58-9572-7b4c87f7bd5a", "comment": "Malware payload (RaccoonStealer)", "value": "6e606fef28425725bf4eab22818e88fae5817b99", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785419, "uuid": "cfb8bd9f-c1dc-4179-bcdc-b50308f01390", "comment": "Malware payload (RaccoonStealer)", "value": "faa1303e40d83782560b080382d3bc1e80a6cbc4f75a50710a80d6e1db887fe62e365e39295c62a28216f8b6084367da", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785419, "uuid": "7e296f89-fd37-45bd-8396-9860c834d57b", "value": "T13A04C2BCC49702A48F816BB46B2B6F4A025DBA6DF755E53332AC273417D1C7A901787C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785419, "uuid": "1833af4b-369e-451a-b311-98a3562e6a49", "value": "384:UTIViW+0EXSRE7WjS33Q0yktZafCl1Z/I7RkZKDk7hGJoYt/m0T2mFA:g0bR2klfCl1q+KsmTFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785419, "uuid": "d0fb6503-7e81-4585-81fd-5286d8fec6ea", "value": 183320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785419, "uuid": "6aaf4e36-c3fc-456b-ac26-db4759997add", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785419, "uuid": "0a2d297f-c9ea-4957-87b1-6ac1e7427abe", "value": "usd27,400.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15940be7-04b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629793633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793633, "uuid": "fef3f21f-3cb8-4ba2-9aef-4a29b22371f3", "comment": "Malware payload", "value": "bb5f60bd8898283b273e0664a4dd6875", "object_relation": "md5", "Tag": [ { "name": "CookieNAS", "colour": "#55608A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793633, "uuid": "52d53c80-1c01-4b8e-9e21-8f19bb86f6f1", "comment": "Malware payload", "value": "6d4b1031747308c41fc259009bda24ff434cf0efdcbbf256bf7121b8f8c28bab", "object_relation": "sha256", "Tag": [ { "name": "CookieNAS", "colour": "#55608A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793633, "uuid": "6267799c-eedb-49e6-a43f-3c5460900b63", "comment": "Malware payload", "value": "57a323e796842e94ccacf01e5920c872b8facd0e", "object_relation": "sha1", "Tag": [ { "name": "CookieNAS", "colour": "#55608A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629793633, "uuid": "7354dc05-d925-4132-92ac-d253488565ee", "comment": "Malware payload", "value": "ef311cc0047381d7ec1031fc0f962d86af3de81b287bdbfdc21b12180b7d41250e4c783e177b6be28ae60059af483fba", "object_relation": "sha3-384", "Tag": [ { "name": "CookieNAS", "colour": "#55608A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793633, "uuid": "9e5e33a2-6a76-4b35-be9e-1d7cce3e25ab", "value": "T1484512207BC481B1D2731A350AFAA770A97DBD741B654EDEA3983E6D4F300C17629B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793633, "uuid": "06516e4a-f295-478b-a966-d16e2415b362", "value": "c127345c03c7eb109783c6cc61e16834", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793633, "uuid": "ea4972b0-6d48-4035-bb99-a3f2d60a1d9a", "value": "24576:XvgiTlHXPiG9PGMMohC0Tv6YysjzRkziTetdHi:UG9PgohCIyYys2iTetdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629793633, "uuid": "9c548f43-a84a-40bf-b57c-baf33f09f4aa", "value": 1235738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629793633, "uuid": "c3248d5d-ae3a-497b-a4b0-29492d99c445", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629793633, "uuid": "6d01dda3-23f1-4819-863e-508fb5853d8d", "value": "mixshop_20210824-024418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301f84e3-04f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629822025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822025, "uuid": "9c7e700b-8a66-41ba-9de1-08a0a543864e", "comment": "Malware payload (RedLineStealer)", "value": "213b4d4a3fa8742fd83229a8be042bb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822025, "uuid": "8f36c12c-c44c-4329-b51e-ccce7035e729", "comment": "Malware payload (RedLineStealer)", "value": "6e67e541d5801d97cb6fc3ec483b7b9dc302506c0f3a1ef0942ea3f7126e9e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822025, "uuid": "5c181e0f-9338-4641-aa85-44c97b7208f7", "comment": "Malware payload (RedLineStealer)", "value": "22a20207263c5f6aea6e2174fb4544714ddf4a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822025, "uuid": "e2fabd1e-0608-43f3-86bd-ea0e52510c3e", "comment": "Malware payload (RedLineStealer)", "value": "9ba39b62e6d156bf6c8ed679011c0ec23255490abf739021acd114d26d919dd50646d3c7b33e2c0b0babe2e7132ab94f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822025, "uuid": "b6d1e65f-73d3-495e-8340-d20a5d9e259e", "value": "T1AA26339BBAC6F3F7E1BB02770563198409ED841BA2F5A70F2C502E8DD5EE617070365A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822025, "uuid": "da7d7696-f717-4080-8539-e42c3fc29b1d", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822025, "uuid": "09bad15a-4d98-4622-bd89-778d92f21174", "value": "98304:yg14WrmAN+0luBsjjvyYc2duACqtp3K57aPkxAS3u6ItmYD:yRvAN+lsPvyYc2t5tFaaPeHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629822025, "uuid": "a0fd37fe-9ef8-45f3-bcce-258eea99558e", "value": 4480169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629822025, "uuid": "92278ef8-08a6-4272-aa20-fdd1db3cb78d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822025, "uuid": "30657608-fe03-43cb-9d83-cdbfbd012b95", "value": "213B4D4A3FA8742FD83229A8BE042BB9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e66e87-04d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629806405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806405, "uuid": "8d0c0029-e54b-43ec-b486-f3e7f171f22c", "comment": "Malware payload (Mirai)", "value": "ebd942c610d0b2548efffa3f5a980f51", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806405, "uuid": "ea1c5f8f-344e-4929-a1ba-b487ae90345b", "comment": "Malware payload (Mirai)", "value": "6eb0cc82165ba03de6b7896e799997090eccbedd0f1c5818208ddc1d84697137", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806405, "uuid": "933f9273-3f76-4cc7-a914-5755bde26668", "comment": "Malware payload (Mirai)", "value": "3cc43a39b2fec0a0f85959109aa27dffdb4b5940", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806405, "uuid": "5f80d5eb-d16c-4620-be7e-dcd90fae53c4", "comment": "Malware payload (Mirai)", "value": "e593bb20d9b2bcfd55127c018c5bdb27071c887b4e82b54fa2f31b6d2b75b6efb63fa53f59c20b9541ee58317ea49c8a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806405, "uuid": "29c98e2d-6c61-4838-8c78-529c78e1b738", "value": "T19BD31A46E7808F07C0D62B7ABADF425533239B64D39723069528BFF43F837AA4E66505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806405, "uuid": "489fbf77-5bbb-45a5-93f4-e8c986f27df0", "value": "3072:tdPiTKTaXhJG0e3hCn2qaJYGm4asD2IZM/9GXYXCmjwzLjysuV:tMKTaXhJGL3Yn2qahIsD2mM/9GXYXCmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629806405, "uuid": "7064d41d-db83-4980-ade3-3fad6f0ca509", "value": 142679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629806405, "uuid": "e4db5689-49c8-44bb-8694-521509c7d78c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806405, "uuid": "f8d51361-12c0-4cb8-9a05-4ac83aa570a4", "value": "peach.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836379f1-04a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629786087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786087, "uuid": "2f27ac45-34e6-46e0-917c-5c88954e4525", "comment": "Malware payload (AgentTesla)", "value": "b11cb891e37c89352d3098f97da8993d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786087, "uuid": "edacfe68-de6f-4d9f-b6a7-1e8c66421692", "comment": "Malware payload (AgentTesla)", "value": "708f2705669a4a5bc823f5aa9f429471d7f1b0aae0cf82a94ccb74380dc9db5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786087, "uuid": "a2bed628-afe0-4808-89e4-134cbcd0ae5c", "comment": "Malware payload (AgentTesla)", "value": "9bb79ee4c55d39b5ad9625ef28d1cb4920572152", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786087, "uuid": "72f5ad35-5a29-4fd8-85c9-dd3810b04f24", "comment": "Malware payload (AgentTesla)", "value": "b05ac183ca8e2738fcb0f8d7f7499c927e1305f19738baebd6e754f259c0e1257865ae256bcd79f0f74c954323ea41af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786087, "uuid": "412d1b8d-4521-4d8c-9c1b-227476ccd95f", "value": "T15FD46B9C7650B5EFC867C872CEA81C64EA6074BB930BD203A05716ADAE0D59BCF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786087, "uuid": "59070a01-72ed-4848-a079-e6461e430dc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786087, "uuid": "9720e28b-9b3a-4e76-8bdf-1eccffe059a2", "value": "12288:PRX4+E+eG8iIcxs+S/2nX57WHeWHOfOaK1lOLFM/0f3S09PbtunPnXbuCAiyNvan:Ph4QeSxs+S6XBTWuWaK1gN+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786087, "uuid": "b316ea7c-5055-4ce0-b5fd-316e109bb229", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786087, "uuid": "2d720b13-7896-416f-9371-54826692ffa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786087, "uuid": "a0950a19-b428-4133-86dd-8e8435c1597d", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30347c3a-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629805704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805704, "uuid": "eaf65557-f45a-48a3-9056-50b8b211672b", "comment": "Malware payload (RemcosRAT)", "value": "b453ffb3d28577a4549195c3f757db4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805704, "uuid": "fc27b0ed-74a1-415d-9074-0da0020502e2", "comment": "Malware payload (RemcosRAT)", "value": "70921226f4c6dd8d21672150cc0115b107c395f848aa89975ed3bb42c7eccd69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805704, "uuid": "0c6395b3-55f1-489a-a0f0-454d7f2159d8", "comment": "Malware payload (RemcosRAT)", "value": "a532fdb05b0cac9b0816fd187cb8ebdc6cf7bf67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805704, "uuid": "cb6b22e1-57c1-45fa-b218-f2a3f27ae550", "comment": "Malware payload (RemcosRAT)", "value": "23d3189a826df35589dfa227d2b2e9a78857120197726730f81f67734aa9112216aaac2b335c90f45638ef4549a1a254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805704, "uuid": "708350b3-348a-4545-b126-87dae854454a", "value": "T1CCC3A3D3AB622824D3B63C70E867ADC113169F015DC7473F21CFDAAB25A1792A5C734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805704, "uuid": "f9b6e406-e6e1-41d6-b72b-7f2e7caa212f", "value": "c65aff2bab39ef464a2bad0c06b18bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805704, "uuid": "581dd8c0-f994-4b60-a6c1-04fbea7cc565", "value": "1536:Zq+v7gDF/7Z2P1I+LRZ5JX+Up93D82iEOX2CXJr8ethrJc/DVyy83XeEYf6B:Zq2gD57Z2P+q8w8JFZ7hrJ0V6Ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805704, "uuid": "a0a1d0dd-be39-47f1-bca9-f121e0835442", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805704, "uuid": "cca4fcd5-e662-497e-a89c-9c18940a2333", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805704, "uuid": "2a3a4cc5-686a-4ece-af49-008da374c8ce", "value": "b453ffb3d28577a4549195c3f757db4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af61f906-04a0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629784872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784872, "uuid": "1f182030-02bb-45c8-8756-5b680a2eacdf", "comment": "Malware payload (RaccoonStealer)", "value": "cbbac2273a64f48a8d804df3b591b4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784872, "uuid": "6f7456cf-d1a5-4546-af67-4cae30a89209", "comment": "Malware payload (RaccoonStealer)", "value": "70a7ea01f9b72bce12827971f0208c90d631535ba2d96286a67cacf6e62a13cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784872, "uuid": "e987ab95-23e3-49b5-b35a-d9d19d9f0845", "comment": "Malware payload (RaccoonStealer)", "value": "4eb56ea5d2667ca37bb94439d6a9e38c0468b702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784872, "uuid": "503a6d26-67c6-4095-86c9-585ec619ae0e", "comment": "Malware payload (RaccoonStealer)", "value": "adfbebfa9100098e9fc09b5c6cbab74dd8aa5512e8f70df54265c9275afa2730feeb4bf063a621e5404a0bd94b13897c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784872, "uuid": "266e8b75-c94c-48a0-bd7b-a31ec55e3aa4", "value": "T13E941221B791C432C85245F04CD6C250EA6BBD51AFA4BD47BFD81AAE1F613E1BB23163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784872, "uuid": "d9517ed5-e914-4198-ad15-5f198814cbf9", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784872, "uuid": "2e4968f8-f361-435c-a14e-5ea81f368cb5", "value": "6144:OYNrvx9YZRyq4gWxx27E2mm6vqxO+SjNaAH+Af76TTv6P6X:OYRvjYbi/x07YoO+SjIAeAKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629784872, "uuid": "0326a032-bd86-44f3-879c-4722a4fbcd27", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629784872, "uuid": "a23bccb9-794c-42d3-b925-6e72f9d81139", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784872, "uuid": "58b7aee8-80f8-40de-8705-1d09601aace0", "value": "cbbac2273a64f48a8d804df3b591b4bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380471f0-04ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629816455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816455, "uuid": "cfcc1988-ed9e-4875-9df3-213cee5382ef", "comment": "Malware payload (RaccoonStealer)", "value": "3afef7c70b9cc8a5af92640526e478f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816455, "uuid": "a11c86d5-c469-401d-a1e0-009fc3af877b", "comment": "Malware payload (RaccoonStealer)", "value": "70d02b5e6758d20721499069a5d703315a1009e3f7724a02b8f5a6b63053b1c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816455, "uuid": "1a73769e-e60e-4018-90b5-90aa3a9e0219", "comment": "Malware payload (RaccoonStealer)", "value": "aefec3e8c5174c8f88465a9463d416010c5042eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629816455, "uuid": "6c805599-8131-4f55-988f-d8e5b1b7a846", "comment": "Malware payload (RaccoonStealer)", "value": "4dd9e6e9b99188a5df6a3e1c013f9c410d9f85ae929c1c53fd5d747492e17ac8980f6ad26e787ac631b50c2a2d4087d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816455, "uuid": "443861db-c50e-420c-871a-d1a499328385", "value": "T14B941212B861D033C0468AB08DD4DB6DFB1ABD80AA749A4337E89F7F1E601D5B53D366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816455, "uuid": "43de453d-e730-452f-8a07-b8fa8dda83ef", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816455, "uuid": "674cd20e-bbf4-4d92-815a-8a170f2dbfcd", "value": "12288:1yk51Wb4Jg42QF2LsusVCfHTYw3eboVRTVhY:vobACQ7gfxOUVRJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629816455, "uuid": "832db130-4062-41fa-b184-2f4823471c12", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629816455, "uuid": "c6150d86-08a6-4348-9c9c-488671ba6807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629816455, "uuid": "34eb9702-4137-47d2-b87d-641426083742", "value": "3afef7c70b9cc8a5af92640526e478f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68a9d35-04da-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629809768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809768, "uuid": "7eb16829-86ed-48ee-a343-7a7128ea8101", "comment": "Malware payload", "value": "099975b1817c0811a4b0321a4869f985", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809768, "uuid": "442d82f4-946f-4f61-a6aa-571d0d3154fd", "comment": "Malware payload", "value": "710945004307a5b060e60461332db23160312fbcac2aa165195cb558a6989b45", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809768, "uuid": "0fded137-cc93-4216-8e42-e60947d5a7fe", "comment": "Malware payload", "value": "3ef727a3e606af5712855f2521c24869ffebef8d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809768, "uuid": "bb446fc2-69f8-451c-801e-b8913538367c", "comment": "Malware payload", "value": "9b0ea586fe2e131311fb2dbfb7fa98b3e6c438fafb10924c18843819e18ec99fc6e7639a476af82cdacbb7f0288ebeb1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809768, "uuid": "dd0a2221-0266-4391-b044-476c9a64a1fa", "value": "T147B4CF0AE6985D17C9E7B1B20AE1C33392119B9E5E08DB03EE413A947DB2FD4EB1075D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809768, "uuid": "40fbf23e-fb1d-4fcd-b05c-740691e374b8", "value": "6144:wbRhrvVRhrvhRhrvcRhrv5Rhrv+SVwp7T2YOVS7IEXWch/+KV368aU6C8O9l03gL:wbvZvlvovdvgpHHIdm36/UgslckVhSPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629809768, "uuid": "0d8c8603-dff2-4d08-bf07-e2aa546bbfa1", "value": 503995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629809768, "uuid": "373d1325-0738-4f13-a544-2f7f7d67e2a8", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809768, "uuid": "b482ef77-38e0-410b-8dbd-dafab0accca0", "value": "saver.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9b7ef3-04de-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629811416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811416, "uuid": "297be742-3f05-4174-ac95-cd62f10d2cc7", "comment": "Malware payload", "value": "5da70207adda2774db5970cc949fa146", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811416, "uuid": "ff700d63-c5ff-4043-bed2-d47e64e4d470", "comment": "Malware payload", "value": "718c24fa701c41ed99e254aabfa5357cdcda8e78a90891e9b6c6de04d10a6e56", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811416, "uuid": "1a95d206-9a2b-49b3-bdcd-0ed3e076a046", "comment": "Malware payload", "value": "b283be63ba62290b95ff59e5dfa36aa0962b77a8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811416, "uuid": "d790914a-244d-4b02-ade2-f20edbbc8650", "comment": "Malware payload", "value": "f1be5a2de99cb959146877c7dc611e4b0f10b8c530cef3cd1a96a39e3b5ba9e0f4c1b8d866bbb3d5104c24f7aeaa8038", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811416, "uuid": "c837d3f9-c9ea-4531-a22f-9a9b161ec93d", "value": "T1CA551117DD189E87D119C7FCBF430DB82B0E1649E992B7FE01B20E9A6F416610D9B42E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811416, "uuid": "782d304c-959b-4092-b4a8-e1f29a957ac6", "value": "24576:y3Giqq0ya++QxTLDjX64LtkAA/V4eDtlPTLyTcePSSS1qanbO9:j2Na++aT/jqpVhxJDaxanE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629811416, "uuid": "1b25d56b-7d2e-435f-a756-f289aca05415", "value": 1303075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629811416, "uuid": "c3349293-f3f8-41b3-92f6-4f2228142388", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811416, "uuid": "243ca31d-e964-4604-9bdf-c76ea1ff5808", "value": "NEW_ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2c8b05-04d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629806533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806533, "uuid": "0886881f-de20-428d-9eb8-f2d288f45e9f", "comment": "Malware payload (RaccoonStealer)", "value": "addf66c224aff122d02e27adb6f5830b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806533, "uuid": "5cc4fd50-3dfc-474f-ba87-6135630c7b27", "comment": "Malware payload (RaccoonStealer)", "value": "7218d54608e55779fd4b3bb6c7ea022a4ddf03ecc33c687209e87f937340e87a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806533, "uuid": "798213a7-45d1-4be7-a6eb-3015bba394a6", "comment": "Malware payload (RaccoonStealer)", "value": "71d92b6db0f4dea263d21f29883e99fe2fdf77df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806533, "uuid": "f8d74c2c-eee5-4acf-8133-545843c2e740", "comment": "Malware payload (RaccoonStealer)", "value": "c81d4e1023c2bafc90354e3c527407cc1f6057f127c5728ac753438b9d8e8b26fc7fc945cfd81d96abae7e15b03c049c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806533, "uuid": "3623c6b8-372d-468f-8c1d-570eff486258", "value": "T1C7941222B8A1C073D45A86F55CE5CE94EA6DB990A772D04337D80FAE6FE12D07739321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806533, "uuid": "775a3095-fb48-4374-a2e9-86274eab38b0", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806533, "uuid": "57ccbf72-a167-4181-9037-2210878ca69d", "value": "6144:VwHAasCJ63x8tWcc8/gA9hCwyw+cl4o312IMnC3GSCcoPy9pIEKxm5b:EqC4GtWccEgAfVyjR4IC3GHTPy9pIDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629806533, "uuid": "2aee6f33-ff3d-4eb6-b0f2-09ad1d3f2c3c", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629806533, "uuid": "f9a478ef-fba4-4dfe-acca-b96ec1b6617c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806533, "uuid": "19a6bf25-9954-4348-b461-26a1026c8f0c", "value": "7218d54608e55779fd4b3bb6c7ea022a4ddf03ecc33c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c43d16-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ISRStealer)", "timestamp": 1629812753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812753, "uuid": "afafa2c4-132c-4835-895c-e9a058e1a462", "comment": "Malware payload (ISRStealer)", "value": "ce1e7349486456b3c57a5266260f3393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISRStealer", "colour": "#FFAB01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812753, "uuid": "f1c9ebe4-dd44-4204-abe9-4c575d1eaffe", "comment": "Malware payload (ISRStealer)", "value": "723653126eb7214b142d0e0c6689158f3acebc548a38f704e979347e2290a5cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISRStealer", "colour": "#FFAB01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812753, "uuid": "5eeff87b-ac95-474b-aa57-3b0bf9e6d2ea", "comment": "Malware payload (ISRStealer)", "value": "0f48649519bf91e15b57650ba84a5a4a7da5c0ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISRStealer", "colour": "#FFAB01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812753, "uuid": "426a345f-7834-4803-85d3-c2939252b728", "comment": "Malware payload (ISRStealer)", "value": "03d14b0b55842a39706579161710762adda23e8cf7ebe5b9e48b87a813ab9d58be30f6fba14cde04df6521105e70d21e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISRStealer", "colour": "#FFAB01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812753, "uuid": "544fcaf5-8af5-4d59-9896-39dba2da3b4a", "value": "T1B9259D3063C9C294EC1A8FF0167CF79402F235E7B6C5CD6A1ADA720C8E5E9D1660769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812753, "uuid": "8b3a1ed7-badc-4b69-98d6-1d10e4d43e68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812753, "uuid": "f1f083c4-c8d0-4fd4-8e02-a522c257223f", "value": "24576:s6unKM3YweVE6GWmLPSaGa4pFPxHCjt2:OJ3YweDGWcSxa4pF5Hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812753, "uuid": "bf1688a9-2a75-41f1-942c-92c5e244ffd7", "value": 1025024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812753, "uuid": "579a02f9-dba3-4d81-a9c7-2e2a38aa9e38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812753, "uuid": "faa21ce2-30e9-4765-a94f-691780dc9b1e", "value": "ce1e7349486456b3c57a5266260f3393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273db6e9-047c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629769182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629769182, "uuid": "662d7d23-b835-42c4-afac-4f2787d875fc", "comment": "Malware payload (SnakeKeylogger)", "value": "d18f6b24885e21a55d4c030832cde205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629769182, "uuid": "4e024235-a4e6-4c99-908e-1957362ac18c", "comment": "Malware payload (SnakeKeylogger)", "value": "726e779529f34143e4d094f0252f3c6e04547d062970d26c0cb553c57c98b1ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629769182, "uuid": "74e15aa7-d7e7-44cd-b174-93367284eb6a", "comment": "Malware payload (SnakeKeylogger)", "value": "50a6a4371234e04113e33ba938778ef50fbae1d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629769182, "uuid": "d2e8204d-d006-4ec5-9ba8-eef287861ea2", "comment": "Malware payload (SnakeKeylogger)", "value": "0b58130ba41a18ee68b8e20316d68d1a14645b02340ae8d894984d38fd2a47be892501048779e1a3350e833534759241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629769182, "uuid": "9ca18bdb-2ca1-4e4c-b495-6dc0ab406dd3", "value": "T196849D8432B68F92EBBD8BF86931611007F6397B656FE64D4DC531DB11E2F104AA2B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629769182, "uuid": "a10969fa-5e8e-4c53-9f78-299dfd10dcbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629769182, "uuid": "48f1b60e-dd9c-40f9-877f-bc5b44ba8932", "value": "6144:GjSVAffHPxtvJ/xanJH2fSYoMa2MgNZk9FtxyWU+gf+KTo0hsBTB:GjxXvjFxiTYbNZoF2WHmVBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629769182, "uuid": "cb5f13e4-c16e-451d-ae75-2121f87d4639", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629769182, "uuid": "a9be1b19-8686-4450-a9bf-6504ece58992", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629769182, "uuid": "96e07ff0-6ae3-4578-bf7f-7ceabb590d85", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.7308.20234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b002092-04b0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629791522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629791522, "uuid": "f31e8cbc-aaa2-421b-a2b6-e079c79c64fe", "comment": "Malware payload (AgentTesla)", "value": "48328a9c9db8e54e03d10c18e3857126", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629791522, "uuid": "44f5e648-ad75-4c62-b183-c2b2bd30b2a8", "comment": "Malware payload (AgentTesla)", "value": "72c19f5b7281d9ec0a3b75924cbb46fdc1bbf17df39aa135ed502613cde7a7cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629791522, "uuid": "63b65985-c180-4179-9781-1e8a02ec4fcb", "comment": "Malware payload (AgentTesla)", "value": "fc2180676861e60af726632e672f74b85cdb729a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629791522, "uuid": "1ae836a5-8f73-4099-8147-0a9a75454760", "comment": "Malware payload (AgentTesla)", "value": "bd7d08967e8abf8ba70a141bf2e0a40ef1a23e1db704c2cf6a28cdf5feca989c4bc60c656ddd58eaacc1bb3729fd3ce5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629791522, "uuid": "8c728c22-90d2-482d-a60f-5c3ebc0e77c3", "value": "T170159D306389C284EC1A8FF0067CF7A402F275E7F6C5CD6E16EA720C8E5A9D1661765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629791522, "uuid": "79e803e0-0941-4a4a-a7e7-55598526fef0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629791522, "uuid": "315ec2cf-f94a-41f5-90d8-33c576b132e9", "value": "24576:S8040IqtBSUIGoUE7FUpQdqiGF50GB/i:RNNYBOUEJUpQwiG1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629791522, "uuid": "b6685d94-a079-46e4-a46b-fe6582892482", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629791522, "uuid": "c8e9384a-cdf9-4764-93a8-ea8b6428d42c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629791522, "uuid": "1341331d-3d0d-41fe-b40d-3852e76dcc53", "value": "Confirmation #376589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdfb5a1-052e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629845642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845642, "uuid": "f2ab61b7-75c1-49b6-9060-e950b4dd5b39", "comment": "Malware payload", "value": "cfeaadfcb125c2f63e9102621bdd48d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845642, "uuid": "d452b80f-6215-4bd5-9ea9-514ede7e8428", "comment": "Malware payload", "value": "72c34b380f8992c5360ca173f96e7ca8a10537a322b6dc7d4d69f094bf79cca0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845642, "uuid": "1918622d-8c81-43a9-8fbd-c2592f48d4fd", "comment": "Malware payload", "value": "26bdf6abefebc3ff5f2b3a683ee66473c0c0cfef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845642, "uuid": "8189d184-d402-444b-b9ce-a3809abb2d57", "comment": "Malware payload", "value": "e48195d2c1d6ea08988c722aeb913fe9481e3a103f7a5648938985ac04149f8c1f490ad377670e0a1d9851caac4aec29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845642, "uuid": "664cb39d-9b4b-4d04-ad04-7243476d5ce6", "value": "T1A3138D33C45EB8D0E5668778AD248A785B23A40685533DF0DAC6DA970087FECF6453F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845642, "uuid": "c8bb05a0-2737-4953-9e3a-e172ff87fc59", "value": "768:D3/zTfpYtWja5FLMRaPwtACbIZXqlDohPtc7VCmlDaet74uQCI:D3/vpY6OkaPwtA1qofcJrdawQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629845642, "uuid": "92fea015-f0d8-41bf-a074-d22ac5d381a6", "value": 42077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629845642, "uuid": "069ef810-4655-417c-a2ec-2505d9818713", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845642, "uuid": "3d98bd6f-e9f5-4c6d-9412-c6f75542639d", "value": "cfeaadfcb125c2f63e9102621bdd48d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29363847-050b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629830603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830603, "uuid": "606ff7d5-a007-42e7-a338-062ee1bf10db", "comment": "Malware payload (RaccoonStealer)", "value": "cb7539c4b28691e2d6c67cb95f8d0dc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830603, "uuid": "a892e969-b37e-4172-8d0f-03d277c56ab9", "comment": "Malware payload (RaccoonStealer)", "value": "73db508abbdf121fded79e1597dff00a58628096bb9751e74dd8659d9fe2eefe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830603, "uuid": "65ffab75-c2a3-4aa5-80a2-e756df90e4bd", "comment": "Malware payload (RaccoonStealer)", "value": "4085ff10ba5933b6d9f2d8375d7aa259bba9b9dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830603, "uuid": "59ac919d-c014-403d-aa42-f12911d6cf10", "comment": "Malware payload (RaccoonStealer)", "value": "7e48e87a97c5b5dfa299da264fb2b890ed9583db9a5203ac9e31061450eef92f620eff1053d41d8e825d6a60f8dc997c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830603, "uuid": "f1ab7693-94b3-4305-8834-33a2806ec455", "value": "T1C7A40200B660C4B3C4A6897148E2DB70FB2979626EA5454737D9CFAF0E752C07A273CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830603, "uuid": "34654a91-c987-436c-9956-b120eae10aa8", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830603, "uuid": "e735ea81-651d-4dba-95b2-27ed3be8dc5d", "value": "12288:dw6dak4prhc/j3otGycD/LDs9Wvs1rEcF:dw6dNa+/jwS4pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629830603, "uuid": "bcdc825a-3526-44c3-bcc2-3ba7957eac5d", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629830603, "uuid": "0ffed37c-53e7-44fa-957a-cf0d997139fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830603, "uuid": "4d7f0353-6ac8-4261-b19c-c2f24225fb61", "value": "cb7539c4b28691e2d6c67cb95f8d0dc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb297c2-0499-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1629781864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781864, "uuid": "4eee0ff7-055c-4dae-b4f9-4a39a734275a", "comment": "Malware payload (Adware.FileTour)", "value": "86edb73033de9a39143b2496ac762fb9", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781864, "uuid": "78d49de9-b409-40a2-bf3b-00fcac94f52d", "comment": "Malware payload (Adware.FileTour)", "value": "76089e8324bd822d80061ba57f1c5b0a473e9e5f80e05953d0e6de9e77b501e4", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781864, "uuid": "17922d89-40cb-4c29-920d-130261ea7cf2", "comment": "Malware payload (Adware.FileTour)", "value": "1c1b971c8cd0c70f29419f36c4502095b52dadd4", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781864, "uuid": "67c89ecf-d740-4601-8b4a-58924b695cf1", "comment": "Malware payload (Adware.FileTour)", "value": "58bf7a7ed5d87dceee14e187fc5a76e5b0c8e0365b0ef7a97f4f2ae0d4424ef0e835fa5f95bfa2b61429a758d9670ea6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781864, "uuid": "bdd9c096-7214-45de-85f1-0b76ce451aea", "value": "T1CCD533927FD2D0F7EA522034C9887FF5E5F8C3591B1488DB6794D20E4F3C8A69129E4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781864, "uuid": "8494e29b-8fbe-45ee-8277-31f03cde60ae", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781864, "uuid": "0f75fdae-1075-4e17-aa4b-9f1a53ae5f31", "value": "49152:xcB9PkZVi7iKiF8cUvFyPPfNojTq0P/k8p+XuuGEwJ84vLRaBtIl9mTy+P:xJri7ixZUvFyPPfNy5vpGVCvLUBsKyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629781864, "uuid": "3567309b-5c26-402a-a0cf-4e7c73da6c3e", "value": 2826056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629781864, "uuid": "2629490a-3722-446c-9e6b-11bd9cfa65f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781864, "uuid": "6d829ca6-7b87-42da-83bd-bda2a831b0d2", "value": "76089E8324BD822D80061BA57F1C5B0A473E9E5F80E05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86adf715-04cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629803272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803272, "uuid": "5b96cd16-fdb9-4c93-981e-374d4b21db19", "comment": "Malware payload (Formbook)", "value": "19f3fd34f33976e37a64d0baf70b1b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803272, "uuid": "a4bb5439-bcba-48d4-999b-b22967638a39", "comment": "Malware payload (Formbook)", "value": "77a828cb768b55daddfbe7022e9f0158a1261ac7752972ab06368f6b93335461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803272, "uuid": "65e9da62-d6e4-4b62-bbee-2aa49566f78a", "comment": "Malware payload (Formbook)", "value": "2d83d40cc53885c2ba5a7f21641ecbe5c4042e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803272, "uuid": "a56c8f10-e93f-4995-9fb9-f639000c8259", "comment": "Malware payload (Formbook)", "value": "08a2f981c22452e3c8440dffc2cb83d8d223e508ae043ad9a4519e6fd49de9c1627cd1baee128bfe6ed6d1cb0ef4290f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803272, "uuid": "46de51a4-3480-4320-af73-0b49b0f83966", "value": "T1FDA46A003B98A92BE135D6775B57813283B24AC7E1D1D785C940E37E7E31371AE4EA8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803272, "uuid": "db071a1f-e8e6-46df-84db-4043c16fdf0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803272, "uuid": "b7ea9b86-e90a-430b-8144-4c952b0c8e17", "value": "6144:V8FYF4XO7l+rk64dlDYv0zplGzvcqHmDJh7FQlO4swMNja1fYHWz52tcjXPnzBLU:V8F6WOR+rmd9d9DvoLsHLHmj/n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629803272, "uuid": "dbd5e37e-a772-4b95-835a-15c05b867e10", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629803272, "uuid": "a54343dc-f0a5-4975-817e-29a91b54ba78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803272, "uuid": "175f6a52-a296-4950-ad71-466d6240bbd2", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92615e27-0501-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629826485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826485, "uuid": "51ac281e-3a62-4f1b-aafa-d89266a9250a", "comment": "Malware payload", "value": "897491912bf25442cb0d7f529bab538c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826485, "uuid": "25178f25-6cd2-489c-a3ae-80596ad80abb", "comment": "Malware payload", "value": "798a073cce7390f37e4a35f864ab5667b5bfac7cd60f8460ed043d0e5ae0bd8d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826485, "uuid": "3cef7b4e-96d9-49b0-82c9-e1c76fe8dd62", "comment": "Malware payload", "value": "eb96b0c363dab9c56825ddb9192ad32746727c56", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826485, "uuid": "81cfc2f3-e6e5-465f-9012-c42c7d20a366", "comment": "Malware payload", "value": "6d8a0a7dd92b1c2059a8bd6f3e7d8513e78b27dbaa15cc84e74a0738cf430ca94e841fe53beffe67cd5a554f2b9f916a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826485, "uuid": "9b33341a-f365-4a31-bdff-25cc3649e97a", "value": "T135932FACC8A706D84F896BBD6727AE80118D762DF7845533327C577927D2E3E911283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826485, "uuid": "6122011d-448d-47a9-9dc2-f7cb26b54f67", "value": "384:ZJAG5D2yVsukI/L/G0+LLXXqH3GQ++fQas4Ybti:Uiiyy2hXB20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826485, "uuid": "a3eb4cd7-b903-4933-a63a-8eadaa165b50", "value": 93746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826485, "uuid": "f658df0e-b9da-46aa-b3d9-c282567da0d2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826485, "uuid": "0583295d-dd4c-4d95-a68c-ef0301a869c6", "value": "payment invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79ad43d-04b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629792670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792670, "uuid": "224a9db5-bc72-4305-a371-aab83063d7dd", "comment": "Malware payload (Mirai)", "value": "af95606ef7cb7595e9765fad4347bc02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792670, "uuid": "ca9d7fe7-e9df-4829-876e-a13514927945", "comment": "Malware payload (Mirai)", "value": "7a1518ab43287d5563109e963382314dccf8daef0cdaa5e8d285178d9930f600", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792670, "uuid": "0c7601ea-e368-47d5-9fd3-74325dc1248d", "comment": "Malware payload (Mirai)", "value": "d006e1a0ed9bb1ef99d8c2d468775120b0f06277", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792670, "uuid": "0e721c9c-f33b-4ce1-b35b-03c601caa20c", "comment": "Malware payload (Mirai)", "value": "48ec2e3cd11e31ea0373e4bf0fa688b207d4dc8a76c02c9a502a7340a763dca8eb444c29adaefd06e61f438fdb6fca62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792670, "uuid": "4c14c56b-1967-49a7-963e-ecc1beee602e", "value": "T17BC3E731E8044B2BC2D223F6E79A829E3F351E9797973311573879B02FF27991E29524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792670, "uuid": "f0d47a90-9be6-4928-aff5-68e88f32c684", "value": "3072:FDcYVLWKlAQTv+mYfbpl2m7/L7QsvmGugiNb:WYVxlAk9YfbH2m7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792670, "uuid": "4fb02e9c-1b18-4876-9820-5654b0b8d428", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792670, "uuid": "d18780dc-5663-49dd-90e8-d4f7d789faeb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792670, "uuid": "4d1c3b57-35fb-48fa-8396-ef26ea9edd12", "value": "af95606ef7cb7595e9765fad4347bc02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84972532-04c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629799403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799403, "uuid": "9f69db97-acc9-4511-8ae6-b018160d40c5", "comment": "Malware payload (Mirai)", "value": "5e6edeaeafab26b212f01db81b8f42d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799403, "uuid": "c6f5046b-01d4-4463-a88f-105a6100f6a1", "comment": "Malware payload (Mirai)", "value": "7aa134c7068130ef319c7b308c8ea44dda35139cac74cf07bb108c340e476d06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799403, "uuid": "7f8091f3-af65-4bf3-8176-c2210a243127", "comment": "Malware payload (Mirai)", "value": "709c4c815bb528554b9f4570fb69b27b82b6862a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799403, "uuid": "b2970f71-3dd7-4aa0-a811-82db3d7b3597", "comment": "Malware payload (Mirai)", "value": "a613aec534c87ebba9cb720c1ab0f8b9b656c55b5b80f340e989587ba4dd9f334a7342dbf8e442f642b5096eb05c17f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799403, "uuid": "c73b0fea-d74e-4ae3-878f-e67d5c919653", "value": "T104D2F1FDC141A8FAEA7FC83923D103031A2513A585836C5B61B9B743DFA59B1B8C71E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799403, "uuid": "713e0085-2187-47ec-b056-5a4e9826aacb", "value": "768:nZI8JvLN/MnqFFvj6lc6YBNolvYPa9JgGlzDpbuR1J3:nO8JvR/IqFFurYBNousVJuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799403, "uuid": "cce52d2c-70fb-4f87-8b0e-e3c8413e9581", "value": 28532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799403, "uuid": "c45f0dbe-f67e-4ede-ae33-7aaf864f0455", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799403, "uuid": "a56c038f-a4b0-4cba-b960-c298b9a2f163", "value": "5e6edeaeafab26b212f01db81b8f42d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5269b5e6-04a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629786864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786864, "uuid": "7f001ed1-e53f-4542-a1c5-786f17f7b8ac", "comment": "Malware payload (AgentTesla)", "value": "608d7fa89a1355cac2824dea062fb938", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786864, "uuid": "948dd866-eb57-47c5-869a-191a6f6dac8b", "comment": "Malware payload (AgentTesla)", "value": "7c00bb4c0bee34d4675099bd9020c860f1aa280656d28681e87cfd22afde286c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786864, "uuid": "f6443e7d-77dc-4bb5-8779-6d0dbad6fa2c", "comment": "Malware payload (AgentTesla)", "value": "a5afb3532c013709d0911cf923472d842478c904", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786864, "uuid": "db3ac2cc-157b-4366-8b79-403af47bc0ee", "comment": "Malware payload (AgentTesla)", "value": "b62ec28c40366152728617c7f652b6dbe3554623ec47d7b68a33c8c0e88a2aaf58ffc53268928274f659fb512a5aba93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786864, "uuid": "8850a5bb-c7ed-4427-b43a-ca8ba2be7d56", "value": "T1F505F53D19B91637C1B5C355EBE59423F148986FB404AEAA6CDE03A7034BA8735C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786864, "uuid": "e347fe9f-356b-4e10-bbf8-c5a772c218a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786864, "uuid": "e6ca1bfa-885e-462e-952f-736b65425a17", "value": "12288:ctVr2bQuUJ9I5jXfcybgSVW3zRBZkSh0Ubj21o/PYDN7RVR:cn2UlQjvTb2kimm/PYDN7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786864, "uuid": "15c809c3-f1da-41c9-9ec4-35082bf73e87", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786864, "uuid": "9b6fdc6a-c764-49d1-9cf2-14c4f51f5273", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786864, "uuid": "2fe6154e-fbf2-4863-896b-25f393a85bd4", "value": "608d7fa89a1355cac2824dea062fb938.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9075cd-052a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629843973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843973, "uuid": "20441ddd-2353-411f-ad5b-f30782ce094f", "comment": "Malware payload", "value": "b4e4e1c48d54285d544ef8f82877b97e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843973, "uuid": "2f6baf1c-ca62-4e47-bc29-485e8358afb8", "comment": "Malware payload", "value": "7c22252bcae2d8a741884f81d7b177cda64a518295177aba1fc8e86e67379038", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843973, "uuid": "d513a45f-c950-45ae-8f65-8d9d8a341a2c", "comment": "Malware payload", "value": "19b34fddd2e7df038b7e53224ddd81c3c12f6cc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843973, "uuid": "a2190932-56b3-46ae-83e3-44be102a5916", "comment": "Malware payload", "value": "bc06e9669e0f5c0182e68bbdc597558e2847cf11c395173adf4e38afde4575e7bc1e06ced10fb0df2906e66b20296da9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843973, "uuid": "30329f78-e116-4eda-84e9-8b95479f21e9", "value": "T1D9C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C52CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843973, "uuid": "fe4067b7-85b2-4cb0-8438-fe936902c39a", "value": "1536:/RHeTECAms/Y8Zm3lKYA43gMJwSkJ8EpkyDzUh8rmW+IFB1Df11hR/:/R5LqAmgMJM8EayDw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629843973, "uuid": "c3aaa96c-8099-438d-9ba6-ffb099300a4d", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629843973, "uuid": "6db2df48-ed15-44b0-a22c-33dbd46ea3ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843973, "uuid": "b556e0c1-7f89-4189-82f4-35c9d6df4535", "value": "b4e4e1c48d54285d544ef8f82877b97e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856c883b-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629805417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805417, "uuid": "1e787937-692a-4533-8ed5-272b29cf21d7", "comment": "Malware payload (CryptBot)", "value": "14a6cf1e4353e07d1407281d6883cd6a", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805417, "uuid": "f85016e3-99fa-4159-9b6b-5ce43ec824ab", "comment": "Malware payload (CryptBot)", "value": "7c3b2df673868d8f99e2cea7d58bcf356bd59c1a49340e5a8a285e06a517fb1f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805417, "uuid": "d2baabd1-b755-49b2-a739-0e3c36bf39a7", "comment": "Malware payload (CryptBot)", "value": "baa29eb9b2113e238edd995627ebb9d233a3902d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805417, "uuid": "c65636d3-56ba-453d-94b7-3699ebc8b333", "comment": "Malware payload (CryptBot)", "value": "82bee364512cd7f7e1e4f878aeed9e652c7f92b8f3a38bbd9bfd119ed28d4332573fb1f4005ea02f8d823e1e1a33b03d", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805417, "uuid": "8d6d7977-a9ee-4ad4-bb1e-9bc5bfe5640e", "value": "T10CB412E93CA19333C597507088E1D760F86DB8A27964464367D8DB3E4F262E17E3A372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805417, "uuid": "a3b2d906-b5e7-4927-9276-fb01d530fa88", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805417, "uuid": "44e75e87-c923-46b4-b524-5e03d8b81e9f", "value": "12288:R5LSZ3C1Enh2W/Fne7lVF1p44MACgzZNxSb+RKrgMOrGbc:q3vh9nalFe1+b8POrGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805417, "uuid": "4512849a-ed27-458e-965a-20553ab7eeef", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805417, "uuid": "b7de642a-fcfa-4320-8908-69ededebb3c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805417, "uuid": "12e531dc-7653-48e4-bfc2-f7e2637fdb25", "value": "14a6cf1e4353e07d1407281d6883cd6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338c5ca0-04c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629799697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799697, "uuid": "18d8ced3-8263-44c1-a5bf-a48e9c8c9a4c", "comment": "Malware payload (Mirai)", "value": "0cf8cfac25a0fc5ee1fc8dd6bd779160", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799697, "uuid": "956c2f86-5735-46e2-95a6-88f6309cce1d", "comment": "Malware payload (Mirai)", "value": "7ca2b1cbba6f4cb2518054be9b8a98744b179002c026a538a5f903ac8e2d338c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799697, "uuid": "67058af3-bab1-4a3e-8171-3d8fc6082798", "comment": "Malware payload (Mirai)", "value": "4960e2c36387c05ef3119c3454b50a073038c7f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799697, "uuid": "91849be9-b32f-4047-985a-e0acf51aa080", "comment": "Malware payload (Mirai)", "value": "4f3a56d0c2b8b39ca6667d07326d02ae1ba53b0e1fd0372317d69ed132f921a265cde1d9ba8119625b027be0091f836e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799697, "uuid": "03c679c0-85b2-4986-a5ff-54213d8cced0", "value": "T152736CBCF179AEC4D2514578B86499389B23F00A92E22EF7DDC4419FA897DE4F5087B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799697, "uuid": "d5ae4a68-a382-4b4c-8f50-e5c4fffb8728", "value": "1536:naAYdWE1H05hcIwtw8tFz3e1KFfs3cNbXoSteIC23:nxYYkH05r2z3e1Ef+SsSteI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799697, "uuid": "215564bb-ec48-4bbc-ac2f-d9c16b87296a", "value": 78976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799697, "uuid": "5c64aea9-8463-46e0-93e8-f90198945e2e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799697, "uuid": "48a0c545-1c04-48fb-ac63-9d98d6d47e25", "value": "0cf8cfac25a0fc5ee1fc8dd6bd779160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915f93f2-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629812739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812739, "uuid": "e6764719-59ce-4568-9432-d89deea5040e", "comment": "Malware payload (RedLineStealer)", "value": "bed18ad10a70b83b30a37341e62cb68f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812739, "uuid": "070dc1d4-e907-43c0-ae31-a8f764a8f604", "comment": "Malware payload (RedLineStealer)", "value": "7ca74aa1face110ab7e965a83665bdd0d05ae25512a0376a14d1957df68eb4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812739, "uuid": "e2ec6144-1658-4867-bfb7-3d4d236f80b1", "comment": "Malware payload (RedLineStealer)", "value": "1981553a112ae1a6151a41678d0dc8cfa38117b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812739, "uuid": "a6d76291-e5aa-413a-b978-0b46b84b9f4a", "comment": "Malware payload (RedLineStealer)", "value": "a0653fb7b4a4a87b5eca9c0bc56e117306273f97677a4a26affe486b0bb2f0f1d15c41ac16ea42b5b0360e1028b6ef36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812739, "uuid": "b8d3565d-6241-4c6f-8388-eab48809b81b", "value": "T16EC422515930CA37E499D6F018D5A974E756B812ABB1420773CA5B7F2F313E0B32A33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812739, "uuid": "37b09793-9841-4dda-9a15-5ef317aeceda", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812739, "uuid": "e18a1333-a2e9-4d76-a77f-12a45949b411", "value": "12288:UJUNmgNL5T9Xd3RvNkUcx2aQGHKVP3wEjBk3SjJO:MILl9hRws2CAEjBmS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812739, "uuid": "f1a8cf25-12f1-4f1d-9172-def4270cfb2b", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812739, "uuid": "95d683b5-8b75-42a6-8b73-21882faaf010", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812739, "uuid": "8c173e8d-cdc0-40ff-bed5-bfe60ac5cca9", "value": "bed18ad10a70b83b30a37341e62cb68f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56739f59-04a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629785582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785582, "uuid": "a6675639-5555-4d50-82e8-f41c58a74d98", "comment": "Malware payload", "value": "a005e1a1dc848ea11d62a15be357d8fc", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785582, "uuid": "c8448cb2-2a78-4a33-8690-b0aa968a104a", "comment": "Malware payload", "value": "7d915056af42f81f5fce2286fc3db1a65e787b5409406016032405b2d4873bdb", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785582, "uuid": "f438c093-8da6-4631-b0d6-25f91fa0c12a", "comment": "Malware payload", "value": "861d2447b4cb90515b45e7f2eaf11f9f8a1b1039", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785582, "uuid": "81507472-6db7-4953-83b8-0ae647f6a015", "comment": "Malware payload", "value": "5186d181921be786058e8c5c273b1b2b18939df62423ef78d2c2b03d1384a41b8f834838126d25ae90489213292cefbf", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785582, "uuid": "c33f5997-e083-4e5d-b442-18bdcb8f877e", "value": "T121F18D7BAB88E7C4CB77453152E5102A935C11581F98AAED31C47A2D2F2370B43C7596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785582, "uuid": "9a1b3d23-5ed7-46a2-aea5-569792b43023", "value": "96:ZEKr9NP113eEOcPSNi/dAdAis80P/GOBjf2KU4EEWSH+FBiqzcP763i5TWjDPb4p:xrXP/30vLHnAj2r4L+FAIG6S5KDPEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785582, "uuid": "d598c133-067f-4ecb-9ceb-ef12e836054e", "value": 7827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785582, "uuid": "a600a41e-3247-45cd-b7c0-8a26721507b1", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785582, "uuid": "59d6f0fc-1ced-4119-857f-1998d8e77542", "value": "PO 122001-221.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3aa98d-04a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629788836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788836, "uuid": "309771af-801f-45f1-9607-b3e8389a3e9c", "comment": "Malware payload (Loki)", "value": "6cf58df93535a365241531d27cf9fd4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788836, "uuid": "88c8c923-9625-4841-984d-8b0420cd1f6b", "comment": "Malware payload (Loki)", "value": "7dd86b5169efc6d1b52dec1d45997341e3731c310488250e517eccd8419c9c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788836, "uuid": "85392d4e-a128-4d8a-a2c2-fa12aef540f9", "comment": "Malware payload (Loki)", "value": "533a179b551c8e5b0df3cc7ef4c37bfb63dac637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788836, "uuid": "4040a309-b9db-46a1-b334-6e3f105805a8", "comment": "Malware payload (Loki)", "value": "a3081a12887bdb9be0029d23d791cdbe17c2b5949e9cfda43b8a3c6c8754dabb85d92d7249419880f5bf6741c1b3764b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788836, "uuid": "bd8532a8-f5d0-4409-9946-827dcede0a1e", "value": "T1BD058C7063C9C284EC1E8FF0167CFB9402F235E7B6C5CD6A16D9724C8E5A9D12A0769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788836, "uuid": "db00c4a0-2ead-4b08-8413-93116a526c30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788836, "uuid": "25d94d1c-bea4-44ff-8683-1db5cd45f077", "value": "12288:jCcsGI/cwWnU1B7gkBqSV9OZR71ZRIxgW7I0dq8otvSFEuYbV22s2EObbY:jHuB7/BlVMRhZRIx7U0dqptvSFUVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629788836, "uuid": "3ed276b6-ff91-46ff-a9fb-0f311125137b", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629788836, "uuid": "c3de8408-cf1c-489f-b611-17be78c5a096", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788836, "uuid": "e0621af7-166a-4f0b-a3be-6b77473e533f", "value": "build1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df0e2cf-04a1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629785165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785165, "uuid": "2ae20039-0c6f-4b3a-b6cd-e97a3669e231", "comment": "Malware payload (RaccoonStealer)", "value": "5576cd36436469362fe2413154ff955b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785165, "uuid": "a24cf1b8-31b4-47cc-abbf-5ead6d730d7a", "comment": "Malware payload (RaccoonStealer)", "value": "7de4221ec5d702eb52286c59b5e63f8637cb4bdde5ab7bbac8b66b5bcbca2a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785165, "uuid": "3fe7b8d7-3bf4-4648-8e34-3bffa14477f7", "comment": "Malware payload (RaccoonStealer)", "value": "750542c4981ca97e46108550b2e017555c88605e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785165, "uuid": "9b9c66f3-c417-4cb9-b1c7-8a4a1df9e654", "comment": "Malware payload (RaccoonStealer)", "value": "cd5a7fd524dbc789eea5664e9eb82c2c3a84064e3f144048c5488d23010edd2ddeaa76a5781c827b45144e0d208353b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785165, "uuid": "b9308b89-5e86-4dcc-aa7c-0b777af00aee", "value": "T171940215B9A3C473DC05863D8DD6CAC1EE1ABD81DE54D24B7BD837AA2F722C07A21325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785165, "uuid": "a31a30ba-6684-4980-bf75-3babf8f5f65f", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785165, "uuid": "bac54398-7c5d-49dc-aae1-5f89b5eda999", "value": "6144:BI+vv7bODQYQRkJwAvCQDOFW22eh1NFefBGxEzBaKqR6kNVL5oit70OzZcCCwBM6:Bv3ODmAhwef4vv6kh70OFcjw8fLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785165, "uuid": "3dfcc6da-b3ad-47b9-8584-03eda8aa8443", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785165, "uuid": "51fbdb3d-7c45-4510-8420-4930d569e6bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785165, "uuid": "825814be-4fd4-4fd5-9813-bd792ae0a08a", "value": "5576cd36436469362fe2413154ff955b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1551c13b-04a7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629787620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787620, "uuid": "270218d7-42db-4596-889b-ccd68eea8944", "comment": "Malware payload (Loki)", "value": "5d281d7538aa1b4f067ebe78c9ba990b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787620, "uuid": "172e6357-e98c-44f5-a286-497ef1c88903", "comment": "Malware payload (Loki)", "value": "7ee920de0512fa2730d9f7294467bc699256926d1924c69d107ed93f565da0c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787620, "uuid": "74060079-9163-46a2-9723-6aa3c471d767", "comment": "Malware payload (Loki)", "value": "866e36151f883f8a102928263437632efc4f746a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787620, "uuid": "16dd24bb-1801-4da6-987e-af9d0792262c", "comment": "Malware payload (Loki)", "value": "b65b0d408711f5a7a2a63aacdcb2d5a4e64e9b51a5187259a6e8ee906d46512c9995d8162d2e8ce04d658a4ed329ce93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787620, "uuid": "d2d06487-60f8-4c88-beed-5c06bdc1715d", "value": "T159058C306389C294EC1E8EF0167CFB9402F235E7B6C5CD6E16DA724CCE5A9D12A0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787620, "uuid": "09185c47-36a9-4d35-a430-63ee28f7a181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787620, "uuid": "10b94f0a-6d46-4832-bd4f-83dced189ccd", "value": "12288:y6csGI/cojdJEYa+EkMolyt3xUDOFxigXdoSPoyflvTmMOE+dQf2EObbx:yadJEvipytEOFAI/RTmDE+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787620, "uuid": "3c44a7e3-c904-481b-b756-9a22e80eb585", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787620, "uuid": "388d2b15-9fe2-4c84-be5b-f0b9c88906c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787620, "uuid": "5f544fc9-6750-4b5b-9bf6-9a6320b698b1", "value": "TNT AWB AND INV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179d779b-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629805663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805663, "uuid": "c5c1ff4b-c4ff-4ff0-8e5e-f8e4382d3574", "comment": "Malware payload (Smoke Loader)", "value": "11abefb29ad984d8f6c07a98203109a0", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805663, "uuid": "e240f89f-574c-424a-8261-2925981f848c", "comment": "Malware payload (Smoke Loader)", "value": "7f56537b4945bccec011b4234f1b25ddc2ed65683029c22c45376f475ec40683", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805663, "uuid": "b238f777-0373-4c62-a128-59363c4cf04f", "comment": "Malware payload (Smoke Loader)", "value": "794a0ca413b6e48bcf3153abd683e083293ce4d7", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805663, "uuid": "c466f5ad-da3a-4104-94cc-b3a8d481cec8", "comment": "Malware payload (Smoke Loader)", "value": "5fbd0ac741d5dcaa66b0eeb4eb6553b37ad8131e7f3aa7193b7657c89b7e72d0159c5ab0d7c59e51f313f45f38165d5c", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805663, "uuid": "29d6d7f8-76b6-4e2e-a150-dc7b707128a7", "value": "T1D7E3AD107693C573C456577088E986D0EA2AFF25AE7388473BD8226F2F212D27737366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805663, "uuid": "f2c444ba-8c70-47fb-947c-22a173f12291", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805663, "uuid": "78ac6300-f9ba-4f05-b41e-325ac9075916", "value": "1536:o+Ih7ekxFjCDxX5/Me++2UJaYFsXA3c5R/dddd540jPrJATEL+hItC3nf:O7TFu950X+tRsQc5R/ddddW0jDJQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805663, "uuid": "d85b1b7c-7a9a-4ff5-80c8-832d624832dc", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805663, "uuid": "ba083911-4e07-4450-ae8b-025819b99db6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805663, "uuid": "75e8f45a-dbdd-4ae0-8de5-1fedb83b3790", "value": "11abefb29ad984d8f6c07a98203109a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222eefd8-0524-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629841329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841329, "uuid": "a4d9fb17-f223-46b5-beeb-e41eb72454a1", "comment": "Malware payload", "value": "353ad3cb7e6b9237e7e7bb96e2b0e5a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841329, "uuid": "4c4e5f83-53b5-4271-a4b1-3a62acb2a6fc", "comment": "Malware payload", "value": "7f5f108eabea4020022851e2dc521b16e7e46c13b7935e4269c0eef2df7341ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841329, "uuid": "d055ae62-4ae7-42cd-bf81-2bff51aafcab", "comment": "Malware payload", "value": "813f8d0376c174b28d55a683cc36d5c7e799eb0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841329, "uuid": "6424c75f-c2c4-4f79-bf96-cec5f555cc3d", "comment": "Malware payload", "value": "415e4325e7b7891ff7fb988546fab2534ec7322f2d9ef3c9698a3118ccd2f037192a3eb3fa2b0b511c72dba71c25c362", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841329, "uuid": "ce20cb81-3c57-45af-bc26-36f8801f56cc", "value": "T1E1B32A2163DCD629F7FE0BB574B1171043F0E09B6021EB5B8DC264DA1F72B829A556E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841329, "uuid": "0c1fe7e6-1007-4516-b21e-1740767d8f35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841329, "uuid": "6005398e-742f-4290-8aca-22aa7d628e4b", "value": "1536:Ft9pmyVpd3OqsadO7XzUqbyr+nDBTNjbuqGdnnMuyq+d8VHdDjEOG6qTaoigW:vVpd3vs2kjxu+rGnnjyjd8/YjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629841329, "uuid": "ba3dc1b6-50d7-4a95-88b5-cd981853a1eb", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629841329, "uuid": "f8e12dc5-b505-46b0-8135-58e12bce948a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841329, "uuid": "120cdef9-bc93-4225-95b8-e1e8c92962e0", "value": "353ad3cb7e6b9237e7e7bb96e2b0e5a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ac85fc-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629805034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805034, "uuid": "2a92633e-f2fd-43ae-96dd-73b2959ceb00", "comment": "Malware payload (CoinMiner)", "value": "651bb4e90bb174d1feabad9d8013ee36", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805034, "uuid": "f9f578e8-1098-4520-a6e8-4919ed4fadca", "comment": "Malware payload (CoinMiner)", "value": "7fefb4ac689e7334f5d66e01673dda50a293bbd7bca0bf3da972f01d32f54587", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805034, "uuid": "0f398e26-e042-4a27-a679-7579c8666428", "comment": "Malware payload (CoinMiner)", "value": "20a13c242d7454d8ea845734cf74f8d902bf7e80", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805034, "uuid": "e56adc3a-c342-42bb-a15c-ef50d4ba52e3", "comment": "Malware payload (CoinMiner)", "value": "fcb8c732711c105c8ca9c78dc9e63a1d95e583b248d77d76b36522cf691cd6211d144fef5fee4e40dc13568a807e2263", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805034, "uuid": "24cadc11-051d-4834-89fc-8010fc6821f2", "value": "T142E3BE1138F8C437D456497148E2CAA0F63BB8A26BB5550733E84F5F9E213E0B72939E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805034, "uuid": "fee4ed64-1416-41bd-ac43-dc554db0699f", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805034, "uuid": "af695ee7-de8c-4960-9b26-73b79f7b119a", "value": "1536:6ahUuMEhnNikDBLCRw3yqMamflDITD685dKdYOnMBriobhO2Yp2:KINJBLB3ykmVIC85dDOegM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805034, "uuid": "8cc428d1-fcdc-4a98-b12e-5082f5b773e0", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805034, "uuid": "384c763f-45eb-4d22-89b9-93d6bc509e52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805034, "uuid": "4a004966-d87b-438f-a553-16cb254ce54b", "value": "651bb4e90bb174d1feabad9d8013ee36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7993dc52-049e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629783923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783923, "uuid": "c7303cc8-ed5c-4ae7-9cda-4bbac571dffa", "comment": "Malware payload (Formbook)", "value": "1a56cf92dccfd9efc7a13f3f03079abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783923, "uuid": "1d82e204-7aa8-4c41-b984-8559c76f91fa", "comment": "Malware payload (Formbook)", "value": "816cca1a963210104f461cf164c15d3375a311ed380609f64479c40eb8a819b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783923, "uuid": "3c510150-23d1-4e78-a633-8721dea25f86", "comment": "Malware payload (Formbook)", "value": "7b9ae133cd38ec7e7478fe68a5cde9360cb99ae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783923, "uuid": "3f65ce5b-bbd7-44c2-8512-e62fa5561272", "comment": "Malware payload (Formbook)", "value": "992fa7b8495ee3a025ae93e432ef71f307d3263f8e380e31fed68af4f1f8b0b50472936ec668526ec072f291b24e43e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783923, "uuid": "a27a1aa9-7687-42ad-a6b0-5c73bcb0a7b2", "value": "T104B4CE0E139C9DF6F187387106A1AE252CAC94B02F2F45C7ABE3BD5E81399C152B570E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783923, "uuid": "e66e5afd-8b6a-4870-a6c6-e0c72bc382c7", "value": "3ab99f80f2c8285ac5250dfc008fb5a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783923, "uuid": "d7cb807b-7e7c-440a-b9bf-369a09091ba1", "value": "12288:EyIpu9c4cH46Z/do6fkWlMgBOcffHCdEq6Aq:EyIpu446ZFoskWlocffCdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629783923, "uuid": "7b06b243-36d8-4960-b9b3-88c8e0950c35", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629783923, "uuid": "c47c3aed-cb82-4c9f-b4cb-4271262d3ccc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783923, "uuid": "867b88ad-9cb6-45df-8ad1-c0b9f9242df2", "value": "data sheets.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0caf8500-04c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629798772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798772, "uuid": "f87fb6dd-43f7-478c-8fa6-47c551e3a329", "comment": "Malware payload (AgentTesla)", "value": "f52bf6749d5e0034f353681b0e466914", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798772, "uuid": "bb069213-584e-4f26-b584-63ed84af0d39", "comment": "Malware payload (AgentTesla)", "value": "81ae348c430a4ac325b5c113babd3c60039a97a41d2a29cd4c43f803428e140e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798772, "uuid": "d28a4738-d35f-4d5d-9d38-c682334e6f87", "comment": "Malware payload (AgentTesla)", "value": "b151c5506e4ea79eb36ea13446eb83944981152d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798772, "uuid": "a5cca7f7-78a3-434f-959d-98e80cbcd188", "comment": "Malware payload (AgentTesla)", "value": "1b5c5afd2bee3532c221090da19be1b664504effaea4f2257a78085e044aa6d22ff07eb813ff19c37f9c6e7d8183d9e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798772, "uuid": "db6d2f4d-3379-4756-b83a-a2b4d367bcba", "value": "T15505F53D1AB91637D1B5C365EBE48423F149985FB410AE6A6CDE07A7030BA9734C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798772, "uuid": "04fa2357-7254-498b-91e1-82713f2a772f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798772, "uuid": "47f5b9c9-4fc2-452d-9881-9a95891693d5", "value": "12288:lXX3skQe75fr09nzwrMVjs1z9rm+W84HdaCIYMwJ+pSRFECu:lXXd5fYXjQeUCHMwJ+pfCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629798772, "uuid": "7f8ec1b4-228a-4d70-b9cf-a93826fa3273", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629798772, "uuid": "d480f5de-4c26-4115-a463-c45c9612f6ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798772, "uuid": "87ef8e5e-8f7f-480a-b202-4d02f390ced0", "value": "PO No. SMC -201103-005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f4d5ea-04d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629806088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806088, "uuid": "65998276-3317-4920-9a09-5607ad9969ea", "comment": "Malware payload (AgentTesla)", "value": "87d0701202a45eaa07310a8553c05bca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806088, "uuid": "15ff6d04-6bc4-4ad6-8ffa-76cd682630a2", "comment": "Malware payload (AgentTesla)", "value": "82bfcd106d031c208a4baebe648b01ef9ced52f735f28e93caec0934c2a72497", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806088, "uuid": "38093e50-d895-458e-a976-8d4158be5cab", "comment": "Malware payload (AgentTesla)", "value": "5a05dee72db3ec699acb801673fa6d75265407eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806088, "uuid": "17d7d50a-664a-47f8-89c3-ce272e59513d", "comment": "Malware payload (AgentTesla)", "value": "a332d8cccfa1d97405adc11f62a47da187fd4339fbb96f24bc5c3341d9f64f57265e956f9bbdd6ed91f6378d99f2341c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806088, "uuid": "94d3a365-5072-467b-bf61-664b0a3d5046", "value": "T138D46B33EE91F562C1BD423CCA9742F006279E35D5BB8707E0A87E483AB26876137665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806088, "uuid": "c70ae1f0-4574-4613-83fa-9138fd0d36ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806088, "uuid": "41c28af6-654b-460c-96ed-c49dea853b57", "value": "12288:fugwlYpLEtlbf1DGyk4j+vAQgfi4iMUlUnpL:LwKLEt51Npj+Yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629806088, "uuid": "c98e3625-4364-421d-b51f-53ae067855bf", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629806088, "uuid": "19ca1dab-c9f0-4991-8564-e2c253c18272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806088, "uuid": "34e72524-acce-4298-8755-1db26ef9d6d7", "value": "MANISA SILVANA - Specs.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f9b594-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629812668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812668, "uuid": "62d62673-bef9-4916-ac5c-d5e100672546", "comment": "Malware payload (RedLineStealer)", "value": "415442e32c0068b900b5ba502ada9f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812668, "uuid": "daa23c36-2e8a-40f9-bb33-21dc7c337a7e", "comment": "Malware payload (RedLineStealer)", "value": "83138f2f99dae7455d97a5af56d30d18be2440c90aa0407aeb3311eb8059e174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812668, "uuid": "5a178a52-66c7-4d30-8fe8-311a67146a14", "comment": "Malware payload (RedLineStealer)", "value": "38c4e3f4993a681518fe9ac7d2b358c9aab955f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812668, "uuid": "f3a45a43-23ec-421c-bd0c-d6e2f0819cb6", "comment": "Malware payload (RedLineStealer)", "value": "709a3493e3ba0f555e6b6829cf2721e585e743dc7cac7c85b978a8fe9e56e33eadb03ea60a8fcd3fa4516977edc26d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812668, "uuid": "545eaca5-1399-4f8b-b0e7-a9a1db35f2d6", "value": "T17DC523C5C6C2B4D4E46EC0F0A277DA3D6B8B98B858E81B3AE59DB25474B1143347EC63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812668, "uuid": "0f27bfa9-b64a-4e0d-a722-b8d2dab99677", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812668, "uuid": "03afe830-a019-4530-8bcc-db53a59a3a23", "value": "49152:Fo0xfu1sR9O01zOlXJXhcUR1P90mvsAC5rdY20LKUHKa:xfXRsbRc+1PimvsACH/0LK8Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812668, "uuid": "1f338b5d-71bb-453c-b030-fe43bc8ec044", "value": 2529720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812668, "uuid": "3a777de9-38ba-4c83-b796-eb185334e6b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812668, "uuid": "6f37a7ea-cb3c-4da9-9851-6f2c2bfc61a1", "value": "415442e32c0068b900b5ba502ada9f8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cc0bd4-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629805655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805655, "uuid": "5f67fa58-ae30-4ea0-b61c-e0b9fe3162df", "comment": "Malware payload (RedLineStealer)", "value": "31293ed09cbe6e4eb22380d1f407df0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805655, "uuid": "80ac38bb-b5d8-497a-9224-9f63609c05ee", "comment": "Malware payload (RedLineStealer)", "value": "84840ce411316289dad22d2bac6caadf6571d49195bf10b614af710b693ef145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805655, "uuid": "9bcdce05-8619-4e73-b75c-ee3792bdac7e", "comment": "Malware payload (RedLineStealer)", "value": "802a6def70a33eded4610bce518145d31fabaf97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805655, "uuid": "dce0e23f-35a3-4217-a01c-97a989e811ff", "comment": "Malware payload (RedLineStealer)", "value": "7d25f01017717b81072df0508ecf207836292e698c9ac4eba526b7f692d67150cff25d444ab6b27d17a988c4b106b0bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805655, "uuid": "9b542a7c-8b94-4ee0-8d90-48c0c861b002", "value": "T1C344F1103990C17FC053013048E5C6D0EA6ABD617FA5417B7BC726AEEF712A1B625FEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805655, "uuid": "c8658ced-acf1-4c8e-a219-1769199d210c", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805655, "uuid": "0773a4cb-ffd2-462e-a424-1d1867ad3cbf", "value": "3072:yn2FwTE3Ae4MtgB5PK0a0aYMAs/lCqVrK2VztZHvPIa4dPxNRTvw0OtCvp5S4fW1:ZFFA60a0aYMvFVrfVvH4lBTgM24fM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805655, "uuid": "f04c932f-a0f0-4886-83b7-2e3e74686eea", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805655, "uuid": "6e5e1f64-7c1b-435f-a0f8-e32b4598a690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805655, "uuid": "30ba4461-bd8f-4212-9cdf-d5184596a9f8", "value": "31293ed09cbe6e4eb22380d1f407df0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af08d146-0492-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629778858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778858, "uuid": "c9ba1bdd-a6f9-484a-9c46-b8cb904ba193", "comment": "Malware payload (RaccoonStealer)", "value": "027285639eb566604093237a1d742bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778858, "uuid": "36e9f6db-b8e9-4810-a1f7-f7be634a6da2", "comment": "Malware payload (RaccoonStealer)", "value": "848b38077dee89f1c2f4dd7696007020643f767f88816ea7d345da49e59a7097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778858, "uuid": "916da81a-ed72-4a74-8dec-a003593dc800", "comment": "Malware payload (RaccoonStealer)", "value": "c31bcae478c779f188935442348e759c494277cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778858, "uuid": "6ec3e4e4-be6c-4af0-8d1c-d8bb064de206", "comment": "Malware payload (RaccoonStealer)", "value": "f42e1e691f81b97ffe7768b9fb4422366f3f0e4fccb251c08f3d3a2ad1147e7b7e24789e5e46e8474af90a92d5937662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778858, "uuid": "a6144c33-a1cf-4cfb-b31e-365b57c807b4", "value": "T14B94120DB6A0D4FBC14542704CE7CAC1E9EB7C50AB75654377E82B1A2FB62C07A1E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778858, "uuid": "83365ca5-d267-4ef2-a5e2-f61617c4bad4", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778858, "uuid": "2db1eb9b-5785-4d9f-b175-974b2181c99a", "value": "12288:nju6P/RT/Uvxpx8OwGhyVp8ADRkr5gnlNBc:nju6xTepOqhgRDa4NBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629778858, "uuid": "1f66fff4-fd73-4db5-97d5-3b064101a00d", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629778858, "uuid": "5b0948c0-bf7d-4331-9bfd-3ef6f17014e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778858, "uuid": "aa658e9e-f3fb-460c-ba64-07d97b40cd60", "value": "027285639eb566604093237a1d742bfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f74429-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629804908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804908, "uuid": "6bfba50b-cf34-4a75-be16-e0e110dcaca5", "comment": "Malware payload (Formbook)", "value": "5676cadae61186b1b446ed78bb5ed8bc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804908, "uuid": "c4dc5385-2311-41a1-ad42-5f0aec8d9965", "comment": "Malware payload (Formbook)", "value": "84a75d4e08c6d28f7d358f95a77ad5af5e737de5e656bdfd6bbf006f456f831e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804908, "uuid": "019b8b18-88a1-419a-bb7c-161e2641e0e1", "comment": "Malware payload (Formbook)", "value": "9a379a28f7ba1d8e9806d04891095e488a931ef5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804908, "uuid": "334c989e-ef89-437b-9aa5-41be7f569abd", "comment": "Malware payload (Formbook)", "value": "1a3a94e0739b8a8aaa056671025e47169c87cb256debe57ad4efe44e200cfea9da0b78d0e245073f466a40bb61651edf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804908, "uuid": "a81a208d-251c-4867-b89b-c208a98f96d3", "value": "T1D9046FACC04706D88F86A7B8231B6F45008DB68DF389E173366C57316BE2CBA516797C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804908, "uuid": "ac29444d-2903-40df-9d8e-de31da9560da", "value": "384:elouJ3Ws7+mi7c3IMIkAUC464523Q49P6nI26T:FKuQ39vC4h5C9UIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804908, "uuid": "36525179-4321-41a5-b8ed-6a6e564c9d70", "value": 174945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804908, "uuid": "44aa22ef-bf9d-4ede-81ab-dd93f3d1345a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804908, "uuid": "b0a236d2-582f-48db-bc4e-1a931d5c4b0a", "value": "PURCHASE ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30436a68-04e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629813006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813006, "uuid": "d46167e2-d5b4-49aa-8841-2d46e806ed84", "comment": "Malware payload (Mirai)", "value": "de08e1c31d779d833d9abfbeed7cd0cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813006, "uuid": "a437b2f1-c97a-4ad2-aa59-8fc215500925", "comment": "Malware payload (Mirai)", "value": "855c291c8107df74d819bc7b7f861d2bf94288f5eeb673f3b6c86242a177f7e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813006, "uuid": "84bad7eb-8d3a-4383-b448-1a988e945779", "comment": "Malware payload (Mirai)", "value": "4bcdb596bf04519c662fe14698404de2f2895ea4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813006, "uuid": "138bc5b9-06d4-4f71-93b3-0e0dfc337f9f", "comment": "Malware payload (Mirai)", "value": "d875fbf62b074af0241fb4019fdd1647ca912847f1eb0c5f917a9f8e3b7fe42d3a16b01a6bc69112d3e019aa9c980c11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813006, "uuid": "7696723b-1523-40df-8ea6-2bb287af055c", "value": "T1905329C8A593F8F5DC140978307ABB66AEB3F13B7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813006, "uuid": "520a0f08-1216-444b-bf0a-24fce6648df9", "value": "1536:IoRC9170vwHbQXZ5+qXDEuXi90dSW7V/DjObeFt6PuQ4Zc:PC917iwHbQXZ5+qXA594SWZ/XObeb6G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629813006, "uuid": "7eceaf30-c090-432d-8d6e-0ea238f3b0a1", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629813006, "uuid": "60c8b811-1412-4041-83d8-d09f06d26638", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813006, "uuid": "47f43a85-eb83-4f60-bfff-8bf6727daae8", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f11d6fd-04a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629787341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787341, "uuid": "fac4b64f-aef1-4ba3-a24e-1490a28e313d", "comment": "Malware payload (AgentTesla)", "value": "9bae1987160cba224b05339dca041432", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787341, "uuid": "180b292a-b4b8-45d6-b67e-12a537de17f8", "comment": "Malware payload (AgentTesla)", "value": "85ec9fb4bee90d873565b289a0165f8a543114e8f20b9725786fcb7900a36c4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787341, "uuid": "f2a3adfc-2186-468b-8d9d-8ad182cac86e", "comment": "Malware payload (AgentTesla)", "value": "7e8c14df119f7aa62711b31c866df9332138e506", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787341, "uuid": "53a6a0a7-b4e7-4bbc-a0f0-20eb6cf2082e", "comment": "Malware payload (AgentTesla)", "value": "905303ae7c45d20ed17cb46408f84a1b001b51e3d2d83a2740a1dfab12858cd305d25848740784b8c74169a1126de834", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787341, "uuid": "9f8b1118-d289-4ce6-97a4-46b7a620ef34", "value": "T1D1E4F10277658E15C7C529B691D742380BF2E6877237E39E3F0896EA6EC27B45C4A3C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787341, "uuid": "66b04a3f-342d-4455-beae-dbd092aa7604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787341, "uuid": "d3ad35ac-ca39-4090-8b5f-ac19dd8609af", "value": "12288:49ZdqeaDGQYjnjagxQ5mAkdDFRjnMB7VnPsW5MJeX4d:4haSNnm8Q8DFRkL5Fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787341, "uuid": "450fb4c8-0517-451f-9991-e6961128ac00", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787341, "uuid": "0f589e3d-228b-4370-b641-655c9a8d0a41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787341, "uuid": "559b9c6b-f07d-4513-99b0-7bbd9831dbaa", "value": "9bae1987160cba224b05339dca041432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af1df25-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629805695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805695, "uuid": "91bb0cf8-8dc3-40b9-b0e9-1296fd89fb63", "comment": "Malware payload (RemcosRAT)", "value": "77bd7eef481f19a072ce785805946fb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805695, "uuid": "58ab921f-89fe-48ca-b7a3-2879e0eae051", "comment": "Malware payload (RemcosRAT)", "value": "86b38731fd275a71b1aadb5a19b308869ea4efcdbf6b1fd692f43b93fab30232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805695, "uuid": "6022aa56-ee0b-41c4-a5e8-3bb7b49ca776", "comment": "Malware payload (RemcosRAT)", "value": "0a8c0c53c35dd965a2167724b55d6cb52a23448e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805695, "uuid": "b6b5f8a1-2404-4e98-a00b-c23a0a974fd3", "comment": "Malware payload (RemcosRAT)", "value": "0289138bf8a9008ff8e140af938f77206e098c058019b6b8325822951b4c916a05c531ffdc3c8b93a2023be51e1e113a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805695, "uuid": "6ed197bb-e566-4fb0-9dd8-462004b81bfe", "value": "T16593C713FA4AD0B2E42591F146426F32CEBCBC3736492173D38FCA419D79892D456EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805695, "uuid": "4fac6e6c-dd87-4317-bac9-2baa7a48c549", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805695, "uuid": "e860307e-133b-4673-abd0-12afb3a0f87a", "value": "1536:AhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6+rV:GhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805695, "uuid": "0b40b628-0170-42cb-986a-b453137c607a", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805695, "uuid": "f125c25f-bb57-4039-9768-fb2610ab1f4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805695, "uuid": "393a636a-b32b-477c-af20-7e8d352210ee", "value": "77bd7eef481f19a072ce785805946fb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43afaaa8-0473-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629765364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629765364, "uuid": "f62ca51c-3070-4777-8972-951328e93744", "comment": "Malware payload (RaccoonStealer)", "value": "15d56f8671e72054131dfc0963fb51fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629765364, "uuid": "cde4c33a-1f30-416e-9d69-172473e0e058", "comment": "Malware payload (RaccoonStealer)", "value": "87dc47ab7b0a1601e78a0eab3d84b59df589dc0c9567812a59caf34f4785fc75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629765364, "uuid": "419e1a2c-76ac-4fbc-9e29-82adf1c15c2e", "comment": "Malware payload (RaccoonStealer)", "value": "dbe0e0b31431def8e5621e605ca59bd5bc63f7a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629765364, "uuid": "607b36bb-cb42-4ef1-8ac1-b08e9dfcd91b", "comment": "Malware payload (RaccoonStealer)", "value": "010760c8afa769d5f390ee108e0a4c4c009933dac9853d2ced60b467bccc9c335139a8dd731985fd4b60f78a76adb1c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629765364, "uuid": "bf9c39c2-8e06-4963-b1f5-07cf59862383", "value": "T16094121AB663C433C45540B14DF5C1A0E99AB8F11F75B0073BE93ABE2E74780F66726A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629765364, "uuid": "2eb2caff-1496-443f-b5da-1b0efbaac3e1", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629765364, "uuid": "3ca88877-d6dd-462f-a4ce-5c7d2a8e96b2", "value": "6144:qH4XmPqtJMXPoHwvYZvI2vrbJdNoA5yHbnRGhMjsxQoqOtWVk0+ADdXysbmCDkpD:qHCKqAP/vkvIclCdk3UDdFA8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629765364, "uuid": "981d3798-ee16-49d7-9f82-d6516e5d974f", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629765364, "uuid": "cffafcfc-0cd7-48b2-bccd-a23711bd3f8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629765364, "uuid": "92d002ac-20f2-4e72-92b2-8ecf2035dd09", "value": "15d56f8671e72054131dfc0963fb51fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa541b2-04b6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629794179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794179, "uuid": "68fa65b8-ad01-4020-8f0d-7350562fe0d6", "comment": "Malware payload (RaccoonStealer)", "value": "75a65727a803ab560f97d99454f3371a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794179, "uuid": "b2665746-f2eb-4af2-8db5-ecde0a6a6470", "comment": "Malware payload (RaccoonStealer)", "value": "87df9f2a4cfce131acf28eb02e7a12c19758050657cc5860722fb521f97ee2b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794179, "uuid": "6f4395b2-5886-4522-aa32-dbd2716758a6", "comment": "Malware payload (RaccoonStealer)", "value": "afce3d602c009053e0dc84f6e834d063e76e033f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794179, "uuid": "c98fa256-64da-445d-9fd2-e2469dc74c0e", "comment": "Malware payload (RaccoonStealer)", "value": "2c7551132f509508016ac9d25b95da597853c8e2f6ed88591a2c1ac79f7f58889b5a791073773ce86d0e5d3dc6107841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794179, "uuid": "8bcada15-184d-41d0-9260-44a26a5092d5", "value": "T19F941202B922C133CA5544B58CE2D7D0FE7EBE41DE6521C73BE42A9E5EB12D1B616322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794179, "uuid": "c2d9b071-692e-489f-8e1d-940b2df0dacb", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794179, "uuid": "933b2d95-3f23-4922-a364-2c9cee43e960", "value": "6144:o2awVzguUzM4EU3flTrTi3R6aAUKlPpfaDFB85pT8Lmb/f9StI3iTPWbV:o2asE/MSflTH1bVaza2LoX9IIijA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629794179, "uuid": "27061672-0d76-479c-b6d6-79e7ca5c3203", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629794179, "uuid": "92710f79-d533-4d55-85a7-ee13343e8854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794179, "uuid": "abb0ea9c-f0ea-415e-bc10-1ccfe72fc0dc", "value": "d0be4707cab9461c51f4d3d2be0cec8dfaa06e2d2021-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f25ae56-04de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629811339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811339, "uuid": "241b5ad0-21a7-4776-8b48-f44a14daca8f", "comment": "Malware payload (Loki)", "value": "e07e01b35b33d429150d5955d73c016e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811339, "uuid": "0c4ac335-4336-418b-a05c-a8977a600206", "comment": "Malware payload (Loki)", "value": "88d340b5f4e128ee71446adff5b002ef8017bb5f919f7e170ecd4fc10566b8c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811339, "uuid": "4f76ed08-6567-493a-a4aa-31c089a3d20b", "comment": "Malware payload (Loki)", "value": "1434968932ea10a115afd4b3c9b25549322a5b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811339, "uuid": "d839afc5-effd-4f9f-a08e-7018dae7fa0b", "comment": "Malware payload (Loki)", "value": "331d6f89790fcbb41ce079a11b5d31049e302322e4e3bc92ba10b0c19d0cde52ba26d6efa5c2cbf6b15b527e61b5bc80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811339, "uuid": "c1715efe-e56e-4f4e-8b83-a02592f79060", "value": "T149F480BE1ABDA2278175C6B5DBE79417F0409B1F3411AC2576C203664232A7BB4F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811339, "uuid": "ea1856ed-fc53-4c6a-b735-276bca4878bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811339, "uuid": "aa7d99d4-115a-4bb5-9f99-eca6798cc785", "value": "12288:sx+7E7zrpprdVwFFpr7u/BoW7eeI1e2UTlRcpf:sx9z3dCd7ul7AS7cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629811339, "uuid": "d1446fbb-5aad-4b87-ba24-739fe88059a4", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629811339, "uuid": "f3bdf003-6534-4c5c-bd49-00c1189bb66d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811339, "uuid": "226ab402-bb89-45a2-ad0d-4752549c13b2", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3341470d-0511-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629833197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833197, "uuid": "83ea21ce-5bcb-4310-b46e-963edb90c792", "comment": "Malware payload (RaccoonStealer)", "value": "3728442d60d1d47aa49d3c143025a114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833197, "uuid": "81b0d509-000d-49ff-97c5-0300f955a00f", "comment": "Malware payload (RaccoonStealer)", "value": "88d792c95b14d7c26498e191ef9ea809e857b56c34381c0c01caca7d3d9e162b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833197, "uuid": "9427ca04-1773-40fe-864f-59e2907bc66d", "comment": "Malware payload (RaccoonStealer)", "value": "6d5927ea9ae6d59c2480df68303ddaf3fb539901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833197, "uuid": "b95051bd-340d-4cd8-9d6a-2d7ea86b8743", "comment": "Malware payload (RaccoonStealer)", "value": "6313c60728abb6f20a518c2cbf8891294f93a197e558b4b5a0b1d05d0a25fd3fe7b1d4d81fc903cf61dde7600ecc1e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833197, "uuid": "d39a6983-1255-4b86-b6b1-57f1c03efdea", "value": "T1DAA412C2B4B0C433C59A52778CE2C664D52976656E6142473FE98F1FAFB22E0332B352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833197, "uuid": "29a8017d-33da-422b-bb8d-aa5f6b45dc29", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833197, "uuid": "062e405a-7244-458c-9b69-e7e185c94891", "value": "6144:2l0ld/aEB/CUrXRu1Kd3gyDptH2k8xF9a1acOAmxfN9IXrKKmDnLcIGNqYuD0cbP:2GLYE3haSmVjoegfqYuQU4cF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629833197, "uuid": "5d61afd8-1969-49df-a14d-10fb932cc5dc", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629833197, "uuid": "7981cdce-1ea0-42df-8048-72a3d4f58f36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833197, "uuid": "d671b8e4-22a6-468c-ace6-f978d9af4761", "value": "3728442d60d1d47aa49d3c143025a114.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafce3d7-04af-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1629791388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629791388, "uuid": "60719cdd-23cd-44f7-b395-26ad7c93987a", "comment": "Malware payload (FickerStealer)", "value": "d606fd6b342d804968cc31341dbae523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629791388, "uuid": "3ea4d967-c4f0-4b6a-bb2f-22b1888d60a8", "comment": "Malware payload (FickerStealer)", "value": "8a0772d0b96be2e3ea63320f194961906560ea9b6bedef47239aaa0faa52816a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629791388, "uuid": "c2b30702-6864-4d51-8b23-ad8c43a74c0c", "comment": "Malware payload (FickerStealer)", "value": "37788e6afb13dd6a5d6859072f4e099d6d961cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629791388, "uuid": "56fa4577-eafa-4365-9a2e-e08fdd8ae81a", "comment": "Malware payload (FickerStealer)", "value": "07d3dd5da61e73f37ef24dde3ddde3cbe2be0d6c829ce75552450c0f8d4ad0837aa0815d71e664d8d309bc79e78b51f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629791388, "uuid": "e4ec58b4-bb67-4435-a438-a8cfad5a2020", "value": "T1EC947C2064F82C1AEE86227C48DB9356A73E7E509A33C3D345766575CF532C3F6A9382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629791388, "uuid": "ac7ce28d-5ae2-41cb-be93-9b8b4e46b87d", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629791388, "uuid": "f4f27daa-d675-4e48-bef3-10b9dca1f40e", "value": "6144:Pk+nzDvUEvC9JZGKFhRCkMW0rLAb56dpLN4XQKJrsu:Pk+nA9JZGUhzMW0rwrsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629791388, "uuid": "8991eb8f-4a0d-49b5-a6d3-ab8bbbb2457f", "value": 440500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629791388, "uuid": "f11a18df-2585-4768-bb81-bf73c950c3bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629791388, "uuid": "b60eb728-b6ab-425b-b21f-d72b3d2df7c3", "value": "- - - -32- - - .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff69bd8-0505-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629828037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629828037, "uuid": "cd1aae4b-943a-4b40-89ed-0530d5f060dd", "comment": "Malware payload", "value": "e1dcebf90cdd5d3fec56c6889fcaf6f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629828037, "uuid": "9df3ccd2-15cb-4c2c-ab64-dbd0306bfaab", "comment": "Malware payload", "value": "8a0bbd6646b392c2eddfc5cdf466933f3c44c5eab4075bbced437e84eff8e030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629828037, "uuid": "0d6474cb-751e-4cfd-8d9a-c1af6dc6d0d8", "comment": "Malware payload", "value": "007b71e06b532121845420e585a334460bb347f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629828037, "uuid": "dec97393-2f25-4e51-af6f-7e8dc8e8d987", "comment": "Malware payload", "value": "7e29887aac6bed9cb5e4d0f777b2cf30b839ce5d990b0e9956abbf124d11b59edb8c56dae370df86bf27faaace1832e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629828037, "uuid": "8b5539f5-3826-41e9-88a4-bdba80030d54", "value": "T1B635D043F98184B2F0434972853AE77BBE35B601A924CE87D7D45D280A72291EE3F76D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629828037, "uuid": "ec8802db-736d-49d1-8c5b-681bc93de634", "value": "d803cf4cabab38ad6ac8123e3c7a53dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629828037, "uuid": "8b051776-c4ce-4d4b-b4df-a2cd2aadbccc", "value": "24576:HnYO/xJrstd2u3Slcfo259gy6Ym4ZrpdSdwwDtrm83z:dbst4u3vA2PgTqpdSdvDtrm+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629828037, "uuid": "9cfc3168-410c-42ba-a2b4-237e14c8edb7", "value": 1096081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629828037, "uuid": "cd6ebd8f-575e-4199-b538-1d1a468e0a8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629828037, "uuid": "21acc8d2-a3dc-40a9-b021-d78b3d2acfec", "value": "dotwininit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29424b3e-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629805263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805263, "uuid": "4bae913c-aa05-40d7-a2cc-3e2024b20bf5", "comment": "Malware payload (Formbook)", "value": "7c3a7d5502c8be0aa5a9d0bc4a4020e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805263, "uuid": "52a7aa12-eda9-4637-bb3e-25aa888d5981", "comment": "Malware payload (Formbook)", "value": "8b4049ea3937e355ad9a551795afcb621fb56991ffc6f1db746861acfd7d6a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805263, "uuid": "ec79560f-24e5-4288-9de4-f92bd35bf74b", "comment": "Malware payload (Formbook)", "value": "f063e726b27fa0a1bd4fdbae0f6b1f0060186915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805263, "uuid": "c9c96ed4-aa84-42f4-b533-2015a95c3493", "comment": "Malware payload (Formbook)", "value": "800668a3ba8d9d243c982f23e9c075f42c7daf061ff9c8c877a850926f0297ccb6394e671aa141e3e2b10d50940dff0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805263, "uuid": "ef3b1496-6997-45fd-be68-2c8976b8e4b5", "value": "T1D544010278964A5AC6C977FC297195437A222CB10A65C0CFD8F63E22F4315B3EED127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805263, "uuid": "c1c94f1a-45e7-4a9c-b619-3ae8084c402a", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805263, "uuid": "81ebbc69-81a6-4e2d-bde7-65ef5bf0e10b", "value": "6144:tEVD95sS/ebxL5RVbGbz7ans9bpR4HCWIjDkqREdoL:tCssebxLVbqz7QgbBWsHQoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805263, "uuid": "fdec52f8-6ea9-42e9-b952-c125a47e5a49", "value": 262804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805263, "uuid": "dc586922-c5fb-4937-9739-61aa0c7a00cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805263, "uuid": "13239113-684e-475a-8199-2a0e18b4313b", "value": "0097890099899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab37d03-04c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629799252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799252, "uuid": "738554c8-d14b-4db4-94cd-bac5ca1d4aa2", "comment": "Malware payload (RaccoonStealer)", "value": "18af8e4f317e4d9ffe97d1c2806f4b03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799252, "uuid": "78be6141-8233-4d37-b28e-fe83eefbf65a", "comment": "Malware payload (RaccoonStealer)", "value": "8bbb2744b45feea5115cf0da55e4bdd4eec08b4bb64992e41aca8aef68304b43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799252, "uuid": "44944b4c-fe79-4c08-9d52-942f54798dab", "comment": "Malware payload (RaccoonStealer)", "value": "8f03bb44b0faabc2fa5f176d46c50d176f90645a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799252, "uuid": "3caf7cfa-969c-40bd-95b4-99ed8c1a7ecf", "comment": "Malware payload (RaccoonStealer)", "value": "2e045e54905a00ea1f2307d9164eb66969dc0cc4ee73dda18830733eb417e999f2f6dc3135ddd067f29b947f9a74fb12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799252, "uuid": "eeb44117-88d7-4c0a-b051-4dffa0de5f8e", "value": "T19D9412117C70D033C892E9B05E81DA91F52AB8D11FB91247BBCD9FAF5F622C0BA2D255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799252, "uuid": "135bd00d-e97c-4014-980c-1e406570acb1", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799252, "uuid": "604ebd41-eb3a-494a-a648-c1646d22a169", "value": "12288:ce8AOuYjPHjJWHIePnKSH0PWm5AB1gdfySVrL0/jwP3:cpthv0IonS+kAglySVnGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799252, "uuid": "4ce90d1e-0dda-45b2-bbc7-3ef6e44d1588", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799252, "uuid": "de80cad8-b725-4ea9-b797-9d05eda1d323", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799252, "uuid": "5e86dcd7-c957-441b-81a4-3aa2648b4bf5", "value": "18af8e4f317e4d9ffe97d1c2806f4b03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7dfadc-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629805077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805077, "uuid": "ec708ab4-d588-444d-b667-b8161d3b6433", "comment": "Malware payload (AZORult)", "value": "28c228b172f4e97225bb582006c68486", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805077, "uuid": "067d1bb0-7f31-4739-9b2f-5fad26a3f1a7", "comment": "Malware payload (AZORult)", "value": "8bed7a01b95a33cc111234b00e3f1ec77f7b234b9b2837b052e31ed10263d7bc", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805077, "uuid": "b5fa0ea3-bda2-4d27-9c27-7f0eda3a5050", "comment": "Malware payload (AZORult)", "value": "b1643e69409409033cce113d9c37f78cc990c862", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805077, "uuid": "eee3e6b5-a9ff-4ecb-bae2-39835d99ee35", "comment": "Malware payload (AZORult)", "value": "b65ee84b03d0c78662332c75d8b07a8e1226425422d075c8d72163cf892d6efb09f1df9e2a3516c1c75113054e27a4a1", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805077, "uuid": "d1aa515b-6afb-4699-9f0a-6fa1dbbeab93", "value": "T145241222E922C86DDC17057606DE65DA575A7E36A302BCE7DB0837A4D0B1FF04A3C9C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805077, "uuid": "36d1f310-d5b5-47b9-b0d8-6bb22d24f777", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805077, "uuid": "af6de01b-b9ba-4de5-a598-1cdda027e4e4", "value": "6144:13c8cGirJL/k2e5pHJkvl0DNvqIADNn7gC4eR:NAGirJ4DGvl0D5qeIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805077, "uuid": "f712273d-6387-4218-9385-9cd147c6dca0", "value": 229998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805077, "uuid": "59910c53-3b1b-44e9-b53e-795f5b60ac7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805077, "uuid": "22a50a7e-731e-419c-b3b2-50922de123a5", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9aa3308-04c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629799546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799546, "uuid": "703d5de0-d984-4556-80bd-4bddda5e382e", "comment": "Malware payload (CobaltStrike)", "value": "943cb4b5ffb69926803d7f9c3dd1bc7c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799546, "uuid": "6b147c82-3983-4ac0-8854-ad44a734656c", "comment": "Malware payload (CobaltStrike)", "value": "8ccd9591e9438a313a21958c7f8edce4b238bbb147e8284ec4a2b7b488b920ca", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799546, "uuid": "eb13d768-8147-47cf-85a2-6f4878e2998e", "comment": "Malware payload (CobaltStrike)", "value": "2459b3ee3761e20439494ab11a7bd5aa96f3913c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799546, "uuid": "374057ea-8e33-42d6-9b01-8cf5f429f91e", "comment": "Malware payload (CobaltStrike)", "value": "1411083bbaf7e5ec2d463f6800a20f8ce5ff616fc99c41641c45b5392b9a352f749e2a3e7bf7ca65b050d0d939944ba5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799546, "uuid": "7ea03d1e-e61b-4dc1-80aa-b50904927da6", "value": "T18554F102B2D190B3D62E9630A9B84B524EBE7C131DF5DC492FED024C5EA19D46A7CF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799546, "uuid": "31aaf4cc-85f8-4192-a6e3-6b14bafa960c", "value": "997dc006256bf1994fede4ad2eddce3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799546, "uuid": "5651aa64-5db1-4394-97e7-94ac23b17e27", "value": "6144:UZC4MTZhJZa5u+/c/xDbUkQFXzF7goI1WtkBTkoLOhSo:UUj7Za5a+RF7aTNLOh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799546, "uuid": "96ac2613-8846-468a-9ed1-52d0570ca61f", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799546, "uuid": "960be3e0-5132-49b3-a166-afb13ae4e084", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799546, "uuid": "b120e0d4-c71c-436a-a07f-565da7e33c22", "value": "JudianService.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d27ed8e-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629805645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805645, "uuid": "54cd5140-4467-462c-af95-1d94e2dcda68", "comment": "Malware payload (Formbook)", "value": "030e3225b86d05330f39b451f733bb7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805645, "uuid": "e69bcc83-48b8-434d-a533-5cd1d37699db", "comment": "Malware payload (Formbook)", "value": "8d6843a7f3cf4ffef14d352860728eba74509878e32a29fb52fa398218a68f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805645, "uuid": "f5e86c3f-bdc8-46ee-9877-25ff549e26ae", "comment": "Malware payload (Formbook)", "value": "f2df37b1733268f470670eab5264b49783399486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805645, "uuid": "8f4be445-ab45-4eb6-a764-57e22e47411f", "comment": "Malware payload (Formbook)", "value": "7bb246bf48effd8df46405cf566061e43c02bdcea7167eb5dfadb2d8a5f4a503d223f9b61453783006c9e780c88d84eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805645, "uuid": "6102191c-d80a-409c-929e-0ad2b2da7799", "value": "T1F7159D3063C9C284EC1A8EF0167CF79402F235E7B6C5CD6A16EA324CCE5E9D2661765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805645, "uuid": "434e0361-bd96-4bbb-86b0-ffc125a8e9e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805645, "uuid": "26fe0f6c-ba52-46d9-bc0e-f36a9aa6447a", "value": "12288:wkcsGI/c8N+tHygtNZwK+l0dySWOjkDZ5Flp0pfGODt/qcYdmWnBPAXm2EObbB:wWQtHltNq4ySJcH0fR5xY7nBim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805645, "uuid": "f872901a-0338-40ed-9418-3e030b8fe8e6", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805645, "uuid": "1ba03301-6edb-4ad9-903c-0269cc415e5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805645, "uuid": "cd0aefe1-d126-42d4-a61a-f1220eb792f2", "value": "030e3225b86d05330f39b451f733bb7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a793ff-0502-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629826712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826712, "uuid": "313d56ae-39d1-490b-915b-0d08e2ff2db3", "comment": "Malware payload (AgentTesla)", "value": "5078ba73d59e8234a7c4f7196da6570f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826712, "uuid": "c5225e42-b286-4ec9-aff2-fe55827f41ab", "comment": "Malware payload (AgentTesla)", "value": "8dac04e57776f7621e48c09b53b4c7ad821474d144a28ff4b25eca4755e6e239", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826712, "uuid": "8fd03460-b011-4a72-8b3c-070ce6739357", "comment": "Malware payload (AgentTesla)", "value": "e3c253ce01b2da4cc373bbc5fdaf4db4504403d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826712, "uuid": "e3520fd4-f530-4acb-a1bf-7b8925e511de", "comment": "Malware payload (AgentTesla)", "value": "5273107a16086c97d3c12ad655e16c40a1e354bbab2dec67abf3d9ec03b7fc663b41f72eb24a96ac44f38d5c9c1b3bdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826712, "uuid": "5505669d-b3fe-4171-bd93-a862a49a9eff", "value": "T163058D9CB61075EFC827C876D9A91C10AF60787B430BD213A05362AE9E0E697DF165F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826712, "uuid": "56c1f718-dddb-4c03-860e-0dfb4dc44b6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826712, "uuid": "1a6fc8a2-25ea-423f-944f-ed77b661f0de", "value": "12288:ZC3bAA1yRNzDQevHU1VVA57XjpMIR3rG2QnEfU4sT3Cv32BFarzEymn6UFYiBRC/:ZCMfURsTlMM3Q6UF4Gh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826712, "uuid": "f6cd23d9-0c27-4af8-be94-ca8a77435a5e", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826712, "uuid": "5a270263-3f24-49f9-96c8-bee8a42dd75f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826712, "uuid": "588ef67d-9540-49fb-a2dd-6f0a05243131", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d2bc0b-047f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629770740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770740, "uuid": "c8fb1e02-3a5c-42aa-86d7-ba8de9fbbd1a", "comment": "Malware payload (Loki)", "value": "252cae0537d8c3aa42d8e69ad802b966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770740, "uuid": "8b1b6dfa-559c-47b6-af26-353a59d9705f", "comment": "Malware payload (Loki)", "value": "8e166eb3487a243e21ddcfa8a88173a7f1b2b37de18a55f4517003027547fef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770740, "uuid": "ee881272-9e83-4cba-a447-ecdda2c3e4b6", "comment": "Malware payload (Loki)", "value": "7d5a78867737c91bb9cfbd88a3aa20c89900fdb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770740, "uuid": "708b8bd4-2898-43df-b39d-1a86f4f62c95", "comment": "Malware payload (Loki)", "value": "a0218f69814df5131444a69f19564c57b8c1ef6ac70a46f0d00f36cd6abe9cf39ae77ee7e2b30cd4cca708edb2b77670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770740, "uuid": "7a1d9966-2a62-4cfc-9a3a-b84fe1b69261", "value": "T12E340268A20FC1D8D37EADF229B8047DA161AF713DCDF1C67125F96D1A37A290433985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770740, "uuid": "b12111c8-da1b-4744-bce3-0c7a78274e81", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770740, "uuid": "d9329944-55ea-4a88-85ca-b2f3ee5edb13", "value": "6144:cxB+lzu0FKw3wIZ6ifYfFPxhypIahW9LYJvtKs5xi:cb+Zu0FKw0ZhOIm7GUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629770740, "uuid": "a68b085a-de3f-4a4a-925a-a08f173ab207", "value": 230363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629770740, "uuid": "2264af33-618f-47c2-aef0-ad91791ad9bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770740, "uuid": "b0ddd424-941d-4ec1-a2bb-2dc675b00478", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7537786-04d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629808051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808051, "uuid": "a51a2e50-f16f-4247-aec7-136a364cdbb3", "comment": "Malware payload (RaccoonStealer)", "value": "2fd6c52c1d56d54b61ea11bd7848b279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808051, "uuid": "10f1e7d4-28ab-44f5-9667-33b255c68984", "comment": "Malware payload (RaccoonStealer)", "value": "8e90387cf2624357d85a49a7b28b4af5eeef893d3daa7fe9a84459cdf6d453c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808051, "uuid": "18678e1c-d4d1-4e49-bbf0-8433d32f4578", "comment": "Malware payload (RaccoonStealer)", "value": "c469f829b903d843dedd5f885d59da3a99f3e240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808051, "uuid": "194a6284-a74a-4de2-b40e-fccc0332c311", "comment": "Malware payload (RaccoonStealer)", "value": "4e5022b8a8bb0c841ba4627e7d06e38f4639a92e420aeba27551cefa0a73c2ede6f7704620a189d6ceb17939f8b13ea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808051, "uuid": "32063cce-add3-40b2-b679-3ab7897996d2", "value": "T116E3BE1534F4C43BC44649B144E5CAB0EA3BF8626F71654333E89B6FAF653E0B629392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808051, "uuid": "31c0b188-0dfb-49fc-b9e2-8dd0c73d0e15", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808051, "uuid": "3f2cf086-e924-4319-a000-ee97425eb658", "value": "1536:BmRhYgE1g4PsoQ99kpuW1TUbJiQ6Tfh4FTsxEU5D/+BriobhO2Yp2:JIoQ6TUbJD6TfnEU5DggM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808051, "uuid": "e99f80a4-d220-49cf-900f-f00df25145d9", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808051, "uuid": "58092c8b-aa20-4c25-9cb6-c433e799d575", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808051, "uuid": "84f70a83-8bd4-4a4b-bd3f-5c6b51baf59d", "value": "2fd6c52c1d56d54b61ea11bd7848b279.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f242567-04e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629813004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813004, "uuid": "902720f9-c7e9-49c3-b119-c6d8238fedd8", "comment": "Malware payload (Mirai)", "value": "905630e0e13475cc588e7d3c30d7c96e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813004, "uuid": "a624d050-1017-4581-bd17-3ba0d3feac4f", "comment": "Malware payload (Mirai)", "value": "8ef3505c2a03ff66adeb104f94996d9bda535679472f3fccfa6a2462a0676d78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813004, "uuid": "d70f36cf-6f5c-477c-a296-55a4060d6531", "comment": "Malware payload (Mirai)", "value": "c6c672347b18f3580f58c879f8196a5d4b25401d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813004, "uuid": "e295d14a-13bc-49c0-adc0-43f6214dd061", "comment": "Malware payload (Mirai)", "value": "bb4f21943ccd3a2833e3f2b2efa5425954f56cf9421944070b129fc74d3fe5ac24fe2a720815c19b7425cab6ce93c2bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813004, "uuid": "f873b826-11c1-4669-b850-fe78c657a77d", "value": "T1ADE34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813004, "uuid": "c7dfdffe-4e4d-4b2c-bd19-c1c78f5469c0", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1Qo:walgM69pe0QmlTvI8t9mrsplDKZUQQBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629813004, "uuid": "cf59c942-555a-4760-bb8e-3765da57ed2a", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629813004, "uuid": "51b42c5f-1e3f-4390-80a0-8a58386f2f96", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813004, "uuid": "e5bee1da-5181-479d-848f-4e3a6eee93b9", "value": "loligang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47926fe7-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629805314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805314, "uuid": "9dda4ee2-b685-4d21-a4a9-d434718de47a", "comment": "Malware payload (Smoke Loader)", "value": "ed8f3190e30a52d989817d06142f9509", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805314, "uuid": "551bc3f3-dc9b-4d61-8e87-9c1e72af3007", "comment": "Malware payload (Smoke Loader)", "value": "8f6aeab4ba06d05d419fa32d5d13df4c21636e926549ea58cb686e4b1b6c92ba", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805314, "uuid": "48a98d0c-fc87-4abc-b759-c190a4138c9f", "comment": "Malware payload (Smoke Loader)", "value": "5bc2e0fdeeb5a40bc29733f287b151569812901c", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805314, "uuid": "972802fb-1153-4464-823e-0790407ee040", "comment": "Malware payload (Smoke Loader)", "value": "c7486e25bca138d9a70b0339be2a7816e69a4a82cd048bc956fc4fafc599c95e335ee95cd2bb0fbbb8bf8ee357eaec45", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805314, "uuid": "8755ff10-dd53-483a-a061-7e72d2e52a75", "value": "T10DD3BE1035F0C837D096057008D5CAA0EA2BF971AB72D503B7E99B6E5FE03D0BB69392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805314, "uuid": "fa837d41-1e10-4723-80f6-dfa21b236e5c", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805314, "uuid": "f28bb2af-f659-4eef-b3db-169925de743e", "value": "1536:B4hT9MEhkNikYCw3xaZ3sf9uWX+gY88Ty7ph6I5uRRiVjk8BriobhO2Yp2:JjNCUdsftJ5EI5uRRSkugM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805314, "uuid": "04d229e9-49ed-457a-a1bf-e01db360fc00", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805314, "uuid": "089f6395-c817-47a5-93d0-ccd382606733", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805314, "uuid": "55b1aaec-61af-4bb3-bb69-ed7b9ea77a0e", "value": "ed8f3190e30a52d989817d06142f9509.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b350e2b8-04a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629786167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786167, "uuid": "17ec071d-dc68-4c69-acd9-dfba3c084d21", "comment": "Malware payload (a310Logger)", "value": "bd047836bb8805934054d02d6d4263f6", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "CryptoWallets.zip", "colour": "#7BDAFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786167, "uuid": "75711db0-dca8-40c7-bb8a-b515a86eae3d", "comment": "Malware payload (a310Logger)", "value": "8fb7d7c33173d49da7907bf7bec5eea3d7d7f79ea3fef39bedf3de4b22f76987", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "CryptoWallets.zip", "colour": "#7BDAFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786167, "uuid": "bda7f763-24a6-4010-83db-e30f11c876f8", "comment": "Malware payload (a310Logger)", "value": "235a213a7bb4fc944199ec54a04138c0c4d0150d", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "CryptoWallets.zip", "colour": "#7BDAFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786167, "uuid": "120ea7a0-7a2a-42ad-9685-67c03c3b2369", "comment": "Malware payload (a310Logger)", "value": "f08ac357424b77ee31e727c152c4ceaacb87a8aaf1c9a4a19a607b8def23287e01a418440013a0ba2e99a3e0868edabd", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "CryptoWallets.zip", "colour": "#7BDAFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786167, "uuid": "7dca4378-fa7d-4c9d-9b9f-742b61f88018", "value": "T1B4B4123A3D8C5937F7AE74766EA551A6F5433E24B73C817260AA78138C7A90F78300B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786167, "uuid": "51db9c1a-1199-438a-93d1-8ec39b1fdf40", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786167, "uuid": "f0884971-e2d2-458a-a686-97ed2aef4be3", "value": "12288:TKhCCCCCCCCCCCCC1g5al+tpTQTujAyfiIsdCCCCCCCCCCCCCCCCCCC/c2XvB5+5:TKnfSIT+L4M6U/QjortrtmHTdSqBV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786167, "uuid": "66dc5db3-d52c-4f51-bd75-3ed9dfc3cf47", "value": 524515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786167, "uuid": "ce893873-9aaf-4ba7-9fdc-e1f5459f6e1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786167, "uuid": "1278f9bc-b50a-4f74-a7e2-c7476d757b1d", "value": "SKQRMFE00058945.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0d3669-0501-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629826506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826506, "uuid": "0f3e2fe0-10a4-464a-8141-8148171190ec", "comment": "Malware payload", "value": "9768641a682e38868db30bf38640102d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826506, "uuid": "fc2c1d23-1389-4090-ac7f-e250f91a418e", "comment": "Malware payload", "value": "9056bbdabbfab971c10af27c83a2019a463fa5835a34bd812c4ee870052220cf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826506, "uuid": "34527add-2109-4fe8-ba9d-bc805a31cce5", "comment": "Malware payload", "value": "155868d768b402164a8e3603af7dd06e248df2b9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826506, "uuid": "6129cab5-1a9d-421e-879d-d4cc3ac08b05", "comment": "Malware payload", "value": "70cfc5d9397b6d9bc12eda217788006e4df8c25a9c3d523dc01053e347099ddaf8101693389881d9a54f77de04b3a135", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826506, "uuid": "9bd5ac1a-f9cb-4740-868f-b645226c6e67", "value": "T1E7C34EBCC05702A48F81ABB8672BAF45018CB56DF7889633367CAB3557E2D3A5116C7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826506, "uuid": "53b3b803-7929-415c-a51d-8fba494fb9d3", "value": "384:mjfA59DqiqI/I+yDm+oPsSto2uGbW3YFvunZOCeD:mjuqPoXuGbhBunEC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826506, "uuid": "9d06ac1a-7a5b-498b-8953-5aa48d944ed3", "value": 118680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826506, "uuid": "ed18177b-a973-415c-834e-2eab96298320", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826506, "uuid": "c8f751ab-4287-4504-9a2f-426035d8a18a", "value": "orden de compra.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bc873d-04c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (StealthWorker)", "timestamp": 1629800766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800766, "uuid": "aacbf435-1e4f-4c67-9187-1b6ceb64545a", "comment": "Malware payload (StealthWorker)", "value": "1d153b36dff89349d52e0b5847b9a8a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800766, "uuid": "099e3287-3671-41e5-aade-85e86610caa0", "comment": "Malware payload (StealthWorker)", "value": "9093d320baf890134c0fc716eaa10cf5027dd4e804570867506537b555fd5ea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800766, "uuid": "becffe1a-76e9-4d90-ba3d-6ac27646cb6c", "comment": "Malware payload (StealthWorker)", "value": "8329a08acea7666e06e75af8e3d88c36e777f17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800766, "uuid": "3ce6664b-a6b2-4105-92e7-457cc058073c", "comment": "Malware payload (StealthWorker)", "value": "0e27fd74f96c57a9636eb8f20588b6de148be16d8ea6b10f4ecfd73999790af166575047b936b84df5287d38190ea5b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800766, "uuid": "40da2d1a-ab4d-4e10-8a36-715711eba420", "value": "T177E3BE1176D0C072D445813C48E7CA90E62EFD61EFB1D94B3BD8266E1F712D0BB2A2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800766, "uuid": "71ed236b-dfe9-40c8-8a12-4fa92eb2ab92", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800766, "uuid": "281048d9-00fd-4a66-9a84-76fd9064b743", "value": "3072:km7BEuvfr02yZzFRPpYC585IXiCwBwJQKt:DESfrZy9yit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629800766, "uuid": "4530e6f9-b8bd-4e05-8bab-d4dbccef25ab", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629800766, "uuid": "77ba051d-8607-4549-b712-e8d5d6935121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800766, "uuid": "7756c3e4-ee5c-4ab1-85da-38fc39d3eeee", "value": "1d153b36dff89349d52e0b5847b9a8a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b9c15b-04d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629808396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808396, "uuid": "466b82b8-f908-44c1-a970-52ee4f6121f7", "comment": "Malware payload (AveMariaRAT)", "value": "bd8e806f55052da02242c6b39e09efa1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808396, "uuid": "87469956-cf38-412f-8b70-0b564bc21a5c", "comment": "Malware payload (AveMariaRAT)", "value": "90c579c57ac202ad7230581299a82c3aba896fc61673efdb0e64fbd719a237f8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808396, "uuid": "be83e70e-edb7-40d2-9cdb-0dbd59dfc35f", "comment": "Malware payload (AveMariaRAT)", "value": "320eea96a9c2fe2d9a4bcca451a99318ca7a6e52", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808396, "uuid": "f274d250-3404-40c1-885e-05a613fec925", "comment": "Malware payload (AveMariaRAT)", "value": "2a77180d15113f39393824bac077076e998b1aaeb623345b9586ca4bc8e9095d99905f4c64ac331fc0ead7b6805a16b4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808396, "uuid": "c122b233-3824-4ce5-b1cb-26822c94430e", "value": "T12394AE5EF731419BE811CE3A2669887E6F743D74EC4A05093453BF962EB230D1D92E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808396, "uuid": "e5cce1f6-95ee-460b-98d7-b812a712237d", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808396, "uuid": "80666081-6d81-45b9-be4f-460e8ffba6b6", "value": "6144:d+MsCS1/AjgOqMVW6vap3FKdGg5lirWsGXdvosPBkp1xB/nI19rkpS:8SShAHqH6ip18PirWsEByBa9rk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808396, "uuid": "89546a3b-dd2f-46f6-8d5a-9a1a9c3238ee", "value": 412260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808396, "uuid": "7f666e51-ab84-4ba8-acff-e1c33ec626c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808396, "uuid": "b9247463-ec17-4cf4-82b8-59a04e0cb6ea", "value": "Declaration.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1858684-04d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1629807183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807183, "uuid": "9146c98a-a47a-4173-9fb2-bf45a2c3928c", "comment": "Malware payload (Alien)", "value": "52abe8e7b491c4674f924c7c116e0998", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807183, "uuid": "6e5d57c9-fff2-4af2-85d3-ef2ae65a2d4f", "comment": "Malware payload (Alien)", "value": "90ddf3acf9053e3d61ce3a125bd4998c71e75621567040cd31d3d27e76d3876f", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807183, "uuid": "c1a20629-9207-4722-bdba-6eb7b1fac9dc", "comment": "Malware payload (Alien)", "value": "790ac6997c1b9042e157e4dd2f314d5077155ecc", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807183, "uuid": "e3e1da13-c7c0-4a80-a9b7-df9f4ae27f3c", "comment": "Malware payload (Alien)", "value": "52f892cea8255e9a1290aab8ceddcc729a6f89365a5f8831ea8a0b2006fd27d309e57196b293df89c670b602b58ece6b", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807183, "uuid": "ce41af42-8d89-4d39-a187-b7f3790cd3d8", "value": "T1C9F53315A7924854E46B63324143D113EFAD24ECD199B83F9679089F2CEBFC8C346DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807183, "uuid": "0d9b5a82-2cf0-4131-a972-3c6406ccc516", "value": "98304:9pg60BgELESYXj60Y2tGiR640ejpcBtmHXTIl:9pguSyj605tGiR0Eqrmcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629807183, "uuid": "b006643a-a8b4-47a2-82c8-d4c7ae7f385a", "value": 3322556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629807183, "uuid": "fe163820-cffb-465b-b127-7cc9f6848a0a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807183, "uuid": "839efeed-a014-4672-8e69-9ee94cfe0ccc", "value": "Bildirim_Cubugu.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6b6249-0529-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629843706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843706, "uuid": "bfe2a707-94ba-4480-bce0-6b1a0e8e0e6b", "comment": "Malware payload", "value": "dbb673b77c5e9f008c0f3705326f5182", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843706, "uuid": "4a7f196b-3db2-4084-8d79-10f73a65341a", "comment": "Malware payload", "value": "91b8264514f782c04150b6585d2e0dcfd29b503f4d2449a3e2fad80c2a08f24b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843706, "uuid": "3c0ca372-1094-43c9-a5db-b04f16215d1e", "comment": "Malware payload", "value": "3fb9eaabe7ca7d7ae9b9f0789423ed149a30b955", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843706, "uuid": "7a03c0e5-270b-4f34-9e23-9b633bce256b", "comment": "Malware payload", "value": "1b7c160a20a4b2d8da3ffd4c0ddbc053f32feecedcfd9f56db6ef9fa36d8e5351cd23a046d3b792714108df90c8b3d8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843706, "uuid": "e80635ac-0215-4176-883f-64e02e7c4de8", "value": "T13BC3842E7E12BBBEE668863107F35F70879521D237A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843706, "uuid": "274b0034-34fc-4ae0-8579-424c83c23d97", "value": "1536:g7je1TYGq+f+A02rKXzeve1eTe8p2rKXIeum9Y0GAzQj1l72HBebERLWfRZrmW+i:/a1UW0MZQHXB6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629843706, "uuid": "0886ea12-0e95-4632-88dd-48ec489c81e9", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629843706, "uuid": "b3285acf-5f68-4ced-a881-ba34aea8b72a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843706, "uuid": "e7fdb1cd-953e-4556-8f92-3a030e8c6ddd", "value": "dbb673b77c5e9f008c0f3705326f5182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5bc7c1-049e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629783979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783979, "uuid": "74942f69-d0e5-4a77-9429-a5cf075bd3bd", "comment": "Malware payload (SnakeKeylogger)", "value": "bcdefb2463aa0840c35c5ee935fabc45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783979, "uuid": "34426bc7-01df-4dbd-a549-2fc043f12df2", "comment": "Malware payload (SnakeKeylogger)", "value": "91e8763b50b0155b4984134d95d36fb9d92bca3a5db8d37bb75ff8faf88dbc63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783979, "uuid": "e677cbae-b328-42d0-a377-3e59faa4511d", "comment": "Malware payload (SnakeKeylogger)", "value": "ed3d38f62d4f97e70e9a4bea32826dcb14c2a87c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783979, "uuid": "a373c29c-7f62-47c2-a59c-d0e4d35d9973", "comment": "Malware payload (SnakeKeylogger)", "value": "e2782c63ab89cdb99f80e09dfb6b2515c2383c30da7589e7ee659757f67690694402173ce936e570d5475d5d9fe68fd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783979, "uuid": "248e11c2-fce2-4afd-ad07-b17019e223b0", "value": "T1E194AF1EB73585E7E811CE7626658C3E5F706C35ED1A041E3442BE9A2FB230D2D52E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783979, "uuid": "539f4370-73c0-4f31-9228-19dd0a91b94f", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783979, "uuid": "529a5c06-b7c1-4513-9c97-2ac1fe7d4ccc", "value": "6144:2+MsCS1/AjgOqMVeAXGiJN7zuSWRF7Jnb8hT6UoMrEWnYq+civhuvG9:VSShAHqqG+/uSKFdghTb1lh3ivhuvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629783979, "uuid": "846427db-4aea-41cc-b85f-ac4d67df4717", "value": 415772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629783979, "uuid": "1ea83c79-aa92-49a2-9d53-0b44e9fbfd46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783979, "uuid": "63786d64-cc90-4351-a245-8dd24e92b5c4", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cc66c3-0511-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629833146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833146, "uuid": "37213cb8-737e-4e6d-aaa3-7f6e89984b92", "comment": "Malware payload", "value": "074ed5398b616205258192bf7a3b6d01", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833146, "uuid": "568c6fb3-58e6-4232-b181-27eb1f2b15dd", "comment": "Malware payload", "value": "924657d7883d8b569b9ab1a979b5492b7b6426ead1435e422b6c21dafd6657c9", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833146, "uuid": "aad7bf22-1a41-47b4-8809-c1be8d495f2f", "comment": "Malware payload", "value": "2b3ddae8c9f179fa84254166af02f37f34ce12c6", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629833146, "uuid": "5f52ee76-9369-40b7-a138-1375f64b7f3f", "comment": "Malware payload", "value": "0fefcb4bd2052a4eddf223752b8a3cbd510123bc3accdf8b6e04de04c08c1372d7a61ecfd1f46596ef9418f0c0bbc52b", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833146, "uuid": "66625608-1042-4923-8662-cfdbfb0ed118", "value": "T1CA03F905B391C622F19246354DD7CBDB733DBC09AE21872B33947B0EBC7A6B49A16724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833146, "uuid": "ffcb7907-62a8-46bf-ae9b-d0f08d17f2a2", "value": "384:3S9D8yGcSdW+wRsCBkcsUAwJVVCNTBJukz7Wo8I5dginAvYthGjD2/:aVKCBKeVCTuqWo8MKDD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629833146, "uuid": "dfe28e91-03ab-4ec6-8d13-b1a330f00be6", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629833146, "uuid": "d7afc3f8-318e-414d-bf6b-932c0953806f", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629833146, "uuid": "8597ea1b-eff9-475b-a81a-4af0de0c6204", "value": "downloadfile.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24561c04-0497-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629780773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780773, "uuid": "dcc0b3a1-0a0e-43a8-9f6d-32be61ae31d7", "comment": "Malware payload (Loki)", "value": "0b27461ca634d4d0829cda88f946725c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780773, "uuid": "584b7c6b-874e-45c5-ba73-f6d6d050a078", "comment": "Malware payload (Loki)", "value": "92b440cfe74b77457eae1df0ff6273de5534060754919b7c47b3f0d705a8591b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780773, "uuid": "d460f99a-938c-4478-a5b5-a9f7c18dbaf4", "comment": "Malware payload (Loki)", "value": "f50df39a0ea97ace8914602dc0528e2a760cd9af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780773, "uuid": "ca1c6c8d-5b1d-4ba8-9d17-33e0badc4434", "comment": "Malware payload (Loki)", "value": "6a52ce6b0e15101fb34277eb2bff6c4de13abfbacd5fe88a34e00626e2018ae324403fb921e83ba651662914e4672664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780773, "uuid": "2a14c483-7f29-462c-b393-c46a409e1930", "value": "T1FC255C25B78076D6D8A50F328823168843F7E95B2631F76F18C836E95D3261BCB1F693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780773, "uuid": "67edf0b5-e0e6-4f57-82f1-1ed00e27e120", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780773, "uuid": "6a17613b-ecc1-4dc8-879c-980b0ad6a517", "value": "12288:+AOQu8/GJAIEnsFqdxlpsrQsLhBN9aTom5OunaaNxjbUk:+Ag8/8ABsUohf9aTXEubjgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629780773, "uuid": "2c983d72-eb50-4f1e-b3f6-4f90650e03d2", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629780773, "uuid": "a6998350-a162-4769-8bed-c42303c7951d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780773, "uuid": "393e1e6b-1b99-4466-8c46-42cc4b2e86cc", "value": "TMG_KOREA-8_018RMH426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300f03c2-04d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629808281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808281, "uuid": "932e7146-0783-461c-91a4-55523dd47092", "comment": "Malware payload (Mirai)", "value": "e8f6a54ea5784fa263fc8b7d443f97e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808281, "uuid": "ba60ba8e-0487-4a8a-b6d0-1efac31625fe", "comment": "Malware payload (Mirai)", "value": "933249ba4dbbf012c3844aad3704206903f42a9abe88746bce56aa16143e4656", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808281, "uuid": "a0b5e35a-1231-4b76-959c-eee6dce7852f", "comment": "Malware payload (Mirai)", "value": "296635b9681aecf007b7f18657fec4687129d761", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808281, "uuid": "5169cfc1-4377-406f-9e25-c577e010606f", "comment": "Malware payload (Mirai)", "value": "cdc101d7d7d1db821bcf873aa8e79f131e6e0fbcea470357e1c65cd29e1a25b792c1ae0b9e7263a92e631bfb5028a3b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808281, "uuid": "e80c8087-d324-47da-9139-cc9180c0193f", "value": "T15773E606EF910EBBCC6FDD334AA90B5234CCA54722A53B363674C938F65A54B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808281, "uuid": "5aadada3-af45-46d8-9af4-353a16db3a96", "value": "1536:26yTPHmIAujj3pEmkvPZmMga5cdmOQM95Hn3GZpOr:2tTPuuQvPPcdmOQO3Gze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808281, "uuid": "132491cb-e9f5-48b8-b355-3df33d1fc7c5", "value": 76540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808281, "uuid": "e9db3673-3f30-452a-b329-cc5b6fef68e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808281, "uuid": "b628c17d-6042-4a27-9d90-6c890cad7129", "value": "e8f6a54ea5784fa263fc8b7d443f97e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b1ba79-04bc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629796667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796667, "uuid": "a550d1f2-9308-4b88-9c3b-e3a1bfe18af0", "comment": "Malware payload (Formbook)", "value": "d6c1ab937a57897b028ec91747a542b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796667, "uuid": "22aacbd1-c59d-49e9-800c-af96c22acf7e", "comment": "Malware payload (Formbook)", "value": "93e0c13d2e22b34b8fa11806b2545fb10526cb04ff95002788d8ae5c8a39d191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796667, "uuid": "3023a262-041c-40d2-9cc2-e806f581e19b", "comment": "Malware payload (Formbook)", "value": "b5f980665fce57c8cde8f47db680e163ed555252", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796667, "uuid": "4bce32b8-27bf-411e-893a-91d254fdbd8b", "comment": "Malware payload (Formbook)", "value": "3af8d20012dbe061b0b0ab63361fbf02274c57498f48bd6ded5d90e440037efa7797d0d05cf2a5f92551fc0f95c4779b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796667, "uuid": "398d6ac4-c1a1-47ac-bcc7-5aaa8951ebb9", "value": "T185258D3063C9C294EC1A8FF0167CBB9402F235E7B6C5CD6A16DA720CCE5A9D16B0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796667, "uuid": "fab7a37e-4e4a-42a6-b0e3-e467069851fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796667, "uuid": "ae1cc65b-93f5-4dbb-bf56-4fb6e3b47558", "value": "12288:OvcsGI/cw8QtdUhwLCywc4Gi8rsG+R+AW56aZ/iiyEJ5aUexV2EObbdYT:OyqdbtwmRIxCkaZ/7Z5aUexVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629796667, "uuid": "4aa9d592-4bbe-48fc-a681-0011efb2f228", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629796667, "uuid": "ea019d57-2225-42ce-a721-941c70514bef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796667, "uuid": "119ecfc7-ca5c-4d1d-baf6-0c9c54e167ac", "value": "purchase order No. 00109877 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf112dcf-04b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629792656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792656, "uuid": "7ae60f51-38e8-49ac-a80f-96137af2efe1", "comment": "Malware payload (Mirai)", "value": "6f59df7fd2515652f7436f58083c0483", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792656, "uuid": "fcc393dc-34bf-4a76-9b01-d4e843a14995", "comment": "Malware payload (Mirai)", "value": "94012a38d841e1ba68bb6f616d5e6de634f1960c599509255e925f6d860f3af7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792656, "uuid": "d7e2f0c3-629e-4ce8-a6b9-cbe457b87602", "comment": "Malware payload (Mirai)", "value": "99114f06c3f46cde6ed680c24e514fda521a6189", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792656, "uuid": "cfcd71ea-2da8-4ea3-90d8-d3adb0381996", "comment": "Malware payload (Mirai)", "value": "0f77e144b4e778c311718e709b04ad5cd6c70515f53bcbb0401c90b9e49d069c4827d27ad91a4a74a9f0055806390047", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792656, "uuid": "1b99be46-47c5-474f-b4b9-390d67749a5f", "value": "T172B31877A4515FB3C045A5F125BA99320F12AC931B1F1A84763CBAB44B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792656, "uuid": "2653a90f-07ae-48b7-b78c-ead5c33603c1", "value": "3072:OwNUWqpCgYXlrSyWUfMNnMmH1cuEgv26uN/:OwNjqpC/G8fMNnMmH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792656, "uuid": "546e245c-1cdc-4cc9-94f4-0d37a39c0734", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792656, "uuid": "420bbc85-41d9-4922-bdc1-3ad028e321ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792656, "uuid": "ab698198-1e91-4ec9-afd5-5d4d04b3715d", "value": "6f59df7fd2515652f7436f58083c0483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d0ba82-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629812659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812659, "uuid": "81de9b6b-bde6-4e78-a274-0c7caa44af16", "comment": "Malware payload", "value": "19e4c4f601f1459b6755776c7aec2604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812659, "uuid": "451d8ec5-b290-402a-ae60-ed35b582a449", "comment": "Malware payload", "value": "9460ffe580332fe64bb4f35bb63dc6a4302f3613718a04dc0986cea989160039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812659, "uuid": "814d16aa-fab0-4223-bb96-4717c8765fd2", "comment": "Malware payload", "value": "71d8398652a891d09492db64bc1458349ba4cdbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812659, "uuid": "a82fe411-9da7-4bb6-8878-e0648659b57d", "comment": "Malware payload", "value": "7cf7bf865a17b5cfde4d80ac47064f62d6c4cb13a2fa907eefd3df2ff60c838a002b363f52bbab99db9c2a3531acee72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812659, "uuid": "cf585d33-d4f1-43cd-ae1a-5e53c5de6b6f", "value": "T1BDC4BF3532DA355DF35991709D90B748B6B268FEBE93531F261B1A2C94E3268C7C230E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812659, "uuid": "13d1fce7-7041-4865-a5fb-3fb8479e20d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812659, "uuid": "6b89c39b-0eeb-49aa-9a49-6c550364666e", "value": "12288:KsztnZfvdeneL2iNF2iNi4QissaMJcR/V:KspZF1j1esId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812659, "uuid": "302a5499-eee5-4ae5-a74e-0922e5fbaff6", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812659, "uuid": "5d5aa670-9eb7-4792-a2f0-13c7d72253aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812659, "uuid": "ac3c15f6-0ca5-4672-8825-b502d60e9691", "value": "19e4c4f601f1459b6755776c7aec2604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b6218d-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629804861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804861, "uuid": "cdb6c202-bd08-4e4b-8f5e-77a7964c79e9", "comment": "Malware payload (Formbook)", "value": "c61424a930f1cf511fe6425c81fa0836", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804861, "uuid": "7613f5ee-2fd7-4eac-9233-458836b46bfa", "comment": "Malware payload (Formbook)", "value": "94d42aa10e9ef7b29c83691412cf2d745fcb7c2ef15aefaae074d5eaad7cda63", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804861, "uuid": "521c0c84-47a0-4856-93b3-d6d95e3189d6", "comment": "Malware payload (Formbook)", "value": "68a194f35862b804a1509b7e4f0ca2c4dd722178", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804861, "uuid": "e3d015a6-dd4f-4bbf-beb1-2a22a98fdcfe", "comment": "Malware payload (Formbook)", "value": "779f0efba4edd0df6a3f84709e05d0292f7f4926850ef46ca800e42fa9c4f14d363936aa286bb96a9f4e5ffe77f688cf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804861, "uuid": "03cb2a7c-b31b-4f10-87a7-551008dcb571", "value": "T1C0A3E66CC0AB16D48F89A7B82B2B5F45018C7A6EF759E5333274577016D2E3E620783C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804861, "uuid": "97ea4ada-8f57-465b-a5b2-7d284f97fb10", "value": "384:JzBO7IIe7yar76uC0q74LklJixy2zfZCNbQVU++BaZ:FB2IIi5pAD2Zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804861, "uuid": "367bf1e2-ec3d-458f-84c6-de65ac12c98d", "value": 102149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804861, "uuid": "349ea1f4-9332-4a6c-95e7-6c205b376e62", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804861, "uuid": "c95cbb78-760b-4de4-b537-dbf89765f620", "value": "RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc6deed-04ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629825750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825750, "uuid": "73229fca-8a24-40c2-b1c8-ab04b9a87dec", "comment": "Malware payload (RaccoonStealer)", "value": "b0798cb9cac65ad39c92ece692dde238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825750, "uuid": "836db6d0-6e61-4ad9-b602-cebb96a1f696", "comment": "Malware payload (RaccoonStealer)", "value": "94e6fa0bac302f238824b37ed63197a7ec24079ef8a5a546c27c59107d101ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825750, "uuid": "00bec717-6729-473f-b915-94233b4a8a35", "comment": "Malware payload (RaccoonStealer)", "value": "13a4a5d959c7754308c93e1f0fddd316479183f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825750, "uuid": "48651099-f12b-4262-9d97-a3a35e2c1e92", "comment": "Malware payload (RaccoonStealer)", "value": "e29712519d13a529ed416b44c6fd82dff9241eb7f83eba609cb4541021c573c61f395b734c0d1616bdd82fceb151d111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825750, "uuid": "41ca6af1-478f-47a5-8222-99fbb54d6b47", "value": "T179C4E030AAA0C039F4B752F846BAD3BDB42D7AA0673451CB52D625EE47346E9DC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825750, "uuid": "30a6eaa3-1277-4c61-a478-15c515f749d4", "value": "db159470f30e320b201abae61c9eb25c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825750, "uuid": "ce4fa6ad-9af9-4f4b-a8a3-980e79c28af9", "value": "12288:NFyw7zKAdhwmtM36cYtpNDjKCYMy00MpZVakSvb:NFywj7CjBMLVakSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629825750, "uuid": "ca653a51-f148-4f9a-9821-20583041652d", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629825750, "uuid": "56274b64-f836-4bca-820d-b92d60b96518", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825750, "uuid": "7b3ec5e8-1bc8-4431-b16a-02aff92f9baf", "value": "B0798CB9CAC65AD39C92ECE692DDE238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb59a8d-0502-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629826962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826962, "uuid": "202ef777-652d-4704-bd65-da0109c023f2", "comment": "Malware payload (RaccoonStealer)", "value": "c4cfd5300fef3f2dd6857d34734a6fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826962, "uuid": "1dbd5ebd-8298-4832-ba8d-71813f914abf", "comment": "Malware payload (RaccoonStealer)", "value": "94f8df3b1fe7da98f6cea66de08e1d5bca079c8bf8d634d031cc35eb444b15b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826962, "uuid": "3c0f73e4-7965-4590-b763-e73059fc9b7a", "comment": "Malware payload (RaccoonStealer)", "value": "f4c1d27e2660f2b134cdbc5cce4bd04f50c55c57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826962, "uuid": "eda126cb-bdc5-46d9-9435-4ec971908e14", "comment": "Malware payload (RaccoonStealer)", "value": "0a490fa03f8c1453577b96d0046d6aa58c58c74379e424c2330a44905361e4bb58a8fad0cdb33c7fa6fb92977b5bacf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826962, "uuid": "2bf332de-f329-4c81-9c2b-f90dca119851", "value": "T1D514CF0136A0C833D456D57088D1CBB0E629FDB16EA1891F37E8EE5F2E752D1761B38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826962, "uuid": "4c2f0c1e-d55c-4ee2-a4c3-42365b77ffdb", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826962, "uuid": "78914577-d5b8-42c7-b80f-b9cae08a6f91", "value": "3072:SGM0TNvWVyuT+Ao6a5HSrXpgJQKtOgMRZafD4UA1b:SGHsIopO8bEcxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826962, "uuid": "3387f1b6-6e7a-4631-9ce4-9fb58c1604c5", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826962, "uuid": "58c12895-55c2-45cc-aaae-dc80928ec7f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826962, "uuid": "f1c8497a-544c-485b-923f-4abc917807ab", "value": "c4cfd5300fef3f2dd6857d34734a6fd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a3ae45-046f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629763866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763866, "uuid": "109e03b1-5d66-458d-a4ea-4cf321a3c1c3", "comment": "Malware payload (RaccoonStealer)", "value": "864e01e36a94d03f8e9427f7bd9ffcd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763866, "uuid": "fa9c77e3-de0b-479d-b20b-f95ad4b9743c", "comment": "Malware payload (RaccoonStealer)", "value": "9515a749f8b4726fd19960ed1c493f4e99c7ff78140b85524fea0db42eb982a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763866, "uuid": "ec30b6f9-8fe8-40bc-87b8-c3aff9a69db5", "comment": "Malware payload (RaccoonStealer)", "value": "c3f849747e494ae3b7fa4dd1f3df1a0517865ce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763866, "uuid": "8e07f8ea-aa2e-4d23-8e54-18af4a057aad", "comment": "Malware payload (RaccoonStealer)", "value": "dfd66f2a8e8c9be1d9e7708230f4b1a687a6239cc6bda2e67562f440f3e3c274f8151bff21610eabe5f338b53a6e667e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763866, "uuid": "92379c3e-0771-495a-a5de-4af0287e7355", "value": "T171B4D030AB91C434F1B612F845BA86B8A43E7AB05B7550CF53E51AEE16387E4BC31B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763866, "uuid": "567ff044-3caf-4bea-bcfd-65c96b732c77", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763866, "uuid": "0d8be81f-cac9-4e20-9645-1d53fa9e5c01", "value": "12288:MnlImDbfndY6FQpD69KP3AWWEVXjef6Fu9b+H09qn:Abfnu1AWW4XjCSGq86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629763866, "uuid": "5a9329d8-5db6-4f8e-8052-3578ea85ba1c", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629763866, "uuid": "3e5e97da-ddd8-4cfb-9b1a-df30334692c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763866, "uuid": "9318916b-5f8e-4226-9355-8a033e5e3040", "value": "864e01e36a94d03f8e9427f7bd9ffcd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81288e0e-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629804981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804981, "uuid": "ff5589fd-b24b-4da2-a1f3-2f5821e0694c", "comment": "Malware payload (Loki)", "value": "3aa16525f1c5ae52bc31cc11002f32c6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804981, "uuid": "0eca04e3-bb5c-49db-96c4-e7514661cab6", "comment": "Malware payload (Loki)", "value": "95b4108efe640e8729785ce401ec1a2f7cecc48846751a889459d32ee9c335a3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804981, "uuid": "b1a3561a-b217-450a-b7f5-24013d40845c", "comment": "Malware payload (Loki)", "value": "d49077452d8d80e1c5993ff5f131f60ea96b1704", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804981, "uuid": "d624eb5d-04b7-4a17-afc2-55fff65e0f69", "comment": "Malware payload (Loki)", "value": "7b4f35303d5ee67b426298d4be5949edb47333861e69d2e3535b66721ecb59aaa6603af1c406de2a3353122f5584b62b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804981, "uuid": "47b79780-952e-4cf5-9144-8f468ba69f69", "value": "T149D523236EF00FA3E6694C34986EF53628651EB41C8DDE635F4DB227BB741B0279261C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804981, "uuid": "39609598-f918-4302-8328-f0ea5614ca5e", "value": "49152:r0Vpqe0EqYc4dvp6Q2hSOk0enYH1xnEw3H+ZRDChsQWqWPskns0pLqq4Adv:mke0EhuDZjH1F5uZFQsSWUkns0YqBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804981, "uuid": "f13d4982-349e-4a5b-8ecb-fc4dfa5d602a", "value": 2914792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804981, "uuid": "0a1d25bf-6cb7-4bf2-bb9c-e4f7b5f8be4b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804981, "uuid": "d52ad25c-4e2b-4e7a-967c-e4e19a655048", "value": "inv7876455.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0792d6f5-048b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629775571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629775571, "uuid": "d14e309e-2203-4a95-b39c-2f82eb949c6e", "comment": "Malware payload (RaccoonStealer)", "value": "66ea50d6eabf8c7e36e5b73344d3a19e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629775571, "uuid": "6079ed10-5467-411f-89da-0255ba30ebd7", "comment": "Malware payload (RaccoonStealer)", "value": "97298d62b017d407648414455e98ecc371aa405c5dd9071371fe0ae76ce4e847", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629775571, "uuid": "416d47e6-3a7b-4d01-ae4f-f214463e4fce", "comment": "Malware payload (RaccoonStealer)", "value": "d9fecfe34cc83580c09bdb0922f8f7cf8194213f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629775571, "uuid": "7061a0aa-03fb-4879-8080-211e9efc448e", "comment": "Malware payload (RaccoonStealer)", "value": "fa6c7dd90b2d5f5e484201e1674e915da4caf9708e607294def9c8438ae528ba30b8e5115ccdc42b4ad8ada5861e2e54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629775571, "uuid": "00d1ee55-6911-42d2-b7eb-a9a61de1b1b2", "value": "T180941212FE91E137C04645B18DE2D780D96BBC506A6841473AD8BAAB1FB13E1373B263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629775571, "uuid": "e2716be3-5174-4822-88d1-62bae327c8de", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629775571, "uuid": "3b8bf81a-85dc-4733-84ba-e612e2a53698", "value": "12288:xYKUeHbnQChKDt2UlQXUv70ivg0e1ug+KC:xJ7Qlt2UlQkvjvtngc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629775571, "uuid": "7edd0c14-d7af-4b82-a709-ea63feffa650", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629775571, "uuid": "ec0a999e-7e98-4a05-94f9-78bb642d8bf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629775571, "uuid": "d856470a-54e7-41af-947c-bf8a96d48b33", "value": "66ea50d6eabf8c7e36e5b73344d3a19e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c948f2-049f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629784368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784368, "uuid": "d6a8fd39-8d96-4c3a-b0f8-6e1a044764b6", "comment": "Malware payload (CobaltStrike)", "value": "9284526d864c785b1d6bedd7830e8c19", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784368, "uuid": "9aeef596-2589-4938-808b-0c0b7cfa827b", "comment": "Malware payload (CobaltStrike)", "value": "97353134cb9688dda31e50d288370079161ac91ed800de8bba629ba0c6040834", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784368, "uuid": "cc361328-d7a4-4ac3-824e-8cb54ef36118", "comment": "Malware payload (CobaltStrike)", "value": "92e1080ac36f170f997c59e60d9e7b80530c60d5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784368, "uuid": "f25ef547-e54d-4577-be14-14a8be6f9c6c", "comment": "Malware payload (CobaltStrike)", "value": "f7c5558d6a1524ca0eb030d90ace6f002553cabc3cceb223836c9b80556e1cba1aa32688e38b53b983f112674cc2564e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784368, "uuid": "7f58ffa1-2f68-4345-a81f-c1124ba6774a", "value": "T14E567D13F8AA24F6C6FEE13085619322BA71386943313BD35FD4967A5666FE47A3D300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784368, "uuid": "f3f18e43-793b-415c-b4c6-2c80f0297b30", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784368, "uuid": "606a1755-bab9-4b79-afb7-02dff822b120", "value": "98304:QWfpNGBkh9DALtSl1+E5kTq+AvulpwCGu9+I/iGqbuqBxO:QWhNG+h9DAol1+LVIxu6Bbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629784368, "uuid": "8bc5862a-04d7-492a-a39b-0054aa968abe", "value": 6422016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629784368, "uuid": "eedfe02b-755d-483e-9e32-f521fb1a58a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784368, "uuid": "893c9008-0197-44e8-b3e0-8502e899eba4", "value": "9284526d864c785b1d6bedd7830e8c19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c4638a-04c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629800445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800445, "uuid": "dae54238-85bb-4832-8896-62c675b9d099", "comment": "Malware payload (AgentTesla)", "value": "f9f04c8586ca58ebcb31069fe3172735", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800445, "uuid": "47644359-befe-4a2f-a42b-6f629575f65a", "comment": "Malware payload (AgentTesla)", "value": "973ac922201f7e58e3665c6e1470244dc6664e321f55596ea64181078de83473", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800445, "uuid": "9ba4d10b-4ad2-482c-bd24-3513ef9fbf70", "comment": "Malware payload (AgentTesla)", "value": "c927700792af3e2f6eff398b6fa807813707050e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800445, "uuid": "cbfe1b98-5e9e-42bb-8239-ceb9cd732f83", "comment": "Malware payload (AgentTesla)", "value": "ffda8c6fb8149a4635d10975ed1cfa58032605f2561634a10507dbd073ba8231dc4f0bb942e9c8b879eedaade1017ba6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800445, "uuid": "1e506840-f19e-486f-b777-01a5545a4094", "value": "T12C2429166715D520CB6F527EC01A820831F1D707A72AD39F5AA6D8EA2F832CDF90BCD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800445, "uuid": "fdac7713-6578-486d-8677-2b7855d2e276", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800445, "uuid": "97fd06c4-759e-416f-8787-36eac5165a13", "value": "3072:0mQlbtPJWxlTgPJHqVPlNFUvlyjjrwjUL3OR+w8WGWN+GxamXC7b9PxA+hSNCYUk:0TqVpUCPwQS4w88NXCl8NfUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629800445, "uuid": "08473237-01f4-4dc1-b9b2-f0a86b524138", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629800445, "uuid": "b36da916-3fbd-4952-bd35-a0a1da533e3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800445, "uuid": "33b6874f-6057-49d5-bee5-d92ec5cdcad8", "value": "FT0821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fe31a1-0502-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629826680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826680, "uuid": "00e81e54-210a-4515-b783-9ac7dbbeb117", "comment": "Malware payload (AgentTesla)", "value": "fa2daac20b773281c652a8f301bec1cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826680, "uuid": "82c15407-3ba2-4157-bdd0-e77a210e5ecc", "comment": "Malware payload (AgentTesla)", "value": "97fb2897b8023315cc1728ae966b6d2f43fb2496450e80c0eda395487f15c7bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826680, "uuid": "f5d64119-d40b-411c-99d7-41518b4ba234", "comment": "Malware payload (AgentTesla)", "value": "5102cc586ec53bc9be3c8ebef2eb2d186c5442dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826680, "uuid": "1b53fdea-0cff-45e1-8c9a-b2f491e56d88", "comment": "Malware payload (AgentTesla)", "value": "da89ca4b501b094c77ecbb0284ee0e8c7114019b9eb2fba9245c6671bac802fb655645c2bcca548518f9a2b5782ef446", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826680, "uuid": "725b70e2-64d2-4042-a392-a62102d267de", "value": "T1ADF4827E1ABDA2278175C2B5EBE79417F0409B5F3411AC2576C203664232A7BB4F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826680, "uuid": "7122fc99-c5ea-4244-9017-cf86d561c824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826680, "uuid": "9f72fd92-e224-456a-9990-bbf7c77fa64b", "value": "12288:klpdotNYtNReXmDwU8P9Zx2413a0jwPRkCtkeJ0T1AP6iDP:ktdeX1jP5HNOUaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826680, "uuid": "8904fe4a-0dce-4bd0-bf3f-689aa0a85496", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826680, "uuid": "ff1c502b-0058-4bf6-bbbb-39fa694811d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826680, "uuid": "577502fe-03ea-4f3d-8029-b69fae985fff", "value": "fa2daac20b773281c652a8f301bec1cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4deeadb-046f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629763863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763863, "uuid": "7d988622-a115-41f9-8f0c-89ad123c9030", "comment": "Malware payload (RaccoonStealer)", "value": "39939d78f5306a1df54b55888959bd4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763863, "uuid": "f971db18-217c-4d41-8cfe-c7af18799f35", "comment": "Malware payload (RaccoonStealer)", "value": "985091b0ad7938f24e5a73dbe8d869d1399545af79a6c7f269a0ca82754e7b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763863, "uuid": "411d1826-3eba-4aab-a06b-3f26e2328dc9", "comment": "Malware payload (RaccoonStealer)", "value": "f0b014318b87f4f7d5d039fb81ff1ae3bc2bcfa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763863, "uuid": "8088f535-a986-4b8f-aee3-dcd1053f839c", "comment": "Malware payload (RaccoonStealer)", "value": "3a8d405da582f2ceea04c934544a0776da01f3597bbd8a44a02adf5aa65c20de452351a4743ca9bab09c8b41f958a30d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763863, "uuid": "a5db24d4-4050-4bb4-aa1c-24bb7f67a69b", "value": "T130941210BBE0C132C99544708CD6CBA0E666BD54B921024737DC9EAF1FB6AD1773B36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763863, "uuid": "a0bd5bc6-ce94-4d2d-8a73-eed5957b6c31", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763863, "uuid": "11f3220a-75ed-4ff6-a9fc-4bc17a7f706a", "value": "6144:2Ai6uBae7tqAPma3aviF6G2z7QbdXQfrtCdcaPLeSIygvqP:2MuBae7cE4iFSSdgfrtCHLev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629763863, "uuid": "9afb6b99-417f-4ed1-8b38-9c55e4022b10", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629763863, "uuid": "082e45c0-b123-409c-97fa-cb74ed8ee8f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763863, "uuid": "a4ab61a0-8b6c-4197-a599-e8f575e634f6", "value": "39939d78f5306a1df54b55888959bd4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288c5f6d-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629805691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805691, "uuid": "a0ac7d0d-4039-415a-8b8d-b2d343933ad9", "comment": "Malware payload (TrickBot)", "value": "8b7661725ad6740e32e8e31c647f0be5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805691, "uuid": "f1ba9572-4531-4d0c-97d8-a8e82d784e02", "comment": "Malware payload (TrickBot)", "value": "989bca6b266c0ca7ad46e518146e61cb4e12ae3ee606f99d2b2f75221f09f096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805691, "uuid": "45d78d73-4776-4e60-9a85-04544dc10617", "comment": "Malware payload (TrickBot)", "value": "7ea6057337cfd884450ceddff6906287d10fd185", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805691, "uuid": "2a162ff0-53ba-4ec5-9c88-ebca4d62f233", "comment": "Malware payload (TrickBot)", "value": "d8394ee8377e6340b893c507d668074a31faf9ab7d84e3e1e03eb85c3fa2628f3f19bf42ff766a05aea93dbb500716ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805691, "uuid": "076d3a83-4f5c-4d0b-9202-f83dc817418f", "value": "T1F70519D0634CCA7FD6C33130F3A61633D2538B4E1AAB919BEB58F59AA86E5467413307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805691, "uuid": "d2abe0de-b268-4300-989f-097319135d7f", "value": "884c251bdbb51e23564add248435ff5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805691, "uuid": "f1c1c604-555f-4a19-98ca-c26cc84757a4", "value": "12288:QFuLe4nHJm79H5+51MKd3GydYLMcOCWvnJi7:QFF4nHJoqZbnJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805691, "uuid": "443f5b1c-4fcb-46ba-8774-d07fe8b8e5d2", "value": 839733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805691, "uuid": "39152932-4f72-418c-b370-8fd0a72e208e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805691, "uuid": "4d86a939-6699-428f-b9fa-e2a869489d66", "value": "8b7661725ad6740e32e8e31c647f0be5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82f63de-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629786578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786578, "uuid": "156d6362-9009-4538-884f-b77f56c586ea", "comment": "Malware payload (RedLineStealer)", "value": "18b953ff1dbc1eb84d82d90098909277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786578, "uuid": "c4940031-5149-49ef-84e2-1d49dd6a7257", "comment": "Malware payload (RedLineStealer)", "value": "99b59b6c40f3c17f4d3b19e76ec464774d54dad4b14b9d9e7d92610589c82687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786578, "uuid": "cde83745-5d46-46e9-8e3e-5b7d7122399c", "comment": "Malware payload (RedLineStealer)", "value": "847fa265770c0048d34549b4a2251e832e42c582", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786578, "uuid": "79f6f804-e079-4ed0-b701-72a46f0fcacf", "comment": "Malware payload (RedLineStealer)", "value": "14c7aa4985c8acfc13a3d09096d649c1f5d6cfade79fb4541502b75d290f1e9d05be33f50a1da2f8c509063ee8e638e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786578, "uuid": "78564a6f-30c7-4598-8c5c-5bc5ea940af1", "value": "T12B74AE30AAA1C435F5F612F845B682B8B93A7AB16B3050CF62E51AED17347E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786578, "uuid": "a57cb18a-d6ce-454e-9eee-88d9a96e0fbf", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786578, "uuid": "46d5914b-f395-49be-8493-bacd3276948b", "value": "6144:bEqc4rwm0j3mkFJC1xQOYCK3KXveNKDh/YtoSt3/WpyTB29k5YrpW:tcGwmQWkiuDsvKKDBYt7F/dTBEk5Yrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786578, "uuid": "c421954c-d3ae-433b-9b26-84f512da8314", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786578, "uuid": "3e125f83-e5b3-42ad-b5a1-0049047ba94b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786578, "uuid": "16dd6121-ea00-4711-a1d7-5961ce2955dd", "value": "18b953ff1dbc1eb84d82d90098909277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f2f824-0486-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629773790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773790, "uuid": "bd035fd3-1542-45d6-a951-1974c87a451b", "comment": "Malware payload (njrat)", "value": "8cb9b4d29c91954932c41dc883862775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773790, "uuid": "9f4c7f59-8a5c-4899-bee6-066bff605904", "comment": "Malware payload (njrat)", "value": "9a70c005dfe999798687b31073d738d08aa5c8203c449be32ea1929149862862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773790, "uuid": "f3c81ddd-ba26-4de1-9f34-5b5e9a1ac11c", "comment": "Malware payload (njrat)", "value": "ec39db9b9832e29dca8d30fdec665b0e607463fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629773790, "uuid": "807fd078-ffe4-4dc5-9c89-718cddd785bc", "comment": "Malware payload (njrat)", "value": "9a68719546e0f11eccaf7f915d979b69a47e1c24a23775eec1caa715af597303b95b5c5279d6784360bd1ae1541998ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773790, "uuid": "6520f9c1-1de5-477d-997a-ed89d2d33836", "value": "T1A2B21A4E3FA98856C5BD07748AA5969003B091870423EE2FCDC550DBAFB3BD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773790, "uuid": "67f90ef4-8b6f-4a0c-a6c0-c1eaf0be2440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773790, "uuid": "eff06f93-b8f6-40f4-ba65-f29493cd6f03", "value": "384:z8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZLi:nY+sNKqNHnSdRpcnuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629773790, "uuid": "70637fd2-980b-4db8-8b88-56ca2e6625d5", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629773790, "uuid": "e8e59685-9132-497b-8ac5-c44323cf5c79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629773790, "uuid": "da75e766-78b3-4544-a541-11d187e06c62", "value": "8CB9B4D29C91954932C41DC883862775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c109d3-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629786631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786631, "uuid": "dd482f07-dba7-40ca-ade9-ddf41bef5a2e", "comment": "Malware payload (DanaBot)", "value": "2b0e445c62830c383077959a8f07289e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786631, "uuid": "403f0fbd-c5ca-44dc-a156-5967dcd3e5d0", "comment": "Malware payload (DanaBot)", "value": "9a9903020d8134184e850dd7069d26734ca07cb0dd87bbde15919587ced1d3a1", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786631, "uuid": "356df3ea-b7b3-4f45-8b87-8bf0194730a2", "comment": "Malware payload (DanaBot)", "value": "40c24d7e6dc8fcb68b00b0e8c21a2dc0aed0e34b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786631, "uuid": "59c67fa2-8fc3-443e-837a-38b30edb3af0", "comment": "Malware payload (DanaBot)", "value": "a8372966dc6da3e77935b4ec1dae9b296cfdd46631a1d5eb32967273d61315f2a6b8a401e4533c272e969a13e17bf5f8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786631, "uuid": "47366243-320f-4cc0-acc9-99b8ac38c408", "value": "T1BC451231AB91C039E1B351F4457A82B8B93A7AB16B3444CF63E526EE57346E5EC30B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786631, "uuid": "b3cb7859-f397-4a34-af6b-1132f1b21455", "value": "c3357f55d714ba99dcfee6966059bf12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786631, "uuid": "9b3b6307-21bc-4c2b-8162-0440387f846a", "value": "24576:OF+drpnEdh3f7/zqT3bdDtm3I00oigJf34hbHnSPmfqXRJ:OkWd1/mbdg32SJ0bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786631, "uuid": "d575c6f5-e350-45ca-b651-3979960f602a", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786631, "uuid": "a6fe9e7a-7687-4605-8cf7-dfc6b300c964", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786631, "uuid": "861d1d0e-6b90-408c-bd8d-723439ed9cf0", "value": "2b0e445c62830c383077959a8f07289e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc22bc0f-04a7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629787927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787927, "uuid": "fe69c682-7505-4bd3-a4de-7bf049772214", "comment": "Malware payload (Loki)", "value": "f9caf25e0ce0553c6969d24b60f9ba8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787927, "uuid": "6b2b6112-174f-4630-8807-61e5835e5622", "comment": "Malware payload (Loki)", "value": "9b7488e4efffc5a3ce782293d90afa665659bf0e1197aa06fbe0f8481ef9b1ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787927, "uuid": "39340e3e-4c4f-4157-b14d-052204dcd82a", "comment": "Malware payload (Loki)", "value": "ba9bee21572b2cad7742ed691ccd7287f3257142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787927, "uuid": "dc21f906-c46f-4075-bbc4-f3e80d006d37", "comment": "Malware payload (Loki)", "value": "ebbfcbbb9c9a94afcfe835ae9a5e5b8e870559eceea57c22d557fb8536c6b4322d2097b43ad19b9ed6a660ffc0421b99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787927, "uuid": "a7d17095-04c5-4aa7-8935-68e6e8e96217", "value": "T14754CF086005F42DF8B6C97924D3B45632453F285BB61EAB93277A3C45B12A89BFFC35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787927, "uuid": "1b6563ff-853f-40d3-9cdb-c3821149ea62", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787927, "uuid": "78e15efd-3f74-4257-8be1-444e43963d96", "value": "6144:67CYpS8fBTB8ObJkZP7cktI2hN+Hldu1N:yCEfB9jFkdckpbslYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787927, "uuid": "2fa2ffd0-b7a1-4191-9725-48da13e1e669", "value": 297704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787927, "uuid": "9044ae3c-6bc2-436e-a8fa-35d7bcee3a04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787927, "uuid": "a93198e4-2192-449b-b66f-d9c69fa724d3", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda9dcf5-04d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629809404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809404, "uuid": "dbce3399-194b-4b58-9205-7747f8b854e3", "comment": "Malware payload (Mirai)", "value": "05863c09a4e5ac391c01bf7b9a74d0f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809404, "uuid": "312408a8-01d9-4213-a247-a4e97ab4b6e7", "comment": "Malware payload (Mirai)", "value": "9b83f89d0bb36c2613978a165682eb68172695d380bc12b6f10699a087b9818a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809404, "uuid": "7f99604c-aca8-4aea-ba4a-4b2a3399bda7", "comment": "Malware payload (Mirai)", "value": "7333cb5003904b75fed1f2c0fbfc891089d8097e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809404, "uuid": "6a221a46-eed6-41b6-a423-8cadf369e2a8", "comment": "Malware payload (Mirai)", "value": "c2fd020f6e969fbb981bd9f11599dc87cad852f7a5d024b6f1d6cabad6ec81bfd3a6d580d978f24dcfdab3159fee701d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809404, "uuid": "103d45ba-2a86-4264-b6c9-206c52b4610c", "value": "T1B45329C8A593F8F5DC140978307ABB66AEB3F13F7075E99BC3D82923A841702D50669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809404, "uuid": "913a02ef-3db1-4253-ad2a-962f97ed03b2", "value": "1536:IkF9170vwHbQXZ5+qXDEuXi9P0SW7V/DjObeFt6PuQ4Zz:z917iwHbQXZ5+qXA59cSWZ/XObeb6GZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629809404, "uuid": "bfdfb32d-b6b5-4699-96af-db4ad80d709f", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629809404, "uuid": "abbae6b3-5072-4ded-8fa5-1145d9fba300", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809404, "uuid": "61bbf994-cee8-49cb-8310-f587b83f85a9", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e80dff1-04e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629812197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812197, "uuid": "4d7889d1-87b9-456b-bd03-80f7342df57a", "comment": "Malware payload", "value": "8ab9db08899bda30d21450ff3849b7e3", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812197, "uuid": "38a7da5a-7c47-47e2-8168-893875a3e8a9", "comment": "Malware payload", "value": "9b89129a44ece7a9f4cd80c03a00cad0b0c681738f34886b3fd1879bdb8374c0", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812197, "uuid": "8eeb1937-5d50-4211-889d-20653e395208", "comment": "Malware payload", "value": "1ed10f3ff90067c87c3e291af80a1d4b15f9412e", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812197, "uuid": "c67477f2-a753-485d-b5e0-9438066b99f8", "comment": "Malware payload", "value": "6730b1d15115cf25aae26930bfe323811628745155bf2a64d9186302b586f799b7eb38a0d2527a0d598bb4bfffa90737", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812197, "uuid": "8770a9ce-0d3f-4964-bade-9efcb74daac5", "value": "T11BF1C05BE0559121C2FA843DE4DB2C63B904FD8FA425B66F31A1B2180AED4C74D09A77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812197, "uuid": "28c32c4c-7bc9-4139-9a1c-f45f5a2e82e3", "value": "192:xrXP/F0ueayEjNgfqUXJbHL+rUGVQNHL2XK081:dXPoaZjafqkc6NHKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812197, "uuid": "05c52540-6003-4c89-82a5-547af4832d43", "value": 8064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812197, "uuid": "423791fc-abbf-42dd-9385-6e1989b8cb25", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812197, "uuid": "e9e9a60b-fb2b-4184-9b43-8290e21e8990", "value": "zoe.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901c39a5-04b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629795557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795557, "uuid": "a12c385b-7964-4095-90b3-5aaed3ce917a", "comment": "Malware payload (AgentTesla)", "value": "42bc1659369eb02fda72d8a0b79dd7bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795557, "uuid": "e76e42b8-a82b-4692-90bc-0eaf23ca5b5e", "comment": "Malware payload (AgentTesla)", "value": "9bcddc31906a8515bc79286dd4aee46e29a04239b546326513d6058a2f1b2e8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795557, "uuid": "107abceb-78dd-4812-972a-fe9e65964f72", "comment": "Malware payload (AgentTesla)", "value": "32decf95acf09c2e19b732ccafc90d1d87b81553", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795557, "uuid": "c1b2e99f-94fa-4bb2-9feb-3a7045a5957e", "comment": "Malware payload (AgentTesla)", "value": "fb89027391a4ca6915a17cda00459f9d2892fa226c8136d0cdc07815f69da3635f9f97449f94a44330ff5b05d630101a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795557, "uuid": "d4fbeaf9-6a75-426b-a139-17299893d55b", "value": "T137158C3063C9C284EC1A8EF0167CF79402F275EBB6C5CD6A16EA720C8E5E9D1670765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795557, "uuid": "7565a40d-6d8c-4e74-876d-3c69aedffbad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795557, "uuid": "d029fdee-3023-433b-817b-63bf88acc2c0", "value": "12288:JzcsGI/cVi0gjAMw8nSrY99VwUd4i9+tnPRISnCggO4cmJe7qv3dfJ/KoQaRS7TC:J+qKwBwUSiqJIjJeyLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629795557, "uuid": "67a69fd7-e950-4e2e-b9c0-9819c2581704", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629795557, "uuid": "1de81b6c-c4f9-4061-a9dc-823896129792", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795557, "uuid": "8d2b4335-4464-43b2-b727-494ceb66acde", "value": "INQUIRY #0029020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b0bc8d-0527-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629842704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842704, "uuid": "0d89d6d4-59d6-4ccb-9650-4287328b4845", "comment": "Malware payload", "value": "b42512d71c3f14e98719d6036148f8f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842704, "uuid": "8967620a-7e09-46a6-ab77-ce984e4b9922", "comment": "Malware payload", "value": "9c1ddfa908ee08b1e2efedc8a6e9a00cccbaa941a927f210fb15ea0ad781b57e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842704, "uuid": "bd06d24b-83ea-4a29-a1a5-1205920d23ba", "comment": "Malware payload", "value": "7166dc2dc94be9a039907ab5815b8bb92459300d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842704, "uuid": "322c2afa-44dd-4191-97bd-96126ac94a43", "comment": "Malware payload", "value": "2f110e2a11266a2287385f49717ee6d89aac8262d4b8cf8ec2ef5977d0a63abf45a113a476e1e746a6833dac0c7e8960", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842704, "uuid": "674739b7-1a74-410a-80bb-64d1907ffb40", "value": "T192B33B1163DCD629EBFE4F7674B0071047F0E09B6021EB5B8EC264EA1E76B816A456F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842704, "uuid": "0f98dea8-6804-4a10-8e34-d884340e6a42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842704, "uuid": "4b782702-c56f-42b5-96fb-0abd8eb3d939", "value": "1536:Kt9pmyDBq2OeYWdOimpYIWnabzjbuqGdJn2uyq+d4+ydDjECG6qTaoig0:YjBq27YaZmpYn6GJndyjd4lYPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629842704, "uuid": "fc11d1d8-e290-4663-bef5-eb997b7e8184", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629842704, "uuid": "edb8113b-61eb-4757-9af9-3a34d44b4a99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842704, "uuid": "e86163ba-e13f-4182-85ba-140984b4d84c", "value": "b42512d71c3f14e98719d6036148f8f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ff6ca1-04c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629800877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800877, "uuid": "eb1fbda7-11bd-483e-a167-523171d497e5", "comment": "Malware payload (AgentTesla)", "value": "f39a0a5e5dd282056fe6638cab400965", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800877, "uuid": "d1fad204-b80e-4ccb-984b-40f16f8b286f", "comment": "Malware payload (AgentTesla)", "value": "9c326e799f7b767ad2921f5501cce71f9894ea38a8c393092ff4a5972fd3b44b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800877, "uuid": "735bb072-be44-4e53-a209-bed81e7651e8", "comment": "Malware payload (AgentTesla)", "value": "bd63c6a6d55e3b7064ed777109f638b0a134edce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800877, "uuid": "4a50f284-8fca-4e1e-99f9-7e70826f0de2", "comment": "Malware payload (AgentTesla)", "value": "4e4624aecfb1ad74e04692981305c2697d9273a327c2a59792d0ab5c7a137f866ad06d7fed26a75c5ec87da9e9b9beb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800877, "uuid": "546d190d-8cdd-4b04-b012-56dad0ad3217", "value": "T134159D3063C9C244EC1A8FF0167CF79402F275EBB6C5CD6A1ADA724CCE5A9D12A0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800877, "uuid": "3c15e605-fa26-4b80-a86e-f4101cef9897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800877, "uuid": "b9afb087-4792-4ca9-a928-01eca3701b7e", "value": "12288:cLcsGI/ccTa/se4DccQPndR7FW1zzPywNqNq4wrc4v0MSPOzK+Z1qaFY2EObb0:cpE+cdPnbBan19xv0MSPOznZ1qam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629800877, "uuid": "4968c66d-6a26-4c68-b09b-d46b436f296f", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629800877, "uuid": "a3d2238a-36ac-488a-823a-8a3fb628a14e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800877, "uuid": "f4523b26-a78e-4e8c-9ad0-c014e911188e", "value": "Imp_362 xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75d9d46-0529-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629843700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843700, "uuid": "28550cda-da59-4e1e-af3c-80c5b2f78d9b", "comment": "Malware payload", "value": "ec8c9fd257c4611aea9c5d2b94062fa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843700, "uuid": "40000a59-4d52-4f61-99b9-dbe2e1f8c156", "comment": "Malware payload", "value": "9ce79194a459831170d750d217cb5204a152d6b210d4ef877b5c9549359ddac8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843700, "uuid": "49967daa-b7c3-464a-b1a1-9b7816c48a86", "comment": "Malware payload", "value": "fd2f23e5bf1bdca3f14b6c69c8ff88d83724ff04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629843700, "uuid": "41ec2b70-165b-42a0-8991-6e6b91068725", "comment": "Malware payload", "value": "5756d6de759d512dce929c147fc8db978cbdf60f501120095c6211082fff7c0ebcca44b5a429c04e4f1df63d04fbadc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843700, "uuid": "975e7434-1b2b-4150-ae60-f20d716a7650", "value": "T187F33A05E6408B17C1E2277AE6CF824D33339B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843700, "uuid": "8a851a55-ed65-42b3-828b-1111b47559b3", "value": "3072:f1g2iIFdVzqKA7Y6ISag0/RbqnyLRM/9lzNmFwfBxKQodn:tg2VFdVzBA7fISantqnydM/9/mFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629843700, "uuid": "ffe8658f-b21f-4b3b-a9f7-b9c61ae96480", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629843700, "uuid": "7bfa1413-5f17-4b22-aa66-3f842269a2e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629843700, "uuid": "fec180a0-04b7-44db-b5cd-a49a4bf0a491", "value": "ec8c9fd257c4611aea9c5d2b94062fa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73a9701-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629805931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805931, "uuid": "c55a78dd-47ae-4b75-b109-a5610252a926", "comment": "Malware payload (CoinMiner)", "value": "82d057e1eb74021d270cead3be27d9fb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805931, "uuid": "63c5a195-c954-4a97-8ac6-da503e24382b", "comment": "Malware payload (CoinMiner)", "value": "9dad1f618e1ebf28e43f4af049feb9d75a03b139a63bdd1901f51497fd4ed50b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805931, "uuid": "3800be41-7e80-419a-b2eb-936cb85b98c6", "comment": "Malware payload (CoinMiner)", "value": "b3c2f6d63488a1a0947a3572bea950cfb5505dee", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805931, "uuid": "7b2af280-0910-4974-9ccf-a0cba342b7fd", "comment": "Malware payload (CoinMiner)", "value": "fcb27cbc2af918d7d520b94cd2477a936f2dfc67a816032137c0a21d599cfcf35d136ae14ca9a0ee968a7b875019c9cb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805931, "uuid": "bdc8b802-8095-489c-b1d9-b6d2289d2ee6", "value": "T13FE3CF1135A0C473D042587148E5DA68EA7EF422AF61B9837BD89F6F5FA12C0BB2D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805931, "uuid": "6acd00af-c625-4d4a-877a-64d31d8b0fad", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805931, "uuid": "06a0b0dc-9c62-48f5-bfbd-03c81739ac50", "value": "1536:K/3vPrEOZ99CkJL+8QhDul05Ac5HJx/6fLOlL/H0X5GZTiZuVnmKbBriobhO2Yp2:K/V9rL+8oJ5A+ifLORH0X5GxIuVFRgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805931, "uuid": "fb8d3ea1-c8b8-4098-82c0-e8f058c948db", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805931, "uuid": "f02772ce-09bd-49cc-bd70-6684fe02e5e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805931, "uuid": "478fa09b-c05d-4e8c-9844-424b40118306", "value": "82d057e1eb74021d270cead3be27d9fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3247c824-04f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629819451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819451, "uuid": "065db2ac-3b21-428d-980d-08727b4c915f", "comment": "Malware payload (njrat)", "value": "7809abf86f2e641c8e0d3243660a4369", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819451, "uuid": "edae1635-fae8-402e-bc2b-e247a31a2242", "comment": "Malware payload (njrat)", "value": "9eefea5706323fd61d6dc53e35551f61978ab88b9b5cd639c3ecd96550772aa8", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819451, "uuid": "b973a371-e938-4835-a74c-20edecf197ac", "comment": "Malware payload (njrat)", "value": "afadd440e67aa7e068182116cfae36609962d6ce", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819451, "uuid": "3539e59a-9d1e-43f9-8be3-37bad27ff5d1", "comment": "Malware payload (njrat)", "value": "10f0e9ccd45f7c616ca862b66203665a82aabe71151923bdf09d64b7b295e0d150fcd6593d9116ef8a1a2ae8c79698d1", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819451, "uuid": "0b33cc84-6ab8-479f-9f51-a72c8ea325a4", "value": "T10C01F60A4D28CDEB0049F18202D38DEDC6604AA74F806E7A2464794B6CAD22E6DCDD87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819451, "uuid": "03359947-48f4-4000-868c-30fdc9389a52", "value": "12:0ChGF2MBNZ/zXNoxAbOJk82cG2bwELPdg3Nfd+aaiTC:HgF2SNhzXQXG2UE7kNEuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629819451, "uuid": "5af9229e-3ab3-4cbd-bb97-bb25087a2509", "value": 726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629819451, "uuid": "ebe6cbed-91b0-4cd6-b66a-09406e39d529", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819451, "uuid": "7075c223-bc13-4437-9603-d9e305738686", "value": "#W002.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fabaf5-04a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629785579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785579, "uuid": "a8459702-92b6-4395-b623-6e143e129dc2", "comment": "Malware payload", "value": "62a818b44b96bffc946f4e3c459f9a69", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785579, "uuid": "38013fd3-3e8f-4073-9198-b2b36757ecbe", "comment": "Malware payload", "value": "9f2a2e06275fc4b65b2274f75fc9100203da8c6d67c2c269a9a9e1d579e05816", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785579, "uuid": "b0444d52-786b-4cb2-81f1-ffe903982c90", "comment": "Malware payload", "value": "9edda36095fa7eb2d002bb2956bee07778bccf3c", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785579, "uuid": "dc5b38ad-d52c-40e4-87f8-e713fa7b64ef", "comment": "Malware payload", "value": "2720d16c253329feb866601f2439f155c89a149ceab893eca5c545171ae3c768aea5953912d5e98169eb08b5611b7f90", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785579, "uuid": "8a188928-99bd-4136-9eb6-ba1bef8dbceb", "value": "T1FCF1BF65D481A209FDF7033EEB1458F6EF1EE920AD58169870BCF059538785B0B872C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785579, "uuid": "acff15fa-6cf5-419e-aeef-e3c670921065", "value": "192:xrXP/CX/mqPy8Auv3EqG84ZnoXrhXYd04:dXPxqa8Auv3Ex84BcloO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785579, "uuid": "62b9d034-7bcd-4d44-ad0e-9554a8259e34", "value": 7883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785579, "uuid": "18bd58e7-dccd-4bd5-8479-1cddd53f72d5", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785579, "uuid": "962df480-b7bf-464b-ae5c-95ca2c725164", "value": "Purchaase ORDER-PR#.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01d38c9-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629805060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805060, "uuid": "25c94f9d-9971-400b-80dc-9919f6cb09d2", "comment": "Malware payload (AZORult)", "value": "e6418d393bc2b70912c35b668d9911de", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805060, "uuid": "a981f9b5-4a4c-4cb2-8db3-82a4cade17a6", "comment": "Malware payload (AZORult)", "value": "a2cb792dd78926a29fa257675d5cc63d5bb5cd6490592cf7e18a00d6b7b67401", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805060, "uuid": "f3b11b98-72c0-492a-8cfe-fbf79a6a6bc1", "comment": "Malware payload (AZORult)", "value": "e9e4d80b99f7d65988c42ad29612411818bb4420", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805060, "uuid": "1410ec8c-7d8e-490b-9a1f-d1088b92ed44", "comment": "Malware payload (AZORult)", "value": "e37caaceb4d887e687ef8340ca125c0896029161b52ef7b9b530aa16895ab3eb0aed07612a7d72099e27f31f81e50c4d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805060, "uuid": "0780773f-1632-44f0-a3e6-bd57e46ef736", "value": "T116241265AE6243ACC64712B169BF28D1107D1E3767B241CF3602BEB37A341E5BD7A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805060, "uuid": "e667ffc7-2fe3-4906-b869-50f1ec5d4923", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805060, "uuid": "4a2d976f-1364-4781-bae3-8dc7eb2861d8", "value": "6144:2HBz05cdmkoppvhWVj+8Ky5cz2wWdgNUboGy3MzzVwRxPlQj:2HBzbmr5SZpcnWdL0GRFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805060, "uuid": "78811a7c-950d-475e-a792-2160b9e86d2b", "value": 230125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805060, "uuid": "10d8eb49-bf36-4778-8938-9961f4b63704", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805060, "uuid": "f6c0f050-d2c2-4a6e-8d6b-a0ebb6235245", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c4f613-052a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629844241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844241, "uuid": "4342e871-b93e-4490-914e-517bb9b3e3f0", "comment": "Malware payload", "value": "7aca6e286c0408c7bf24cac22d7632f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844241, "uuid": "222a1d0e-ebe8-4c5d-8a61-7650568baf42", "comment": "Malware payload", "value": "a423aec32f73ec996b0f9e60f52c361b2e8700b7f2b2b84ca8b370601800136f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844241, "uuid": "2ead9fab-f462-4ade-9cf9-2ccb9f36c9ea", "comment": "Malware payload", "value": "e52e723d104f24b78f7c84b9d00249f196579914", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844241, "uuid": "a30fea37-ec80-4d53-9841-2c9abf578c82", "comment": "Malware payload", "value": "1f7eb5e1240e1ffced1e5b69135b7e58c5697928163d40076193d2258c0fad61c4cc64a00db943bfea5ba88f832abe9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844241, "uuid": "dd6130c8-2c69-4def-a6bb-a80e8437c079", "value": "T18EB31845F8408727C3D327BAE78E478D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844241, "uuid": "d6b1c8ee-def0-4f1f-9223-5152a209f922", "value": "3072:MSk+U6m1qW/w8VlPbiRq6AmkZrQAhPDCXFke:U6mgW/1VlPXmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629844241, "uuid": "8113ad43-656d-4bb9-9859-a66d96f4ed85", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629844241, "uuid": "02fe82fc-55fe-4a23-bdf1-66bfba3fdb2f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844241, "uuid": "d386d729-b1df-4e54-8912-fc26aad04e91", "value": "7aca6e286c0408c7bf24cac22d7632f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940c6f36-052d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629845385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845385, "uuid": "f11b997e-e561-4f47-bf34-5448bb2a9169", "comment": "Malware payload", "value": "98b45b56143a1f749d4a9e588023cbcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845385, "uuid": "321b3c0f-e0a7-496e-b091-cd8789e9dd5c", "comment": "Malware payload", "value": "a73545e99a9143bfd5026ce4d5f187cb8d2928c6c8eee07dd4d03628605ac637", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845385, "uuid": "16580bc5-310f-440c-ad06-715fe5a7e400", "comment": "Malware payload", "value": "29952a5c1b0ce00be008a51ad70c7542dde3211c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845385, "uuid": "839963bc-917b-46d3-af12-02d5cf3d91f0", "comment": "Malware payload", "value": "9acca16cedf7c3057bdd83d3a25dd2b68ed570a21fb2ce6cf7165c12ebba4aca2ffba5dbc2482f532e0ded0a521eb5f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845385, "uuid": "aff1ac96-1d0b-4b33-a89a-f2d9705bafa1", "value": "T168833B01E643C6B3CC8307B2029BAE661931BDAA5E2A9F49F31D7DF49B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845385, "uuid": "72eb7632-9d6b-4ccf-9e1a-bbaa01c382a1", "value": "1536:qr5b1ZU4d3J6lreu5r4hWj8L7GDloRmF+wVOz+sXcfW7k:wb1ZU4ZJ6liuq0YvGoRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629845385, "uuid": "cc883a12-3628-43c0-adbe-0e701ff2ce51", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629845385, "uuid": "fea5d4ad-d983-402c-932d-8c194848c4ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845385, "uuid": "99f23e11-7083-4881-9061-a48472a2c469", "value": "98b45b56143a1f749d4a9e588023cbcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dbb94e-04a1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629785423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785423, "uuid": "28b54d1d-1a14-4d43-aba4-9b636bf07362", "comment": "Malware payload (Loki)", "value": "6d15b80668eead417557940080623dd5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785423, "uuid": "a01bee76-4ec2-4f13-a5db-e3b03965039b", "comment": "Malware payload (Loki)", "value": "a775469c7265b9165b1c30a8e74e8d434d6fa759ffcc11e0f4c5075b6b41ec47", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785423, "uuid": "5c5a0d7c-50f8-441e-ae0d-8081945d1899", "comment": "Malware payload (Loki)", "value": "f2d22bb316217eb804800efa0c18a3ba033bb2bf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785423, "uuid": "532aa7a7-9fa0-4e4b-9037-91b86375d4c9", "comment": "Malware payload (Loki)", "value": "a30761e4b50366dac8f22eff65cda3b245fdc5a8a8dee35dfcff961299b7877cb05620972efcf79a5702f69b2aea105f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785423, "uuid": "9b64e256-5435-40a0-a267-d8c23104c9df", "value": "T1EFB2F56DD42702A88F49A7B86B2B1F89154CBB6DF7889532317C57701BE1E3E912383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785423, "uuid": "891a28bf-188b-4f4e-9087-1a43ab18622a", "value": "384:S6jQR7EscF9IuFGxWy9loaixjL5zYPwa2lnw:nER4ss9INxjopZzYolw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785423, "uuid": "7686f05d-0acd-4fdc-bf6b-7407f3308031", "value": 25513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785423, "uuid": "6146facc-e791-4ac3-9b31-274f8e4324c0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785423, "uuid": "754bf0ec-64e5-4024-a1b1-5c832f2480ea", "value": "BALANCE CONFIRMATION.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f191d043-04fc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hancitor)", "timestamp": 1629824497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824497, "uuid": "846d71af-1610-4f03-98fc-780eb647baec", "comment": "Malware payload (Hancitor)", "value": "28e594119e5081ef5504e241e4c72285", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824497, "uuid": "2ad6d96e-b5e5-43f3-aa1b-a628ac87960f", "comment": "Malware payload (Hancitor)", "value": "a84ce5f878d308a093823b638d997e9081a4aaae4ed8bfcad3372f99942de223", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824497, "uuid": "304a22c4-5865-4012-9ca2-00da9e51ed22", "comment": "Malware payload (Hancitor)", "value": "794e8eae373570e15b563a0d3ae1ee042a64c313", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824497, "uuid": "8209877f-8752-4f3b-9bce-a8ddebd0eddb", "comment": "Malware payload (Hancitor)", "value": "d3a47202bec255407cabe18466367441971162c4f69cf6b39c9cdfad9fbeaa5d8bf899745e4420881b29e5c93b82f77a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824497, "uuid": "22bdc984-2447-4259-8d7b-f3ebb0242250", "value": "T1A9058D23B2B24833C1731A7D5D7B5368A83ABE413A7CAD462BF51D0C1F396813D29297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824497, "uuid": "6ecf8d30-c9e7-4634-984d-9ff263756156", "value": "e8f80ba4da806d63d82aa9115d581ac1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824497, "uuid": "4e9e9c28-aeca-4b49-9d94-4603d03562e9", "value": "12288:/pUcS4hKZz2f3ssC0CpK54o5FWXgiq1MNQGW0wTX8Uo/XE5Uf5VVVVJDgZh:/pFBEWss7mKSqQtiKvwr8UIEeDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629824497, "uuid": "740a6820-1dad-40c6-8700-9de7a543498c", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629824497, "uuid": "6a483ded-d818-47d6-b876-dc921f74fda8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824497, "uuid": "816f4f9f-036c-420f-8454-4242c0477b0d", "value": "jjy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956daea5-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629812746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812746, "uuid": "02d64b6f-bfbf-4d2a-bbfe-90b98b5bde90", "comment": "Malware payload", "value": "b8a8a1af70157b7499831be3ba37141d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812746, "uuid": "4210d5ac-8218-4e1d-bfcc-e8e66637e2a9", "comment": "Malware payload", "value": "a8f40382ead50449d872ddb8db0251148747fb63fed23bf4647d14fd226a2fc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812746, "uuid": "59a1ffa2-aa79-4ebc-8994-40e89cc995d1", "comment": "Malware payload", "value": "4431431baa3092d50d92886fd97e21f049396387", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812746, "uuid": "a053f203-e867-4e32-b80d-ff859fe44258", "comment": "Malware payload", "value": "011eb65af8c376c70db9254842a13fcd5376e6c1d95a411d0a335bc484df3d6b127398f21fb84aa682de9d26351582c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812746, "uuid": "e22b2fa6-4231-4bd3-b16b-e6a9277e78a9", "value": "T1FCC512952A519E67D848F7722AC7A17C13FE9BEB2603644EB354EF0C96302A5170F3E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812746, "uuid": "b43910b1-69ac-4775-80b2-81b0dda62fea", "value": "667e6d0f434d248524103ade13b913e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812746, "uuid": "fa715bf9-f186-4638-a8bc-6d5ab99e2aff", "value": "24576:SSLXUq4Zu5hXGVpZZocimOwIxAz8pq/Vkpxtywa/9PkZHtgo0osu1lrSrw7nj7t+:52G2VlimQ+Dkpydkdt7J1lbj7tFJg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812746, "uuid": "8be0a3f7-2928-46b3-ba1b-1c7f209fb299", "value": 2630332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812746, "uuid": "1f920690-0fe8-4198-a07a-5d54b5d87c3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812746, "uuid": "c8e4d6c9-9f36-4c7d-a9a0-095dacd5dc15", "value": "b8a8a1af70157b7499831be3ba37141d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7523bb36-0533-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629847910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847910, "uuid": "8940166d-4c5f-43b4-a846-b79724f8b35a", "comment": "Malware payload (Mirai)", "value": "d5610ef7b31cf367e3ea3ccd7cdd2296", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847910, "uuid": "d28544d1-a142-4033-ac9a-98fbc8e82c70", "comment": "Malware payload (Mirai)", "value": "a9c69de4f87fdf9a48530dd63186d6ce388f046058ae0fe7d583ab6a2638406b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847910, "uuid": "29f61f44-075f-4cf7-9bbc-c92ea835e893", "comment": "Malware payload (Mirai)", "value": "6368a73be3b7103c6a7b17e25d1d799a74db5049", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847910, "uuid": "a9a6da05-03ad-4b79-a50b-a868b49ba844", "comment": "Malware payload (Mirai)", "value": "8bd6e2a8e6e4680bec05ae70f6f7ac146588003a56e0fd24dd04f0346997a96e65036bea203cc3c4e9f912e11875ac32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629847910, "uuid": "2a5b2701-e63c-4cbc-9ad9-b1a91344f773", "value": "T1CB53B50D3E319FBDF79C863447B74E21A65837DA23E1D284E29CE9011EB024D646FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629847910, "uuid": "121b1170-696a-4696-9309-87142fc1923f", "value": "1536:DLT4JxAFn3vEAvIU6d4MGNBYfZuAcF+8G5OtoM:DLU8nfEAvIU6g0ZuAcF+RXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629847910, "uuid": "4b6124a3-3158-4a63-a848-51cc1f2ea774", "value": 63668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629847910, "uuid": "1c24f158-a648-43b2-b3e0-9d6cb72c16ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629847910, "uuid": "cc0f7873-3e91-43ca-a7dc-4cf683719e1d", "value": "d5610ef7b31cf367e3ea3ccd7cdd2296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0a838f-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629786319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786319, "uuid": "5f0e7c1c-ff30-4295-b0ba-03fb8ef522a5", "comment": "Malware payload (RedLineStealer)", "value": "2f09b702b4ea73bc5a3bc19e5a6788dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786319, "uuid": "08dba4d0-0541-4e30-8948-f77764acf1f7", "comment": "Malware payload (RedLineStealer)", "value": "aa5c88d32d0495a0111354db177f21f2affb17d3d93ff4103f9f3fd3d1cbd51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786319, "uuid": "128e8fbb-61ef-4235-9bb7-910c929ba873", "comment": "Malware payload (RedLineStealer)", "value": "09ca03da0f810c27fa5230abc471baee65b17f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786319, "uuid": "5be94fe9-caf1-4a11-93fc-4d68183cb0db", "comment": "Malware payload (RedLineStealer)", "value": "6dbd53645065a4d3461e88a21713f7daaade52103a44ad87b6df0ec94efebe4e18e36de4c8ba952bb9f141d1863695dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786319, "uuid": "5846f8bc-5908-4578-8c13-b7d932f08620", "value": "T1F374AE30ABA1C035F0F712F855B682B8B93A7AB15B7450CFA2D11AED56386E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786319, "uuid": "d47365ac-959b-467a-a74a-7de3a3658955", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786319, "uuid": "61ff26df-ddd1-42a5-8b60-37d9a4940f33", "value": "6144:tLbD4h7mgj3indeFSix0LTYNaxaAsSxWDczOQX1JIq6SFdwVjkfEvB:dDI7msSndpKE/sKWDEXXIq6SFyd7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786319, "uuid": "80470730-faf7-4ec6-8ab4-d8cf3647de4f", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786319, "uuid": "1cbbab06-5e04-4c0b-886a-e66a523d5cd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786319, "uuid": "952f5ef2-a331-4849-b8cb-50c454245efa", "value": "2f09b702b4ea73bc5a3bc19e5a6788dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090e7d75-04c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629799625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799625, "uuid": "2cb5b4dd-a19c-4062-bf84-bd1fbc6ed623", "comment": "Malware payload (Amadey)", "value": "3172370112b0a5d7b8c1df8813c5b23e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799625, "uuid": "e98c1390-2289-4f2a-84f1-7a0acfec9401", "comment": "Malware payload (Amadey)", "value": "ab2851b9d96065b01a96c3305a8bbec77522b97a6c751a82a34f47f45f30af6a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799625, "uuid": "7c0bd49a-6422-46fb-bc1e-f40e1de403fd", "comment": "Malware payload (Amadey)", "value": "3fe0a9b75b2f4dd939df21f9086175d9127191b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799625, "uuid": "af93d6b4-fd7b-48a2-8918-b691751a4107", "comment": "Malware payload (Amadey)", "value": "12add38f7f1abed76b1e69493786083f39819c4c0136b4eb9eb4f1d09efe8a757661c834b7976a4eaa6445a6cb65e895", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799625, "uuid": "75c2896d-13f3-4753-8583-42c1fd3310d4", "value": "T16A3533255CEFCCCFF9EB253685B4E246333FD48481B4EBD74A2ED26A019DBA84672114", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799625, "uuid": "b3fbf768-31e1-4a73-ac7e-b05bc853c221", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799625, "uuid": "3949ad4f-828d-417a-948d-0e0a54e7aee4", "value": "24576:Iqtwk/QybGD8xuXcG9Rc0dH9YX8RbVTttj3VHmq199ZM:cuQzDOuXcGLtdGq9tmC76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799625, "uuid": "9391287d-5efa-462b-a365-8773e83b43d8", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799625, "uuid": "75c3735a-a19d-4344-9192-6bfacd46a0b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799625, "uuid": "7506a9c2-22a7-4d4d-9bc5-5994b545d200", "value": "3172370112b0a5d7b8c1df8813c5b23e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb92915-04a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629787097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787097, "uuid": "1e5d975f-0a52-4a31-a31b-0aaaaf1dfe7e", "comment": "Malware payload (Loki)", "value": "138f8e6100e6bee1e6ac8323eaed4b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787097, "uuid": "2a631f61-cc0b-4d6f-b5b5-f76ec8f76d6b", "comment": "Malware payload (Loki)", "value": "ab6cb0b8add55b66b105add3ef5d745f037be2e21c28f5e0e989b3b078cb6fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787097, "uuid": "625c10c1-567b-4b02-a063-fed22034b980", "comment": "Malware payload (Loki)", "value": "735c0cfe741d32494f1ea78367ddc4d4becd7072", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787097, "uuid": "99e43a10-ea02-4b97-b63d-017b22734412", "comment": "Malware payload (Loki)", "value": "d6ca5adbdaa0b7e978255e7a51f152b93fdd7f6459b4ba050e41083a746b4a7e6faf60779ac8015290936b248b0c671d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787097, "uuid": "555e2f8c-dee7-426a-8ff7-71d72264f9ec", "value": "T19CE4BFB071978696F11F4A742538BD5403B231B3E9C6DA390B5A614ACFEDE987F4820F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787097, "uuid": "1abf4130-830e-4def-b0a4-112160726196", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787097, "uuid": "031d1167-7740-4d30-b1f3-7a924b0e5460", "value": "12288:hL3+NtpSupfZ+aYeF258kNbuM3qoJHPhINql3ITL2SXY4rIz5JOEPpBja:SUxGFebXNS43g15OHPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787097, "uuid": "69370085-2e07-4c7b-8765-c6eb19d14ac2", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787097, "uuid": "eb8ac2ee-26c4-4321-8e37-d95849d57640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787097, "uuid": "31ad94e2-beb8-4798-8a23-637bc82734a7", "value": "138f8e6100e6bee1e6ac8323eaed4b9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eae8650-0507-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629829028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829028, "uuid": "22617ab5-c117-4a37-80ab-be172df13cb4", "comment": "Malware payload", "value": "320dd4101f27b336fe012fe18e7106fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829028, "uuid": "11b92b48-92de-4fc8-92f1-4be78267612a", "comment": "Malware payload", "value": "ac57d8cb242185bd11b7b0ab898c06f7904e0e0a0d9c39edd3b136c902bf394a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829028, "uuid": "0d6670f3-a503-445b-8400-c5e5d49caf74", "comment": "Malware payload", "value": "34295f60bdf81c747bbf7bb17567ee6e3585f1f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829028, "uuid": "a7dff913-0fa0-46d7-b791-8209784e82ea", "comment": "Malware payload", "value": "f7f7dbaaaabd6f50474af11523c3bfbbd55c54a414dd7d62849342e994b344b0634439284423d644287efacadbc043d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829028, "uuid": "fcf8b8c5-b0e2-45ad-b3df-e74b1216153c", "value": "T11A05B47E1ABDA2278175C2B5EBE75417F0409B5F3411AC257AC203664232A7BB4F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829028, "uuid": "22aa01cc-cc53-44f8-a5a7-94813bf81d3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829028, "uuid": "21142390-7512-4a30-8a44-e09a1d49c4d5", "value": "24576:GVYQaHX1Engs527nRCE3bLlB2N8vUyQ6DO19g:EY/lyg7boAL/2asyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629829028, "uuid": "9c8df1a1-a5db-43c3-a68a-f4ae9993c5e7", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629829028, "uuid": "8bdb2e21-9c67-4070-874f-8a0c6ab3d28f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829028, "uuid": "6f8fcf73-27c2-46b7-a0bd-457eea483ac0", "value": "Swift 3876448484 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99b8088-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629805049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805049, "uuid": "8516205e-a3b0-47ca-b5f6-f44df9a07d2e", "comment": "Malware payload (AZORult)", "value": "811184048a84cadd13aae64542578817", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805049, "uuid": "fd6b4ac2-52d8-4bdb-9e28-649de0a7c4f5", "comment": "Malware payload (AZORult)", "value": "acfd67e70a3b73fa1c66207594fd2afb565fd437470c61f7c2de922d855e71ea", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805049, "uuid": "688b007c-7a6f-4bfa-820c-3351ffb55e45", "comment": "Malware payload (AZORult)", "value": "a17c9b48ca67b4aaaaac728c727701818b9f66dd", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805049, "uuid": "341dfe2a-8bc6-44ae-b6ed-540b5a19c06b", "comment": "Malware payload (AZORult)", "value": "cb65416932294be13c0d3a658a68d28d7cf0eeab2e684880fdcb097474c0c2ecd9d26038725e0b9284b0bec521af1ae6", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805049, "uuid": "d48f53fb-b141-4de6-ba4b-b48207014106", "value": "T1C1341263F47660E0F22011B8C793129443E7ED6C27640FEF6152F949B639EDEB476A24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805049, "uuid": "65c1e19b-120f-46be-8d61-0abea56fc4eb", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805049, "uuid": "8061b807-2c16-47e1-834b-2159fccc91c7", "value": "6144:XwhpiItG42hMCYt2XNF20vMHGT0RvCYn20hp+pNGV:gnpo42hhYt2+3HG6V20h2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805049, "uuid": "fca85f74-d0df-4128-89b8-0ac170f626ad", "value": 230370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805049, "uuid": "ce9af58a-dd95-46fe-abdc-84ec523fb1b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805049, "uuid": "62eab458-911d-4f6b-81d9-8163bec82f8a", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab897d6a-04b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629795603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795603, "uuid": "bd195fec-3a1a-4c14-918c-961997c4f456", "comment": "Malware payload (Mirai)", "value": "f4169417ebf372c33932c844452d3829", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795603, "uuid": "14696b9b-6953-4987-af48-6f455c37106b", "comment": "Malware payload (Mirai)", "value": "ad2ba0c97023cf23a69452dd1acf913da132db4f4a64b48ebc13d76ccbe3fe5b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795603, "uuid": "0f87cca6-6eaf-4082-8bb6-fcfd85b4e00f", "comment": "Malware payload (Mirai)", "value": "a0fbe525c8acd322dc10975277c7000246d02129", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795603, "uuid": "534a1e0a-d3e2-4e9d-af31-b3e32c8b5dce", "comment": "Malware payload (Mirai)", "value": "a8d9ca18b9c6aef2b776ab6f2465d6aeaf2e5aa3a23f2b79a53bcb30d6a11cb3b1989d8e1cef775e214d653e78c46fc6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795603, "uuid": "6ab0c698-1f9e-4548-a369-15fa0324e5c2", "value": "T167C2E121C78B1059C8AD467674AEAF4E1870F5ADE28559E7B4CD1A7DE4832303F643E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795603, "uuid": "4fef7654-1811-4743-8539-5e2adcd7cb79", "value": "768:DD/su//JOqvstwXbo/XaBQ7V+GqvGnbcuyD7UHQRj4:DD/suuwroSyJJQGnouy8Hys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629795603, "uuid": "bd9efe8f-3948-4184-b3a2-31b9e5516e46", "value": 27948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629795603, "uuid": "af06b566-e2d0-4801-a8c6-6ded8298c471", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795603, "uuid": "6de7b9ed-1fe2-4da3-8448-f26d5c5e9722", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf349a0-0479-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629768200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768200, "uuid": "e833f60c-a08e-400d-8608-2467e25a9c16", "comment": "Malware payload (Loki)", "value": "5be66e805ea10740668331c26a4591ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768200, "uuid": "0038aa73-8033-434d-9685-4892c5a2f4ef", "comment": "Malware payload (Loki)", "value": "adcb5db1f09d2457682e3efed798b70fa73a6e56fe875b0e13e4dd0ab243cbb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768200, "uuid": "0a47c13b-e3a8-4a10-928a-7554eb26b567", "comment": "Malware payload (Loki)", "value": "e9daab214079864b80a488174b825641e418f889", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768200, "uuid": "d5c6adf6-0db8-4974-84b5-dfceece5ce54", "comment": "Malware payload (Loki)", "value": "59ed16ded92f309dfd98f8992caed946ebb35781e13f076c60be35152f0e3b3d701ae9c2154251f7e8e7afc75f8e71a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768200, "uuid": "379c9bfa-4cac-49ae-ae73-4c6a9dec888a", "value": "T1F4D401497B45F78FD52ECE7E98255C20E6F0A1350307EB56AC8321E8AD8D7958F052E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768200, "uuid": "df51e4db-d97b-48a6-9397-1ca92e889c7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768200, "uuid": "18157f97-38e1-498b-970c-872e0d42c600", "value": "12288:l8E7VYFIjQn/ytTLd812xFbJ/xch6HJBzhi8LnfxS7gpRpYZ/AUajnihgV:SEJ9G6hC4FbJS0hDLbpRpYPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629768200, "uuid": "3d91fee0-a353-4328-9c27-c0bfc270e30b", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629768200, "uuid": "48d82875-173d-47bc-a0f5-2225e9a55d72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768200, "uuid": "23f232c5-21f6-41b4-b154-5b81bf5ad7af", "value": "5be66e805ea10740668331c26a4591ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12ad93e-04d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629806404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806404, "uuid": "bf26e625-d085-4e7f-be36-c2d1094fbf85", "comment": "Malware payload (Mirai)", "value": "d8c30d1b6e88f59a78fef865af4f314e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806404, "uuid": "b431a7a4-b9c6-459e-b4cf-2cfcfe78ab51", "comment": "Malware payload (Mirai)", "value": "ade5b6c0e4f75b9aa83635a6b6681270ae1d565916572c63b203baf75fe06c44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806404, "uuid": "23774e37-4fa9-4d84-8212-46f7a8da551d", "comment": "Malware payload (Mirai)", "value": "8e2d865d39435d6ce99fd9ea15d75abafcafb99c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806404, "uuid": "537fd0a1-b3f5-483e-88a0-80d949c293cf", "comment": "Malware payload (Mirai)", "value": "6f3ddda24ef2734e062ef32a73f5eca87c8da8d5bfcfe8713a6c716779912fcda18e50af88d821b79ed63bde02a5e9f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806404, "uuid": "f635b7bb-3993-4e60-bd56-57dab7eebd07", "value": "T163037C84DB43E2F4ED3B05B1E9A7A7B15731FA265459FE97C36908348C02112DB07B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806404, "uuid": "b8c3e9b2-d686-458b-afe1-6ee438500fa4", "value": "768:iTruD3v1bmtIh79Vf8IcGM9phOfTjiQc0jryhrYH++T8mZ:iTKDdt7bjVAnOr2R0jGyHsmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629806404, "uuid": "2c0f8c9a-2472-4910-9e88-24bec32978c0", "value": 37988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629806404, "uuid": "f4a87322-41a1-4567-b205-9fa37345819d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806404, "uuid": "ec6896c1-4fd4-480f-97a0-939b8a4ce448", "value": "peach.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545d5faf-0473-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629765392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629765392, "uuid": "c814d66a-e08b-4452-9b58-fe80b141f4f0", "comment": "Malware payload (NanoCore)", "value": "b927206da06227fcf2b5244e1bc171a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629765392, "uuid": "30e21b60-cc18-41f8-ae7f-3ead8e5ce592", "comment": "Malware payload (NanoCore)", "value": "ae07baacc615ecfcdf7547d7e2de432255589b45a9969e39718adeee231d05f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629765392, "uuid": "dacc5149-2fa6-4787-913d-24aab3d25717", "comment": "Malware payload (NanoCore)", "value": "6c06941acaeffcdf6f72f43be27758e8cddde911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629765392, "uuid": "46224bd4-0495-430b-9262-4149e97ec13b", "comment": "Malware payload (NanoCore)", "value": "472762e8625f7681040965b701fee5513319661ce053d5233d729391d4f855a5aa568f71761c1ae404338db451a14833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629765392, "uuid": "9354437b-ba14-4426-9935-68519688a236", "value": "T1E62413C6958852F0CD9726B09AE3F48F65BDAE3F2AB4110983A5770DABF361DB017031", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629765392, "uuid": "0cdf7223-cb51-45fc-9adb-721b32a061fa", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629765392, "uuid": "b8a9a0ce-2ebb-4eba-9a47-8f1350eea03c", "value": "3072:/PcNUzqXcRCmJn/tc3Y7QSWWknGB9BzdI8SvrVu5GRG/xpH8yMNyUf/DwKJ90DZn:nGUV1G3Y7QxWeS5dY5Ral8oiw69yWAQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629765392, "uuid": "3dc2303a-ff8e-4f57-b336-cdc76ea5e9c9", "value": 221093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629765392, "uuid": "92799213-abcf-4e8a-80a1-6e7ec5a97b28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629765392, "uuid": "40f3407b-0094-4721-b055-42447f12c1b9", "value": "SOASEIKO (M).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c336f0-04a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629785451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785451, "uuid": "4a27c279-a243-479e-ab6a-45ba977c13b0", "comment": "Malware payload", "value": "3fb22122ef2c56e87223b29adafeba2f", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785451, "uuid": "f15f7be0-551c-4320-9d5b-72672b90850b", "comment": "Malware payload", "value": "ae305fb0dfdfdaebfd843907742bc582e5a7500324bb3b2c9a94608af5628de6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785451, "uuid": "aaaa9481-bc49-4f64-b96b-348e704d5d43", "comment": "Malware payload", "value": "c6894003c446d5b62110f39fd764e36668d9cf50", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785451, "uuid": "8f70669e-eac1-4beb-9161-b5bec053fd98", "comment": "Malware payload", "value": "bb3505a7a2d20b7bc766accf06c698aa8fbcf3196ec24283b2388bf7b2719d312e8d52373787b5fb938a59c58af99519", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785451, "uuid": "27cf6719-77ac-4f98-8c3c-c8011620b425", "value": "T160551247E6C98A5BC2AE48F0FCBF943C893D4CDD6B5652BB55B7B2166034D3912C0B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785451, "uuid": "0b854834-0ac3-4ba4-9802-fe8a4c1c83ed", "value": "24576:dcMjKDfopm+7yZDb1bIhD/yQJwJFX+lsem2uRfvpFGgTiuOUnNCSpwAoVDDB0e4O:dDubopvGDVgjiD+i7RfvjG4NCG0eZ54b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785451, "uuid": "c5ae551d-b022-4d02-b6be-2e80405a6599", "value": 1317432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785451, "uuid": "28876a0e-be43-4788-a4ed-1c514658d794", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785451, "uuid": "26fad403-b0f8-4a0b-bf25-9523c9575348", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a5e5ae-047f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629770657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770657, "uuid": "540b1b48-ed8b-4415-8698-f5c21aa40448", "comment": "Malware payload (Loki)", "value": "c3b1a1ee8d107f322bf008afba7e5a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770657, "uuid": "2c5f924e-45ee-404f-b50a-0c3d1b540c92", "comment": "Malware payload (Loki)", "value": "ae4e01b2d1998acf3b1c00515d860f5569c26d81bc3f6db56f75a7025da86c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770657, "uuid": "fa68d5f5-bcf4-4004-9f84-21d5730d9679", "comment": "Malware payload (Loki)", "value": "ae87430175ed196657a41411b7d1a2ebd69808ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629770657, "uuid": "e74c1beb-dade-41e1-b400-f5edbe06ca9a", "comment": "Malware payload (Loki)", "value": "e0de5ba174e91718957850145a64cd8836fbfbf0bf618f16717524f384d7f6e457948339d773fc594603efb2561c041c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770657, "uuid": "dc23fe2d-51b2-4e9a-ae5f-d1b1a0ab76b6", "value": "T1BB257D24738077D6E8A50F328832769407F2A6576639F65F18C436EC6D3261F871FAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770657, "uuid": "281863ba-19be-4c05-9ed0-eef5c31e40bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770657, "uuid": "d10a6fc6-b5bc-4f71-b409-3bf93abe9c7d", "value": "12288:9o1jiKKYYu82DMWQsLhBN9aTom5OupaaUxjxuVj:9okYf82fhf9aTXEu6jxuVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629770657, "uuid": "0f99b48e-9cb8-4018-9fb6-453c925a6b35", "value": 996864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629770657, "uuid": "e52a4b9a-7446-455f-80cb-048550b19987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629770657, "uuid": "734ea4a3-a566-4d4e-ae99-8840f504d54a", "value": "PO#24-RFX-018RMH426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41252eab-04db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629810027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810027, "uuid": "cf2d8674-8499-4fc4-9f2f-e3e302132763", "comment": "Malware payload (Mirai)", "value": "05bd0312cdb568cb3a091c12a4b19ead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810027, "uuid": "16989dfe-4d4f-4878-bd6f-4546d1d34a7b", "comment": "Malware payload (Mirai)", "value": "aea3f62bf73bf729b7d942cdf6797811c34c0d9bc3e0b92325aa4bfc559bdab6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810027, "uuid": "44c17a28-15a6-42a4-8afb-8c9c12c311d7", "comment": "Malware payload (Mirai)", "value": "0b9e2ac09737f58e3ee6a4810075b35c5e5cb427", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810027, "uuid": "9d185616-895e-4bf3-93ef-013d06bd112a", "comment": "Malware payload (Mirai)", "value": "88248481e5e7265cef758ebd2de0b4db0c84c9b994a4e067854374a1655301ac464d9888e90ceffc09d34383803f6b46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629810027, "uuid": "d71df20f-d74c-4426-a6c6-78fbe951a72c", "value": "T110634D21BE621D2BC5C4657661E34331F2F6838A34FCCA2BBD610E9DBF6464032577A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629810027, "uuid": "807d0c81-aafe-4546-888c-8ff49d28ceb7", "value": "768:jcYrU/RMDRLlyL1qOVO+JqbUw6Ltk2V+mmDc+5bcyN1tsj/BIqZ:VlZi1qO1+ktk2VG15Jto/BjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629810027, "uuid": "79982d74-3d04-4886-9c55-87c36a868e82", "value": 66900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629810027, "uuid": "1bb29a02-6de5-44b3-8c91-21f3b662ba91", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629810027, "uuid": "0973f32c-fee5-414a-9bcd-39eb2ad57c19", "value": "05bd0312cdb568cb3a091c12a4b19ead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7178224c-04c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629800660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800660, "uuid": "474d9b4f-9234-41ca-ae65-074c28506556", "comment": "Malware payload (AveMariaRAT)", "value": "163856a5d54168c13945c9d5609ea1f7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800660, "uuid": "3386ef14-34df-4884-9236-be9d6c57ba5b", "comment": "Malware payload (AveMariaRAT)", "value": "af117cc3897d228854dfc1dbea6ffe53aefdd3ded7dc1aac840acd78ad65eca5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800660, "uuid": "b723bb99-7ab8-496f-ad01-591cb0255775", "comment": "Malware payload (AveMariaRAT)", "value": "deda5a4b11c148b50cdc5c1d763d745ea5a8684a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800660, "uuid": "df88ee7a-2f87-455a-8006-2980e295d7ca", "comment": "Malware payload (AveMariaRAT)", "value": "71d8996f29ee37dcc505c31ef22fb6b4850c8741dfbdbafb8a8fae0f50486105442be02d3fb9252651bef8870a3fe814", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800660, "uuid": "741c11cc-9d1d-488f-9fd2-056ef3dac38c", "value": "T180158C306389C250EC1A8EF0167CFBA402F275E7B6C5CD7E16EA324CCE5A9D1660765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800660, "uuid": "c00211f3-75cb-402f-abd1-a6749add1e00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800660, "uuid": "70e1d911-2b70-421d-ac09-967b08ee36be", "value": "12288:v2kzCamXZWApyQ7u7poDWqszLhXBCZvzJOsERRJSpFjJj02EObba4k4A5:ZmXYApy7qsz1ns+YFjmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629800660, "uuid": "206eb325-72bc-4a29-8d3f-554e21a80cde", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629800660, "uuid": "979c4460-2075-4a80-b46c-9e74568db972", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800660, "uuid": "6fd50b82-afdf-4f81-94d4-9e015d5766fe", "value": "MT103_09876TYUI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68160d7a-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629804939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804939, "uuid": "cf9fadc7-55e1-4e42-852d-14148109de93", "comment": "Malware payload (Formbook)", "value": "a57d7b2a91993bc4c152da018d95daee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804939, "uuid": "a2ddea7a-ac4b-4f5d-8dcd-821ac497bf47", "comment": "Malware payload (Formbook)", "value": "b1415629db6dceeb9b1fd57ebb50c5c0f47a30e5ba5766ad4feadfd56609acfd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804939, "uuid": "7e6750f9-c437-4bf9-bf42-2e7d95c0c4be", "comment": "Malware payload (Formbook)", "value": "9aac54966602d91b627a658b8e0bac3c08a6e317", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804939, "uuid": "b76bb16a-38f7-4a9b-be7b-259a8d21479b", "comment": "Malware payload (Formbook)", "value": "d98cec0ecdfe6f973611778cfeaa81b9ee0f3f0c1d3783e2fc651409eb4032c169d4041f694487131621ccaa9162ca8f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804939, "uuid": "e7ef54f0-bb29-414a-88f8-8be3255c4657", "value": "T1295523D27A03D7C2D31DE1BA4CE272141469BC22FA467A9963317E92D07B761BCCB706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804939, "uuid": "fd3e946a-abce-4626-a861-284e082e895e", "value": "24576:1mx7oYMaIJv1eLVmOJEKdylF+y9V9a75Cky38e+LDyOZ3V1Xo:K0vItJol8y9V9OCn3q38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804939, "uuid": "9353eefb-5ebd-4175-98e0-1c5aef09c5eb", "value": 1315432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804939, "uuid": "168eee1c-1675-4890-bfa0-db2b1427722c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804939, "uuid": "26a0ed1f-7fbd-4308-a9d6-0c12aae28265", "value": "Neworder.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d356c4f-04d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629807820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807820, "uuid": "cada940e-b4f9-4c5f-b37e-7e3b841d4f44", "comment": "Malware payload (AgentTesla)", "value": "a642330e8c3d462dfb0b833716fb207e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807820, "uuid": "f6df5b68-9e42-4d68-a28b-512bedfc8919", "comment": "Malware payload (AgentTesla)", "value": "b265897f9d97d7c1d2ee2533e216946dd241bff6644b38ba8928db6e1ddf1b63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807820, "uuid": "7bb4c1ec-d7a7-4e4f-bf46-282d6dc40c64", "comment": "Malware payload (AgentTesla)", "value": "bf4b0914574663a44bc0cd488defa2d2842ba505", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807820, "uuid": "32859960-0bc7-49af-bd9a-0f72b3314692", "comment": "Malware payload (AgentTesla)", "value": "672dbf77039d1ccd618505d5d9d9bf4620d05e0c47b6ddbc7957d66424c3ab798fc20eaffa88939fddcab717f9405831", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807820, "uuid": "1b12fab8-914e-4cec-a4a2-25a21428eb6d", "value": "T12B158C3063C9C284EC1A8FF0167CF79402F275E7B6C5CD6A16EA724CCE6A8D1260765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807820, "uuid": "bee251a7-b06a-48cf-bea7-89ed89ea71b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807820, "uuid": "d891e079-4b12-4184-ae90-25328acc7891", "value": "12288:wRcsGI/cpOOPrx+zhZD8wxIw9Gb245ouukAE1sERpmJqI23eEJhP22EObbV:wWdPrMNZDCwOGkAE7dI+eEJhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629807820, "uuid": "6bebbb6e-42d4-4aa9-a9c7-b159d57be9ee", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629807820, "uuid": "bc0bfd68-f47e-4935-97e0-4e1a43b83e02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807820, "uuid": "5aa1cadb-69d4-41bd-900f-01548a60583d", "value": "N0A3VX7wWXZO2nd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971a6046-04da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (StealthWorker)", "timestamp": 1629809742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809742, "uuid": "66772e18-ac67-411f-8522-b6337376b740", "comment": "Malware payload (StealthWorker)", "value": "5e7f9ae99a7e6cc5a2f40a4a159bc3db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809742, "uuid": "175b874f-7733-4c97-a83b-7d9a8b50a05b", "comment": "Malware payload (StealthWorker)", "value": "b302fcb42934760527ba26528d13aaa8e2cc3150b8055485e5c27f24edaf2892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809742, "uuid": "c8b6431c-f543-4667-a566-12db8bcca31f", "comment": "Malware payload (StealthWorker)", "value": "7fe31637a9f6e2e6e463d2076702a00f92f06d76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809742, "uuid": "00a434fb-d42e-41bf-b587-ecf0570855e6", "comment": "Malware payload (StealthWorker)", "value": "8b3846734ac88472e38fd4e8c2edba000f9a1d2ea275ccb727c810214f750b97e5bf8f7286da2707ed456b547f56049e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809742, "uuid": "fc9621f8-026e-464c-88d5-833b1a49c0e4", "value": "T1A6E3BE5079D0C073DC511C3148D6CAA0EE2AF861AE7599473BD816AEEF712F1B62A363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809742, "uuid": "17476a34-d51f-4a22-8781-f5541a88c6d6", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809742, "uuid": "46693010-9c06-44ff-98dc-5abdea889ff6", "value": "1536:vUFEqUJ0eDYKk9DX0Ps3PS10VcpCMLocPQtGhE5XKcBBlJATEL+hItC3nf:IEYr0PL1rpCM0cIQhE5XJBBlJQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629809742, "uuid": "ed114b31-8979-4a3a-9223-08e5fc697e05", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629809742, "uuid": "d0ec7080-07f3-4071-a5cc-a5622e2584c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809742, "uuid": "1c6c95f8-7691-406d-88ff-21212f818019", "value": "5e7f9ae99a7e6cc5a2f40a4a159bc3db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15893f5-049e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629784124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784124, "uuid": "a445d67b-7892-4cc9-9eea-04027765344d", "comment": "Malware payload (Formbook)", "value": "e326d1eac6386e9c4b427f8d321d5740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784124, "uuid": "c762aba6-789b-49b5-ae96-5612cbd10863", "comment": "Malware payload (Formbook)", "value": "b38eadc0a59ed8405656c9445912f644724ed07ce9086e0183a6b086460f20e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784124, "uuid": "d63fc180-a10d-4916-9492-aba2014d8464", "comment": "Malware payload (Formbook)", "value": "2c268f4a18427a7d1cc42c2f4decf730d3ae16eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784124, "uuid": "d26a6079-c901-4ff8-a66f-42cf1eff59d3", "comment": "Malware payload (Formbook)", "value": "f4b9a86a0b0548479b4c38d01ecbb9db2aae440c219929c2cb7bc88a217c646cf24ad8fa582b313d5b5b14de4078b044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784124, "uuid": "95271fc7-7df4-461d-8759-f7c548688c76", "value": "T18D15063D19B91637D1B5C355EBE58423F148986FB404AEAA6CDE03A7034BA9734C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784124, "uuid": "44667d9e-067d-4804-861f-f70cff31003f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784124, "uuid": "35477d27-920c-4b50-9356-555137ef8194", "value": "12288:rh/1XiD1mzWnw1xIhrBD1MuUV72LASPP5lemLErr+WZ1:rXiD1GcZhF15nf3TlLErJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629784124, "uuid": "c8e23d4e-a51f-4074-af59-bc98df8a4b49", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629784124, "uuid": "3c47988c-2f2c-47bf-b4ba-3abe9121daa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784124, "uuid": "32243bbe-3207-4c9e-a4e5-1200a31ea352", "value": "DHL0039283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2de680-0501-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629826311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826311, "uuid": "48c0974c-a71d-4de4-9289-65d668159a2b", "comment": "Malware payload (RedLineStealer)", "value": "47b88c16f9c8b311fc96b001acd344e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826311, "uuid": "e480d466-0116-4441-8beb-51b4d90bd176", "comment": "Malware payload (RedLineStealer)", "value": "b434b3190e481f0f0fe310e16b560ddd47aa76bcda84e4fdb81499047cc54e06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826311, "uuid": "273871b4-6f6b-4dc9-adef-b73a746d67ad", "comment": "Malware payload (RedLineStealer)", "value": "41c492f919d8fa43b0f98c77de393e4be406fbd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826311, "uuid": "ffb427a3-800b-420d-aca0-8071c1b460b0", "comment": "Malware payload (RedLineStealer)", "value": "c92aaf9bc8be8c8434b5897787d1062ba29a0f4058b0e05bafe5d89caa7bf7bcf93e2054b514c5354bef9f4c5148673c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826311, "uuid": "88b8f3a1-2501-4a1f-a8a1-ccdf741ec380", "value": "T10E55A3289C6471CC741EB18D4E3245E8439EFDA621A2EE2376DD9B329557D9CEBE3C00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826311, "uuid": "0f6e335d-7e9b-477b-9e16-db518d6c431e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826311, "uuid": "ea89477f-ba06-4c85-8483-3bb02913d991", "value": "6144:AneICwPlzdx/bOPSaCUS+Q9owmw6NQzrp5lICT+5Bj9hv6LpBE+1gtj6lFI8lz7a:jwThlICT+5Bj9hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826311, "uuid": "2872e272-0cb2-4e4a-8a54-8b53e797fde3", "value": 1330688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826311, "uuid": "c33e86ee-f018-4ac4-9003-b81007f3a774", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826311, "uuid": "2d8d73b2-878a-4595-8e99-b0c199592e46", "value": "47b88c16f9c8b311fc96b001acd344e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349d6507-0508-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629829334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829334, "uuid": "53349207-b16c-4cb3-9d8b-2f8aa4a20f2a", "comment": "Malware payload (Vjw0rm)", "value": "1abbd5432118e4de7c696d5d43a7449f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829334, "uuid": "ba380150-6833-46b7-bab3-1e26da3cc025", "comment": "Malware payload (Vjw0rm)", "value": "b4489a7f0467bee2782b5e5cf74763d0c05148a9044092eb79aba7c588f35f99", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829334, "uuid": "d1640660-1bde-497b-b2a5-18288e4701b1", "comment": "Malware payload (Vjw0rm)", "value": "49fea89d7fc9f8be3afa2fd1b0ae9b6075c0acbf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829334, "uuid": "dd7d22e9-ca32-4098-8427-e4aaca89b708", "comment": "Malware payload (Vjw0rm)", "value": "90463e98852d5fa16fbae0774c748320142f64a862207c40371cccfb5a49d170f0461a7d6ec5cf309f6bee2b642eb5a9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829334, "uuid": "62061b75-b1cd-47de-8787-7f129762b1ea", "value": "T129521731B55E7C95E6708B8A4F31C817E70E61565D78A807CCA23C0A0D732CE2EAD15F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829334, "uuid": "09d1afac-f6a1-4c8d-9416-1862669a69cd", "value": "48:+OmYGJ08nH0Jn607W+CI0nJs56UbMH0a8y7j02J1mYGJ08nH0Jn607W+CI0nJu5O:B2aQxA4AeizBSF9MHlsTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629829334, "uuid": "2fa9725d-2eec-4aae-8717-28e1c41f9b53", "value": 13967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629829334, "uuid": "b618b3d6-ab7b-4449-b8c3-32220d6ab749", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829334, "uuid": "72acbdff-bfa6-4beb-a981-f94dfaf2686d", "value": "NS882992019101.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f715b0-04b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629792686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792686, "uuid": "90c6d1bc-c4ef-428e-ba28-b1e6736ffde4", "comment": "Malware payload (Mirai)", "value": "f1294180aa29022fd5401fb7c19879cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792686, "uuid": "a29a1918-1422-4e92-b174-71832da75486", "comment": "Malware payload (Mirai)", "value": "b548f6138cec3565cb3353364e3b1a7a604247fe7f648768d956e8c4a2267913", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792686, "uuid": "1bad517a-7015-45a2-b695-10020be132ab", "comment": "Malware payload (Mirai)", "value": "b0b8f5861da8ead06c16d6b283febe4eb931de7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792686, "uuid": "b79ae9f3-1a1f-48da-947c-97cc780f2ad8", "comment": "Malware payload (Mirai)", "value": "443a9dee72457d6dda8231cfefed86c8689b9814f58bb76c3390d78110baa092c28090a3cde63449f4965355b4b0e52f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792686, "uuid": "54c1431c-e374-4c40-8e81-a88fbe0fce11", "value": "T166E31930D4504B17C2D213FAA69E825E3F221FA793D733115B38BAB41FE279E1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792686, "uuid": "b15b4319-c338-463b-b898-5cc0ee86fbed", "value": "3072:Z41HOuaGVV3NfHUOjqylCqCw3jkmhxQwoVZUNu:Ze3aGVVdqylCq1jkmhxQwoVZUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792686, "uuid": "051a77d3-d212-4f69-ac1c-bc387473a1a4", "value": 143044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792686, "uuid": "e54a8d1f-5c6b-469a-bb3f-6f33c04056f2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792686, "uuid": "fbc97dfa-02f8-4a9d-9604-5ec33a8092e3", "value": "f1294180aa29022fd5401fb7c19879cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e508f0-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629805578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805578, "uuid": "ffcf6189-4355-4ce1-bc44-197ca8fae434", "comment": "Malware payload (SnakeKeylogger)", "value": "4a9a30cb0128072a622eae28bb09f9eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805578, "uuid": "90b9c5ff-d579-4e45-b217-a417d890c678", "comment": "Malware payload (SnakeKeylogger)", "value": "b598e5ed39809731f46b6de47c3c1a9dbf531137dfbdcb79e580698b7211b1a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805578, "uuid": "d9693d8f-962b-4265-84d2-be70498b3ed9", "comment": "Malware payload (SnakeKeylogger)", "value": "b4493e2685172bdda3ae104c719dbd77047f6b0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805578, "uuid": "4a0ad2a2-610d-4f3f-8228-cb979b460f31", "comment": "Malware payload (SnakeKeylogger)", "value": "ded6ef57306f42df4e939f16aef4466e25594d0a349c3dbfe20057bd2e47525f27101546e254558c79e020cda116ab28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805578, "uuid": "e8e65c56-8d57-4fe0-8f64-80f376d30d19", "value": "T155057B7063C9C284EC1A8FF0167CF79402F275E7B6C4CD6A1ADA724CCE5A9D12A1764B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805578, "uuid": "7d821b65-fdde-472b-8da7-450633996387", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805578, "uuid": "e9f2113e-913e-4f2e-937f-a9de9dfd5d1f", "value": "12288:ZNcsGI/cC46R6I5Y5aeuYvySoeu4GkgDCsDF57432EObbX:Zu6Rneu4/gDCsLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805578, "uuid": "7dbbe402-7fc3-4256-84ab-219414a1d779", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805578, "uuid": "355bbf9b-9749-41d3-b76e-09c446e59609", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805578, "uuid": "5d22bdad-9945-466a-96d8-eff6edf38243", "value": "4a9a30cb0128072a622eae28bb09f9eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a7c14a-04ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629817922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817922, "uuid": "9ebb5ecb-83dc-479a-89fe-9e1fb8905a51", "comment": "Malware payload (RaccoonStealer)", "value": "b641183407dfacaacd0f530fb5543a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817922, "uuid": "50872d94-0335-445c-82c0-a33a8711fd26", "comment": "Malware payload (RaccoonStealer)", "value": "b6b51b1ee6abf96a7bffd543c7736e5f3920d2cc299eef1a5f6c812d2af0fc07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817922, "uuid": "c6593039-0e90-4ae7-8c60-232c3ec07832", "comment": "Malware payload (RaccoonStealer)", "value": "adadf127465988c954c4417eef8fee19f915a834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629817922, "uuid": "085d2b7d-d5c0-473f-9283-feab8ffbd603", "comment": "Malware payload (RaccoonStealer)", "value": "09cb6dddd2625bc766d0b53907b909bf695c40910cd739a89de537458ca0e607bfbeb52ca847a86562bc412b83ee9621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817922, "uuid": "df48e483-5d6b-44a2-b356-1246c3779f6a", "value": "T1C5A402117670C977C19952B2C8E2CB90E92B7AD16E61910337E9EE9F3AF06D0721F352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817922, "uuid": "5dfc9e59-7ead-470f-9e69-10b2cd18b9c1", "value": "bcd64e2657251d69bf082a6790bd215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817922, "uuid": "21843cfc-388f-4ccb-a532-c841026009f8", "value": "6144:ypGwhdHewLtKpjO2pqvtyy4ufPcKF6VcZkRnySmJW7AK6P0MFFLPiXOwS18bEcxb:y1/ewLI6z4KsVcwySm4sK68MFtn4EcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629817922, "uuid": "4a502b51-d25a-4065-b171-a89ce7517b02", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629817922, "uuid": "934bbd6d-3e8f-49c3-9e54-4ccb4faca466", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629817922, "uuid": "8cb6b5cb-7929-4425-b74b-3b7c482061e3", "value": "b641183407dfacaacd0f530fb5543a7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d8447f-04ab-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629789396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789396, "uuid": "976561c2-8734-452a-8c18-464bf562d75e", "comment": "Malware payload (CryptBot)", "value": "bd7e707e1d6f43a0c0092e903405ba51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789396, "uuid": "f52e92d5-2cf2-4ede-a1cd-cf4bd54d45eb", "comment": "Malware payload (CryptBot)", "value": "b811ee0b920a723d99831ea6b3bab492189a69797d47a809cb0be4248f7eec08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789396, "uuid": "f51c8680-62c4-46aa-b81a-e911619e96f7", "comment": "Malware payload (CryptBot)", "value": "af4396ac122a58ba891938218d025ab0792dbe34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789396, "uuid": "1a0c5afe-5154-451e-be23-4e8e004463a5", "comment": "Malware payload (CryptBot)", "value": "73bd25abf84ab4c64d8fa808f444f2eb8b1dfc85c414513348b3d2f9b4195e8fb6948ec18d0dd87f680b03af3e218fb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789396, "uuid": "5be59522-b4ef-48dd-93ff-44fd25c18d37", "value": "T102B412197AD1C7B3D045023486D9CAF0E66DFDA189A2654723EC116EAE713B07F233B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789396, "uuid": "c0eb6443-94e5-4ec9-a9d6-5e25bf768cc6", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789396, "uuid": "07bb2335-be13-4e1a-86b8-76a3eb2c3047", "value": "12288:rHBCdfzmP0X81ADPPhzztcxOC4uNgRpkL:r8dfBMKPPh2F4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629789396, "uuid": "396b16df-3f28-4c60-a70c-876eb930bb00", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629789396, "uuid": "9c479dde-d044-4dd3-801c-a93542d72b36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789396, "uuid": "01cd4ae9-bd45-44c7-8ecf-e75a51f12bd3", "value": "bd7e707e1d6f43a0c0092e903405ba51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc906d8-048f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629777648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777648, "uuid": "81653e4b-6695-4cee-afc7-3d35f810e0f9", "comment": "Malware payload (RaccoonStealer)", "value": "3ecaccfe63a52acac6641155fdcfe147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777648, "uuid": "7474848b-a66f-4f20-982f-c6d0c0a68f13", "comment": "Malware payload (RaccoonStealer)", "value": "b81f37d3309cc2244ee7842486f69e408cc82048199beae43339d1c0ec956a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777648, "uuid": "3ad4497c-c133-40d1-8849-6415933f3067", "comment": "Malware payload (RaccoonStealer)", "value": "b619f26c501384aad013cb03ffb47a55438f5bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629777648, "uuid": "1432c2f4-a87c-4a81-a059-7b7122d9a1af", "comment": "Malware payload (RaccoonStealer)", "value": "d91ff5b839cb4f21841f3741cef0425fc4e6891398e478081916763cb4055425710a66fa2b815b2b709e0bcd21738ad6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777648, "uuid": "7b27f9dc-5107-41eb-a53e-f49361564181", "value": "T18D940225F950F032C1910D715CE6C7D0EDAABD809E70D24F37DC1B5A1EAE2A1B92A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777648, "uuid": "eac61ff8-f793-45f9-8951-ccd17e76f5f1", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777648, "uuid": "b828d214-b22e-4b0f-a17a-ac756bd9175a", "value": "6144:3DJWjq+rBs9kkZtorhhAGBvib7EFoh+79a2GNgvjY2VG6yNprFC:39WjVa9ttorhhAWvi+oh+799k2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629777648, "uuid": "4f829674-ddc4-44a3-9b9e-b4259ada82fd", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629777648, "uuid": "a47492ee-62c9-4a2b-b0dc-773e0e110b2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629777648, "uuid": "d834eb25-c67c-4a80-8da2-b8f890cb634a", "value": "3ecaccfe63a52acac6641155fdcfe147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eac164d-051c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629838075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838075, "uuid": "23e9d3e3-7bc9-4e47-9b21-65b4f83cc8e2", "comment": "Malware payload", "value": "fea06025ab5431d0f70b1e1f15e963bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838075, "uuid": "bf05d2db-7955-46c8-8bc6-905e2e308c54", "comment": "Malware payload", "value": "b8743283611f70dcba115b0f6a35ffaecb6724aab2cad3e244c120c878425a4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838075, "uuid": "80d36f47-68a5-49e6-939a-894d6830e97c", "comment": "Malware payload", "value": "977f1a70f83492c323bb26cc19861f9206087e60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838075, "uuid": "4ab61af6-b70a-42b0-8a9d-34b1a317c8e7", "comment": "Malware payload", "value": "b71afe0122c7c64562a498895e51c0b53e50a41349bba6f61823b12bdf9a9bc303421d1375b4a475369d3841e0705bc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838075, "uuid": "6061ac93-b636-4131-b3b3-0c6bda6f7833", "value": "T10373B517BB519EB7DC5FCE7306EA460120CEE45A12A46F1BB274D92CB74B94E08E3D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838075, "uuid": "07b3b088-eab1-4fce-9dfa-13fcc61835c5", "value": "768:eeT20oSeR43MDeeAeJoOgWwX8eZ4ZfGPXidkSeweeD375bAAIHhoACDZuVkS6j:eeTISx3knAeyXuZfGWkSNVDdMAFA3D6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629838075, "uuid": "8b05cd33-8273-4a43-9fd4-327ace36a274", "value": 79930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629838075, "uuid": "134c8fd2-27a8-406c-b697-950c2c42eec2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838075, "uuid": "2df716d7-c90f-474b-b79d-e97bc4c764b3", "value": "fea06025ab5431d0f70b1e1f15e963bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14871fc0-0502-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629826703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826703, "uuid": "dab736c4-550a-431b-b86c-634b9a83afc9", "comment": "Malware payload (AgentTesla)", "value": "20496ffee56ed8dfb758c27c675af5c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826703, "uuid": "5ff83d47-f3b8-41c5-9523-f71de3c0aadb", "comment": "Malware payload (AgentTesla)", "value": "b8c22189bd0dbb85f078d3d58774f7a1f7e28d0c304cb3f36de7328b4b4fc442", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826703, "uuid": "15d7fdea-3eb0-40a7-8ce2-537139b3bddd", "comment": "Malware payload (AgentTesla)", "value": "6bba96032c6e2ac546a0a16dbbb265e9639c8e1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826703, "uuid": "57aab996-641f-43e5-8bca-5f841f6fefd8", "comment": "Malware payload (AgentTesla)", "value": "96231a554bbf73c7d7926760b707ddfa1db1aacdfcafc059caee880f3f046d43101142ee4a1e264531c09d79628fcf9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826703, "uuid": "418feebb-5a06-4a75-93a1-628f226ee856", "value": "T1A205A37E1ABDA2278165C2B5EBE75417F0409B5F3411AC257AC303664232A7BB4F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826703, "uuid": "afd25267-5f43-44ed-9e37-3f1cbf1e7ce6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826703, "uuid": "53eb5339-f7ad-42a4-b3c9-62fd6981a8b3", "value": "24576:yWRlcbJM9yYcGUs86jd3/LZHNCWGegvm:Zlcbq9/Uo5PLeWGb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826703, "uuid": "a73f8469-a048-48e5-9f14-962ac4c61733", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826703, "uuid": "a70e22dc-e469-46e4-977a-fecb318d2270", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826703, "uuid": "43f51709-5be1-4186-a9f1-18481399c679", "value": "invoice009202109374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b0fc1f-0501-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629826458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826458, "uuid": "b17f61cc-cef0-44ac-ba1b-0cebf2a0c0d2", "comment": "Malware payload", "value": "d236b1db60c9673b9bbfbc75321c7a10", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826458, "uuid": "64a2ce73-7e80-4fe1-bfb0-f6cde7a6594d", "comment": "Malware payload", "value": "b9384216a5aea20cd398e51c6549bb84d6b252f3fde114010e3cc0c60b1e2b13", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826458, "uuid": "3f07ce57-8f22-4ed4-8953-c8af84b736c6", "comment": "Malware payload", "value": "3a9b14b7a7d8abba8bc7a3679919fbc94d674a6c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826458, "uuid": "228a549c-b3de-4f3c-ba21-aed68a3def43", "comment": "Malware payload", "value": "ff827428a6e8929188863e177029309566460523550e052a0f658920a2caa5b36fc020eace8ea487ae279b2e43c1c1ec", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826458, "uuid": "d3a01b62-b3f2-40e4-b079-3281ce66481d", "value": "T173159E52E240053ED5AB5BB45D9B27B56C3BFD102D25F8826BF81C0CBE383507E276A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826458, "uuid": "9e7325d7-40e9-4996-8354-78258758c136", "value": "721dec374946056d4c697696b353d31d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826458, "uuid": "51367fd6-1cb0-453d-a259-5b71ee3b69d4", "value": "12288:y7woC/+FoQb/uiQrS0djzLf+P2P4uWMtjT0GIBSDfYlxMC:y7lC1Y/HQO0dni+AnTQDfYlxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826458, "uuid": "1db86a34-daf3-4b8b-8196-36590a68f3c7", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826458, "uuid": "b6f82975-6e7a-4851-a6a7-d96a6df46633", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826458, "uuid": "6fc90f86-3e42-4a83-a533-3b75e72199dd", "value": "DHL waybill forms_ 6263677632_993837366_8383736632562_944847493933623553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d025ca6c-04d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629809408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809408, "uuid": "3c85f145-1945-4181-8c3a-7f1a65c634de", "comment": "Malware payload (Mirai)", "value": "fd71fa36336c82930b5545f24841d927", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809408, "uuid": "21287549-43ff-4d0b-91f6-cd765e8ca643", "comment": "Malware payload (Mirai)", "value": "b946257e4551bf3c7f0d86fcc7ae7f5fc0419e28bbd1ae9a00a7fcc9059056ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809408, "uuid": "89a9cf4c-38b4-43e7-91c6-1aea6c99ca0d", "comment": "Malware payload (Mirai)", "value": "5718c4812707a6efd29f2ae94da5d3cb4bdd58a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809408, "uuid": "34c9d56c-dd6e-4d49-9c11-19f6ad4bd8b7", "comment": "Malware payload (Mirai)", "value": "2c52f5e53dbb4124f6c14f38a9101881a1e50b6dd1047846ae850f49e9bc3abde3ae441c27b77c1f0a1e40abb22a0073", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809408, "uuid": "4c05dc14-0806-42f0-9279-e9ff713cd0ad", "value": "T1666318817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809408, "uuid": "6d4f0ce8-d30f-4b19-bc8f-c89949db7247", "value": "1536:OXtWxU5L9zoucRhv96NUQ3XtsavOBn98iXxuJeZWDN7UAUM:OXtWxUwz8IxKw2NPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629809408, "uuid": "6d476c34-3248-4073-ac57-a1a15e33281e", "value": 71860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629809408, "uuid": "75a78b41-4238-4473-a492-d919822d0fd7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809408, "uuid": "a22abcf4-a1aa-47f5-9fd1-9f8d20ae866e", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49205eb2-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629804887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804887, "uuid": "430721f9-520f-4226-b6b3-7ab35bcb184c", "comment": "Malware payload (AgentTesla)", "value": "6b4266756894b8e6cd719c373987e39e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804887, "uuid": "9e1b32c7-66d2-4ab6-90cf-8f037248d29d", "comment": "Malware payload (AgentTesla)", "value": "b94b9e39295a228e954c5ab817ecc6f1ecc1e7b7f3caf7aba455106c86837c33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804887, "uuid": "ebd69c5c-661e-4268-bb97-94f434a636c2", "comment": "Malware payload (AgentTesla)", "value": "23f3de2d85f02ab9ddaed7c19df3498ca5b65a19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804887, "uuid": "2d139338-a4dd-4c37-8acf-84049473c5fe", "comment": "Malware payload (AgentTesla)", "value": "9dce0eb793af8514807ccf7fa11cabced9cf046c4084dae29fecb875c31111a792afebf82b9e3c005dbcc53a64a9f39c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804887, "uuid": "ac201a23-8a44-45c3-ad7a-587017ab42bf", "value": "T1AEA5AFB875047DE62A6F576BCA96ACDD03B52B239ACBA4CD40647BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804887, "uuid": "22ab7746-1a14-4938-95c5-8f306b57fc28", "value": "24576:HtH7pTp4IHrpVhSYdcIMloWPUGNNfEkhWWnsN55E5cw1RRB9NvgoMMDrAji/dtRL:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804887, "uuid": "052c8622-84da-4b9b-beb9-2aaeea72ab0c", "value": 2194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804887, "uuid": "5f34d11d-4889-4a48-8992-bad9615d6a1c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804887, "uuid": "45fe231e-b9c6-48fb-b1f1-f7a4de01af70", "value": "Gassol Solutions Pvt Ltd.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0e61f0-04dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Banload)", "timestamp": 1629810878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810878, "uuid": "f5583fb5-fd15-41db-9ac9-b58d6b94771f", "comment": "Malware payload (Banload)", "value": "14169edff3fabcfb539f726ad3cda55a", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810878, "uuid": "157307db-eb66-4538-9f35-424b9ef594c2", "comment": "Malware payload (Banload)", "value": "b9f91a108d61f586d76de0da7314c50074b2574bc6bceda176d2bf3b33d905d8", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810878, "uuid": "6753e212-59f5-48e0-bf45-7ca556952930", "comment": "Malware payload (Banload)", "value": "e750d28b6f01bdd0259bc6e63265c52f428d96f8", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810878, "uuid": "41000ca4-12fd-49a2-8447-b43ca6bf70d7", "comment": "Malware payload (Banload)", "value": "5efc8a42626397e6f5987924e46b0b67b8e94f7229660b1dfde6a8c0534df659e4382955b900a09d91d76487a2b684b8", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629810878, "uuid": "44b1f500-a7a8-4d51-bd93-d781dd09bf4b", "value": "T1C9446B513BC9C13AD2AE063785BA9B66263A7D750B30D0CF77947D6C5E306D2A939302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629810878, "uuid": "d227821e-9ae1-429b-923e-e3d977c0a61b", "value": "3072:1dspAtOImXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8+i0:1ftOIiRQYpgjpjew5LLyGx1qo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629810878, "uuid": "62cb24ff-ee51-4bd8-958c-2472fafe3f8f", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629810878, "uuid": "a717fc5d-478c-4a9a-b897-391b36abb32b", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629810878, "uuid": "aff07151-378f-4a70-ba80-61a61dc44ab9", "value": "banload.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79d0cfa-0501-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629826547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826547, "uuid": "fe39b812-1c83-4fe4-a516-033b12864640", "comment": "Malware payload", "value": "223285beeace1bb1bcc37794539cbbb6", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826547, "uuid": "557f29ac-e933-47db-9249-3b7bc6c31927", "comment": "Malware payload", "value": "ba5a4f1c0c776fe8d9cf8a8f82d66536d46da0f6b624baa395c1896fef2d49bf", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826547, "uuid": "4a78eb36-5d12-4821-8d4f-7a4769706018", "comment": "Malware payload", "value": "afc352e31765c1e0d150f3d3509ba671545207df", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826547, "uuid": "2d1e7b0a-d46d-4966-8277-57ec6232b446", "comment": "Malware payload", "value": "8fd532541f0b5eac0428e43a040a023b42ad46152481b33a2e7e6572d6f9a46380a019e97398454a199df13fcf700f67", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826547, "uuid": "98c319e8-b4d1-4df9-96a9-86a2463919ac", "value": "T14255122938C5196EDF6F2A386DE1C7BD84B35D6AB9A4C20123067E069D350B8CF35F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826547, "uuid": "f9768741-c1a7-4cab-9aa6-c31354baa0e6", "value": "24576:e/RnpurvdjN3VgV5rP0wK5AlJUmYr2FbnlPV4CPGfLxbIBTzSFDJpDz:k4553yPrPrK56JZm2Rj4PjxbIYFDbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826547, "uuid": "80282adb-58e8-42a6-b1a1-e48b5bbbebf7", "value": 1318792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826547, "uuid": "f151fe3e-a2e0-427a-88a2-0b2241bf877d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826547, "uuid": "fb88d482-f61f-486b-801e-409773f18be8", "value": "Remittance_Advice_Transfer_Details_Intl-payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0824401-052a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629844252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844252, "uuid": "1216bd8d-729a-421b-96dd-176d6b100cdb", "comment": "Malware payload", "value": "e1d7bbe07d5b7a986a62a1443cdf44ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844252, "uuid": "7443fbdb-fbe6-415f-a003-54eb2c9802c5", "comment": "Malware payload", "value": "bb4fab33bce3edba3b0897136587b2fd925e076c9f0c4b2973be88b2c81b634d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844252, "uuid": "95b7ef14-f2f1-4e46-81c8-a7d51a58bb09", "comment": "Malware payload", "value": "640f62eab8d8a4087269b4477055165f3edc21ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844252, "uuid": "774f0314-f33e-4a70-8fa5-859b914eb7a8", "comment": "Malware payload", "value": "a22ad09a69c0073035ea4202f12beefcb3202f2c7a4234fbde748941b573d5d0862512aec77f0eb622fa420726bbf00a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844252, "uuid": "737fe9a3-bc2c-4431-b57f-94ec026e14c4", "value": "T19A933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844252, "uuid": "964af563-8dc4-4a22-b627-e408c1a1e0b9", "value": "1536:9QK1n/zXzxuPz5tq57MBtcaKECp/dC1k+8qMLumXxVqDrstKfz9e:99bzI9dtcaT0cMLumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629844252, "uuid": "31de8ae5-0d88-44b1-a2c5-c8c4fc687615", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629844252, "uuid": "a82345df-6002-41bf-bc71-479c7894d368", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844252, "uuid": "2311e783-00de-4686-8fd5-57cf2890c2cf", "value": "e1d7bbe07d5b7a986a62a1443cdf44ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c623ad0f-04c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629799513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799513, "uuid": "3fde5d69-9b84-4288-85bd-17e265838f4f", "comment": "Malware payload", "value": "f8ccff73406a3b6acad964a6376b2ae9", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799513, "uuid": "6b2887ca-7e6c-4b8d-b952-322da083f0cf", "comment": "Malware payload", "value": "bbb84b90e0a90e614b2a46542b576f213caf4d4f32f34eddfffe7d5be1e3a3ba", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799513, "uuid": "232ab88a-8d7b-48c7-936d-4458b9380923", "comment": "Malware payload", "value": "fbabadf32b4dabadf18f0d959bc40f112af5549b", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799513, "uuid": "ab784a9b-9ec7-4ae8-9166-584bf78bc2cc", "comment": "Malware payload", "value": "6cf05b48119d99b96e0e3e8b332bfa1d22c0e1c33bc22e7707b5a517c4d9c65c687c0ab8a70fd839c49ab2ab101b68a7", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799513, "uuid": "7cbc396f-53e9-4e1b-9983-d4a21b9db2e4", "value": "T14384231B72138CE6DBA832DE85827FE9057F5246A59F4E3FA70289543E7130193A43AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799513, "uuid": "a670677b-b233-4372-a2d2-414e8ce6362a", "value": "6144:F4PhIJ0YQ4p/bSdbMFP0wkUmtPAGDnWAOqmJHRwOMFNmvUEqre3R+IdmK7ipbplR:F4JG0Y7zwMawkUmtY2pmlRnMFNm8E5+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799513, "uuid": "9dac398a-16b7-43a6-8679-bdf842c32088", "value": 382320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799513, "uuid": "9a002ad7-ab1a-4445-a8ab-d74fa2257476", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799513, "uuid": "a39ed234-e043-4110-96a6-24c132cfec12", "value": "2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec309c66-04e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629813750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813750, "uuid": "80ece8f3-0ce4-4ccf-9b7a-01fe13f0ac3a", "comment": "Malware payload (RaccoonStealer)", "value": "b86cf8bca3df1df7e9c9288783cbac94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813750, "uuid": "bf548155-a950-463b-8191-52d4b440f882", "comment": "Malware payload (RaccoonStealer)", "value": "bc67d08fecc53f790347e8b4eb78d354c0a26d0c7820276c1eee632169e527e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813750, "uuid": "d911444a-548b-419d-aa09-dd7c72b1d645", "comment": "Malware payload (RaccoonStealer)", "value": "64c3dc6f7086e535df1ac45dbcc27528f8ca10a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813750, "uuid": "44111705-00a5-4f04-a891-2a0cd1ef25d3", "comment": "Malware payload (RaccoonStealer)", "value": "7dcd04c06cbe50dd32e2f292de9c1c9453ed25011f656d289c598202743687167da2aaec9308ec412e53508342e8f513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813750, "uuid": "ffc7aa3a-83fb-433c-b746-951b2335f8a1", "value": "T1CE9402937A70E433C01686B68CA5CB61FE6BB951D720914736F88FAF6F506C0B728395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813750, "uuid": "8d264f4a-f185-4ddf-90ba-5b3e6fd1633a", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813750, "uuid": "bed6bf2a-a4f3-4ace-9b6f-c56b36561aa7", "value": "6144:42X25mQ4KL0Nyo6rhXb7nidbXScP3c2kRXeSCVwtvee03ocMekQAYb:7X2oQ4KL0kVrhr4XScP38RXi6Ng3oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629813750, "uuid": "beeefa24-07f0-46ec-b275-178c33f2e76b", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629813750, "uuid": "fc06d907-8463-4311-a5c9-2930bc173bc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813750, "uuid": "e829e902-4abd-474e-858c-7ef2db29deac", "value": "b86cf8bca3df1df7e9c9288783cbac94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df88d8e9-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629805569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805569, "uuid": "28a71391-94f2-419e-a097-8707a700f5ff", "comment": "Malware payload (NanoCore)", "value": "f028625566975ceaaf63023f702690ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805569, "uuid": "d24c9684-3026-46f4-b10e-0234c2fbef08", "comment": "Malware payload (NanoCore)", "value": "bc7ce5f904c600b73f1765e5479662db545ffb2ca097055e638ae27253941245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805569, "uuid": "942261c6-3de5-48ed-8526-7a22b9db402f", "comment": "Malware payload (NanoCore)", "value": "d80e58b376cd2ba1c717ccc6d8c6da576938be07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805569, "uuid": "306c8084-cae8-4640-bcc6-a777b04cafd4", "comment": "Malware payload (NanoCore)", "value": "36a5edddafe8e8166bbdb5cb47901114f25300db55a337a953ab4d83497917d6a425b24cb324d3a637ec5644b8b62f3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805569, "uuid": "6a15edc5-384d-4d43-9b5f-90c38367dd87", "value": "T16E24120321198976D1A50E7144CD0A8E5EB32F55F3E58DDBCA22BEB0093CED82DF765A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805569, "uuid": "64437009-0ad6-42ac-900c-f1110219ae7b", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805569, "uuid": "a812ac96-6e58-4572-952e-53ff3c9ba09e", "value": "6144:b+BI3EaXhrl6+FzXza+7HSsvRC+6A2sVofdT6zD/cqRRYKaQ:r0a9FzXza+7HSH+6AKdYRMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805569, "uuid": "0db06e3e-8ceb-4b17-aaa5-e12d06230a48", "value": 221480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805569, "uuid": "ce055659-90a2-477f-b28f-b0a7ecd5a77d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805569, "uuid": "36900c6d-7266-4fc3-8847-2dbbd743e260", "value": "f028625566975ceaaf63023f702690ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6489b08-04ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629818841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818841, "uuid": "a7b36380-f168-4787-8dba-5be29a6d8029", "comment": "Malware payload (SnakeKeylogger)", "value": "0982d53dcb0d0320774143cc82389bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818841, "uuid": "1ec37c29-34ff-47b9-9256-bf36ac6d2880", "comment": "Malware payload (SnakeKeylogger)", "value": "bce4b929f18998a33f795bd5b6f54d95e24fa63d7a5880e2e0361728122f40aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818841, "uuid": "fc6384d4-a7d6-4216-a3f4-0e2298611ff2", "comment": "Malware payload (SnakeKeylogger)", "value": "35d75218ce6f7ddd1f4e693cbacb7d2f566a46b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818841, "uuid": "da262598-8207-492d-8b8f-9d480618c344", "comment": "Malware payload (SnakeKeylogger)", "value": "7d7244d5befe040e985344c1912df8fe01fe78cf6ba589dafcab103f2d7e373c637de77a7c7aea26a69278837671c8a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818841, "uuid": "0b93e939-a0a2-45f7-93e8-2f60176ead99", "value": "T1AD6437103B98AA6FF130D5775B57823682A209CBD1D5D744CC14D3BEBA30374AA8DA9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818841, "uuid": "9640bf93-2fb2-4fa4-8719-48c7873281b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818841, "uuid": "61d3dff5-cb58-45d6-8d7c-a3876a14731a", "value": "6144:c7IEjzHq1ocsOcmxJofVZeStkaJo+fq4JOn5YRhQ8Rk:crHq3cmvofVLm+fq4s5YZRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629818841, "uuid": "e9e08002-26b0-4152-917b-99a77d70ab22", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629818841, "uuid": "ab69b625-0e3c-473f-9f21-bcbf35adb691", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818841, "uuid": "be8ff660-03a9-472f-b416-f8e7db9a20bd", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95041c08-04dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629811027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811027, "uuid": "88d0294a-4d3b-415d-9f60-e5945fc85210", "comment": "Malware payload (Formbook)", "value": "acfd02c74a843ccc00e6db5ee67e9e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811027, "uuid": "8f198694-3c47-4667-b2ff-ea8b93728988", "comment": "Malware payload (Formbook)", "value": "bd015a47e8e376d7cfb70b5ebc81328a9c3a3cdc45d03635b107c106555d55a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811027, "uuid": "945599ff-f0b3-4312-9266-a81fbf643fff", "comment": "Malware payload (Formbook)", "value": "edca21a075e31a10a84227b7c417739244c3829c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811027, "uuid": "2e179789-aa22-4582-897e-f5199924b305", "comment": "Malware payload (Formbook)", "value": "9e76330018a62f25383be47106a1a7c9a94e74bd1a1671cf0fe256f913015136bc23c6f6a634d97940a8db92792e872e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811027, "uuid": "2f991753-0f78-4192-b3ce-0a50cb2eda99", "value": "T176159C702389C295EC0A8EF0166CFB9501F235E7B6C5CD7A16DA324CCE5E9D16B0768B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811027, "uuid": "db96435c-25db-41c2-8cc5-614979fdbbc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811027, "uuid": "af68aaf1-16af-4672-81cd-fa2e027f6f99", "value": "12288:Fg+yOQ0Zltlm4jCvHxKF2lLwQRpf9Vw76ll+FAJpNIaUs+u+0zn7GrCgqLV37yJW:CTE1mgCv3TweP+yJpVUs+unFLt7yK2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629811027, "uuid": "04f98cf0-332e-44e9-93d2-6a8191946241", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629811027, "uuid": "a83a372f-8bb5-44c8-bed1-b1ab08523fbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811027, "uuid": "7a1a61e0-387e-4ede-a5fb-6b9cd40209d2", "value": "Proforma invoiceShipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66665fe-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1629786655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786655, "uuid": "f32e4703-00ef-49a2-9482-2aeda5bce5b3", "comment": "Malware payload (KPOTStealer)", "value": "e3ee0e2846868546967e9b52f56f8593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786655, "uuid": "31a24f89-64d2-4bc7-8260-b5065143cb8e", "comment": "Malware payload (KPOTStealer)", "value": "bd6407bd4b93629025d0ba89fb1f0dd257c6d8f79b59138584fa8f6fd8d71d44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786655, "uuid": "65c1ddc9-0f11-4206-8c7f-8b690528ac34", "comment": "Malware payload (KPOTStealer)", "value": "1c1e7dc00f97db264f77775ec197f89777286abe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786655, "uuid": "c533c126-9d34-4e61-9413-9d2986345473", "comment": "Malware payload (KPOTStealer)", "value": "425830257267569b25acbfb7e9ac678a938e2268613e861a7eebdde76c4fe9b56c046c49a671519d7d93ba575223e45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786655, "uuid": "8b0f2344-d3bb-481a-8eac-abc0db963f49", "value": "T163A4CF30AB91C035E0F611F459B683B8B53A7AB16B3490CF63D51AED4A387E9AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786655, "uuid": "6f7ff65c-98a7-4983-94f1-ea9ca52b4303", "value": "ab6a8b01372d51e7fed6c22dcfc42852", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786655, "uuid": "b7ac4b8b-f805-49b1-8ec3-964e4331ee61", "value": "12288:UhOOGb4lqqAP6nORdtMQGmvMLgRdCCazRXqUijVmvY:xb4lQRkWS8dCC2QFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786655, "uuid": "1bd90cef-ca03-4f21-b25a-a8f7b967511a", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786655, "uuid": "8ec629ff-e46b-479c-be39-f2685855a916", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786655, "uuid": "3fce1779-60cc-4db7-b7c7-4e86b7899007", "value": "e3ee0e2846868546967e9b52f56f8593.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52d25dc-04d8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629809041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809041, "uuid": "e2bdc74d-f9a6-4909-af44-77a73ba65000", "comment": "Malware payload (AgentTesla)", "value": "823f77942b8243e4db6e33999aab3d94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809041, "uuid": "4c9cc933-5885-419d-ae85-5a230b773a0c", "comment": "Malware payload (AgentTesla)", "value": "be23d736ed46ea266b78bdfcbb8ec120b59214444857b444e312008b77db3af7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809041, "uuid": "10d58be6-9463-49eb-98c6-54d63162c0bb", "comment": "Malware payload (AgentTesla)", "value": "b7e893ec206d51bd9679ad666d8f723e7551b861", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629809041, "uuid": "29053d3b-b1ed-4c45-9225-9b3746b6e389", "comment": "Malware payload (AgentTesla)", "value": "50410e74b506a78c0636558cedfee31c78c10250bd5c3b739ab08effb5c328444413e445efe1ee8d1d32aad383704075", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809041, "uuid": "3512f684-2ab8-4568-bda4-ab5b81056e9c", "value": "T15D946A003B986A6BF130D5774B57863682B20ACBD5D5D784CC11D36EBA31335AE8DA8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809041, "uuid": "a721f421-c9e4-486a-8b9a-784a2775d899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809041, "uuid": "85bf7c2d-4714-40d4-92ec-b0afdd10e298", "value": "6144:rqozI05B6fPS9mwqB4sOZDOoogKqoVO24BXU/Gzx5d8Gmsq9VeexrIWJvs89LSHo:rfCqcwvOAreu6G9as2Dr3vsCuER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629809041, "uuid": "5cfb5335-bd51-445f-8447-9500e749db59", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629809041, "uuid": "4143cd4b-b7f5-4070-bd55-91d672f1964e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629809041, "uuid": "beb953e1-dc76-429c-9466-096b5cbfa0b7", "value": "Inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227da10d-051d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629838323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838323, "uuid": "b94d3402-9bea-4b95-9adc-3f291496ad99", "comment": "Malware payload", "value": "00a232c613ca3ddcc4555d227b146722", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838323, "uuid": "25bb6e4d-28b4-45f6-971d-41fb6158f3c9", "comment": "Malware payload", "value": "bee10b83f0692ad0dfdd0b64edc660512ce45a5580bf273e38a71c41d3c6f8e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838323, "uuid": "ba3579b8-8fee-4a49-8d09-7bced6d6c66d", "comment": "Malware payload", "value": "7f12abdbf8573546f5c799cfe74a2f1cc9110eda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838323, "uuid": "c9e5fd78-7368-47c6-b0ec-ea625f91d9c6", "comment": "Malware payload", "value": "4a3dc3ce2c619717d659000f583680b0b6cfd432327bb2c6ef625428d1822d980912b77946de70e48ad9ac483f028fe5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838323, "uuid": "c90970d1-da4d-4cce-93d6-c528fefca4c5", "value": "T1BB532A92F801DF7AF40FE77608D34725B230FE650A935662735B3DA6AA362C43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838323, "uuid": "761a8e14-7807-4171-8b60-b6dcb9152ac0", "value": "1536:bqjcNoDWJLmhrff8pdq7t2/nYHL/7dcrRn+vFOPeC:+jEJLmhrf0dK2PygRn+vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629838323, "uuid": "ff7df433-6271-4632-adf8-e4143ccd3682", "value": 64564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629838323, "uuid": "b9223978-ba9e-4c09-93cf-10d6f92eb540", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838323, "uuid": "baf6526d-c331-4813-987f-994352317c34", "value": "00a232c613ca3ddcc4555d227b146722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281ea26a-0517-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629835755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629835755, "uuid": "3eae71cc-6e45-40ff-a006-2368212ad34a", "comment": "Malware payload", "value": "52e1fed4c521294c5de95bba958909c1", "object_relation": "md5", "Tag": [ { "name": "#Encoder", "colour": "#FA5951", "exportable": true, "hide_tag": false }, { "name": "#LockFile", "colour": "#7CA51D", "exportable": true, "hide_tag": false }, { "name": "#Ransomware", "colour": "#E0C2FF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629835755, "uuid": "2e1d7f65-9b33-4a36-9221-e2724f9a07ce", "comment": "Malware payload", "value": "bf315c9c064b887ee3276e1342d43637d8c0e067260946db45942f39b970d7ce", "object_relation": "sha256", "Tag": [ { "name": "#Encoder", "colour": "#FA5951", "exportable": true, "hide_tag": false }, { "name": "#LockFile", "colour": "#7CA51D", "exportable": true, "hide_tag": false }, { "name": "#Ransomware", "colour": "#E0C2FF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629835755, "uuid": "cf96efab-de8e-4fa9-96ef-f91091d70547", "comment": "Malware payload", "value": "1d01528de63c9581be0ea5ebc18dff7f6a2272d4", "object_relation": "sha1", "Tag": [ { "name": "#Encoder", "colour": "#FA5951", "exportable": true, "hide_tag": false }, { "name": "#LockFile", "colour": "#7CA51D", "exportable": true, "hide_tag": false }, { "name": "#Ransomware", "colour": "#E0C2FF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629835755, "uuid": "e98959a7-4476-4c90-a3e4-9bc08b2d5868", "comment": "Malware payload", "value": "99e62307940a3fd2990e0bd27b0594e28a01089b843d09da3c8c4c385a515c43b7b3e2961c23ee084d08a006a780f61a", "object_relation": "sha3-384", "Tag": [ { "name": "#Encoder", "colour": "#FA5951", "exportable": true, "hide_tag": false }, { "name": "#LockFile", "colour": "#7CA51D", "exportable": true, "hide_tag": false }, { "name": "#Ransomware", "colour": "#E0C2FF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629835755, "uuid": "d607d354-c629-4ff7-8248-bea258b0e6ec", "value": "T1B144239176680B9BD4C4E138527B3622E5C2A92D620A04A077F3F1CD6C7F7EF583A52D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629835755, "uuid": "a52732dd-8215-41ed-86fb-fc6f30f68d47", "value": "07a0cdd4807510f9323ce2fd61059e50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629835755, "uuid": "090be1fb-ef0b-4754-88df-2756ce6ddf98", "value": "6144:NARrIk3qCl6TvSWg6ZZaYQ4dlGvgjWrgFnp3z3gj77vi7Cr:NARswU124dl3JFnp3rg3DA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629835755, "uuid": "8434d154-15f5-4802-95d2-a65b6eeffdcc", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629835755, "uuid": "b1ad1af6-6ffc-4961-99ab-f533eb784e86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629835755, "uuid": "53f3da2a-4a53-476e-9fdb-45e107c8057f", "value": "#LockFile #Ransomware.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc237f6c-04b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629792678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792678, "uuid": "98e76664-a28b-4e9b-bee6-bf83c6ffd80b", "comment": "Malware payload (Mirai)", "value": "9a266638e9b248a2236da8826bae9259", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792678, "uuid": "bdd35cc9-183a-422d-88af-9dbe3becb1e8", "comment": "Malware payload (Mirai)", "value": "bf44c486d52046d6047a2e660427edbe8913f8b152912df308cecc4339b1f095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792678, "uuid": "80a87dc4-2bdb-467f-8200-bb269ec1a98e", "comment": "Malware payload (Mirai)", "value": "b03b90420fac932e45264cf3168e1d41f3e9dc39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792678, "uuid": "8ccbb786-c963-4cdd-a15f-30760901770d", "comment": "Malware payload (Mirai)", "value": "b01b0d112b0e15676e529f05586127a591a9c4c2c7495746edeb33ee9755fc76d713108515e97edb65bc4b829311b30c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792678, "uuid": "2f9775ab-51ed-4969-a93f-dfb4a630c028", "value": "T139A30731A641C973D14305F211A7DB620D32FEBB1A6AAA96E36D3CB0DE360C1B561F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792678, "uuid": "30db5b45-8208-4f63-8f7c-20c0c91ca44b", "value": "3072:gjtwgA6UlYzZveohR9kIEkfdGZmmFVcqq0G27ZT:gjhzt3mIEkfAmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792678, "uuid": "c155725d-2b34-4764-8348-6c6a446b3135", "value": 100267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792678, "uuid": "8916d81f-fb6f-4df6-aa8b-11af18f61535", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792678, "uuid": "1bfe31c8-1ad7-446e-ba5b-09961315f360", "value": "9a266638e9b248a2236da8826bae9259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391ef370-04aa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629788969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788969, "uuid": "46e5feca-69cc-4bff-9857-1b5ffc96ff12", "comment": "Malware payload (SnakeKeylogger)", "value": "7a325eb5362fde69fa4f53a6186515b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788969, "uuid": "872172d5-4564-4a67-85b4-4532e46b547d", "comment": "Malware payload (SnakeKeylogger)", "value": "bf72fb3cccef8f9988501591ae9d15e547ef80191c3e5b8043ca223268b32502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788969, "uuid": "e56f66c3-16fa-4296-864f-084178a7fc38", "comment": "Malware payload (SnakeKeylogger)", "value": "ba098e5df96e94497dd61d5614abd39ffff009d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788969, "uuid": "9b72126e-99c9-4ccc-b5ae-cdfaff4418d9", "comment": "Malware payload (SnakeKeylogger)", "value": "f8dd2c23f4276054030f45cba3df1a48f660f64c35cea0a911afe0c34e221ba9af9bfa96734274040772242fd8e57a8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788969, "uuid": "95f531d4-18a5-44dc-80b5-185548c9db96", "value": "T187158C306389C284EC1E8EF0167CFB9502F235E7B6C5CD6A16DA724CCE5E9D12A0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788969, "uuid": "c6112fc3-a218-4442-9bac-fbc0c682770f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788969, "uuid": "03d64bbf-0a03-4c4b-8ac2-8b7bbd6225af", "value": "12288:qdcsGI/c250xQ8CZznsV0xwGsWSwyAHihv8X3jKAXMiqsdO+/2EObbR:q3KzCZ7KPGQAS8X3jRXM/dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629788969, "uuid": "7aa3a838-89c4-4b2d-a1b7-9373214f3603", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629788969, "uuid": "9e741634-0976-44d8-9454-90a1b8bff29c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788969, "uuid": "7b86997e-de0d-4907-adc9-a5f749b45251", "value": "2UZ8zLT94pJEufW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45028d40-04b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629794572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794572, "uuid": "3e2611cb-6b7f-4660-9a47-0bd3e9dae776", "comment": "Malware payload (GuLoader)", "value": "444ff5258081d51036df9223014eda6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794572, "uuid": "61e0e151-9a0c-4c13-be9b-08c2cc200911", "comment": "Malware payload (GuLoader)", "value": "bfa8fd6eca0f426b2a0d6e7aff0d1b38480077f1bf9a91ccd70d7df6f7709812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794572, "uuid": "abac0a25-48e3-43f2-8650-890c809f748f", "comment": "Malware payload (GuLoader)", "value": "bc10ee33512da6a31d63f2a49f7f337a09c1cac0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794572, "uuid": "7d693894-a732-4a13-8735-c276129c2be3", "comment": "Malware payload (GuLoader)", "value": "7e28bc29279260b47a23ea6dfc6496adfcb712d2441780398fcb962ff00797464b48ddc395e7d81bf6023f44d506de6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794572, "uuid": "9380baa1-ce37-4e55-8d56-4316619a684c", "value": "T1BEE30AA3E3D0D92AECE2DD7226A6814C4C54BD3C5957624B72E6421D06F7EE8E1F1323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794572, "uuid": "9c72230f-26c2-4269-bce6-66523a6c3c59", "value": "49b7e5612a1221a1be900bc99888bbeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794572, "uuid": "69da157e-5920-4723-82a0-2cdad12f9130", "value": "1536:k+DMFTNfRNU/GrKNqpP3aRp8uHBS9BeW+X2gmyvbXUch/qGmDtd:zofR2erKMpf/eBS9BeW+mgJzEcVqGmRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629794572, "uuid": "4ef76c57-82b1-45e0-82b4-0f5585dfc094", "value": 144408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629794572, "uuid": "b1db08ed-fc9a-462c-98f2-6a47be3ad9ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794572, "uuid": "f0a03e7c-99b8-424b-97d1-bebded520c12", "value": "PEDIDO 002065-0091 GRUPO INTASAL S.L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cbb69d-04c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629802301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802301, "uuid": "e0cc15fc-8e08-45fa-970e-52dc243165ea", "comment": "Malware payload", "value": "ff6ad7dc00ead4ba16f84f03f70c7f88", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802301, "uuid": "5386b5e6-bfb0-47c6-aee0-50d9c507dcd1", "comment": "Malware payload", "value": "bfdd719b5febc302aeba1f12ba164dfaaa163fc72eb9a495ff6194e7a8e8db0d", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802301, "uuid": "ddb38bef-a227-4762-990a-adb6ed222f4c", "comment": "Malware payload", "value": "31d86ec7cde0a64df4c857cc94b9a053329d7886", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802301, "uuid": "76918b3b-bb1a-4d10-b7d1-6676b6b3eece", "comment": "Malware payload", "value": "85050581b068108d7f062bf315cd36abdc474996187b1e5e0df64e1633127e9fedb6be12de808885e8a63d316df4ddab", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802301, "uuid": "e521698b-c601-411e-8f36-13ab3e48f589", "value": "T1D9F18EBE6A549C6FEB31463E72BB046FD01AB42C9524E74738D1B3AC13CC046A7453CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802301, "uuid": "0944fd29-234d-447e-8aec-60938c5e9e6c", "value": "192:xrXP/Qp9urU/PY8hZSpxceBbw5B8uSePbeABWEnrzTz:dXPqjA8w5W8urPRB5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629802301, "uuid": "54d19f56-229a-46a3-ac64-ce075c41a691", "value": 8182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629802301, "uuid": "1e2b5294-65ba-44cf-90d4-c430742329ee", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802301, "uuid": "d85eb360-4c45-4ef5-811f-e52354525da3", "value": "New PR# 10164717.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5159198e-046f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629763669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763669, "uuid": "1fca8186-e451-43ee-86f7-d31dcfddfe28", "comment": "Malware payload", "value": "fcc6150738789bad1cf3d6a6f41a6dcf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763669, "uuid": "53ac86c6-9c7e-44ef-8ac6-75632550908d", "comment": "Malware payload", "value": "c053b857492aa1d6a23adabf48253e5e8437a23e2d954bb2f9e80f10761ae53b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763669, "uuid": "4bcf8bb1-e6bd-45fa-8fab-0cb79797fcce", "comment": "Malware payload", "value": "2e17e5031ac41f55e3fd87beacd7fae559d97d0a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629763669, "uuid": "f78af398-aee0-4d8f-972c-af006f6eeb15", "comment": "Malware payload", "value": "a6991e81e13d2d944213284fb2a12e2600ed6c85ae9b87229a793c551194b1d3ec2e8820b41536567194cee6b2d0b65c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763669, "uuid": "9ac3def1-c4ad-458f-9ccc-f394737951f7", "value": "T168548D0573D78637D9DE07326F57CB629AB2FC3481A3811B4395BA0E2CF5149E263AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763669, "uuid": "0101fe03-06e3-467f-9ee6-4011a835b778", "value": "3072:V3ygYXkj7q0vTYDryO1nT5U6ij4qpXqnnDibAJBVkF9nY5AtT3DJL/Dnoja:V5i35Tqp4nwEOY5AtT3DJL7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629763669, "uuid": "6030595d-1e0d-4a1e-a219-5cfe67c11f46", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629763669, "uuid": "093eb707-f4c4-4f7b-8464-144e0c37f604", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629763669, "uuid": "8d9af225-8c68-4523-851e-654604273d94", "value": "inf.documento1748388.PZNZDLWKRDIPGBYZMKZCYOQPOFNFJX\u00ca.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43402946-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629805306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805306, "uuid": "2c3dbe65-0eb9-4903-b5d6-1735e4312494", "comment": "Malware payload (RedLineStealer)", "value": "4a82a53435f05ba0ce4c283a5cd89255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805306, "uuid": "6d7054b4-27f6-492a-9020-e15480c373fd", "comment": "Malware payload (RedLineStealer)", "value": "c0d46d8f2d6c5769d747681e56d06ff7943d25e0edf92f8422f5ee8f2a08cd46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805306, "uuid": "52024c19-0b97-4a07-b46e-f6f1f4590f67", "comment": "Malware payload (RedLineStealer)", "value": "38be02c631a257bc4e7a72ef72fc5e954af71fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805306, "uuid": "2e00715c-6390-4ed3-80a9-1df821e4e83f", "comment": "Malware payload (RedLineStealer)", "value": "5b2114cc14da55d82937c7c9b3b1850445f186e73574f84fd8ebb75ced52d10551fcb6feacce0361527a22ae88481ce6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805306, "uuid": "82cbb47f-c19a-4d8f-8909-9d2e6e81e2d3", "value": "T104C412123970D173C99A583008E6DB50E32A78516DF1881B77D84EAF9EA52F0BB3D17A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805306, "uuid": "00585520-bc95-481a-a2a4-5fabe22bc39d", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805306, "uuid": "17c2e35d-fc8c-43fb-ac38-e38612661c49", "value": "12288:jTIz8uxZimZLqL8TEPVEjg3A3O9/e3hptpGdp9VJiNrHw:jEljTer/mRTgNV8Nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805306, "uuid": "a6ee3942-b116-4b98-b044-8c44d2fb4c67", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805306, "uuid": "dce1af78-b7ef-47cc-baac-50f3aefe2529", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805306, "uuid": "2eea00e9-f629-4367-9aa3-3e429a196803", "value": "4a82a53435f05ba0ce4c283a5cd89255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a351f675-0527-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629842834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842834, "uuid": "b8fd5881-7fa8-4352-b12f-48e255f85e0d", "comment": "Malware payload", "value": "d34321e72334ff78a4354676e5ebf36f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842834, "uuid": "d0647dfb-c968-4f4d-8818-366896297c97", "comment": "Malware payload", "value": "c1940ead70160b4c8b3fab9dad2a1ede9921076a20030f078d68007238f93f8e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842834, "uuid": "a5bde09b-7c39-4a55-bc5f-afb5015050e4", "comment": "Malware payload", "value": "0c8ff633dcff1f1d7f62934bce77060ed5c4b709", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629842834, "uuid": "9c5218ae-1d5f-4c06-a8de-3c2df97b54e1", "comment": "Malware payload", "value": "153c2587d8ef373fd24b0ad926fe4d5f50b22b73086b8ce0792fa75609f93722ec60dc4ab46f2622d22d00eacfbc3594", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842834, "uuid": "0b9f3ffe-ea95-4ba2-8668-7278836987f6", "value": "T1FD6275083285D616E2625E321ED6EAE737B6BC11BF56433B3284731F2D3BB658D16340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842834, "uuid": "2191f9b5-eda2-4d80-868f-087c182f3585", "value": "192:X2t9XoFf4K/PB7qRvrFk9uv/pWyhsB2uv/heccUm:XYkf1/PB+vrFk9unpHr0hec3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629842834, "uuid": "5e44d03f-38aa-46c2-84e1-0ab7cbec1822", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629842834, "uuid": "5a6cbda5-caba-447f-9aeb-4a485ebbee1a", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629842834, "uuid": "d8b191c0-41e4-4271-aab7-363ba301168f", "value": "SecuriteInfo.com.P98M.Downloader.12.15815.3480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320fb591-04b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629792393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792393, "uuid": "af71c29d-b671-4a6f-8334-0c95dbac88ad", "comment": "Malware payload (Mirai)", "value": "f5af065bffb2b29a259058e9133a785d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792393, "uuid": "b3ec5255-cccb-4333-8458-f9f3567f5761", "comment": "Malware payload (Mirai)", "value": "c237f1d5cb498ca8a5a4b3f3c52fa66c4c5cd71790f1fe82728c6ef1d51207ee", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792393, "uuid": "e74b87e6-81a1-43cb-a0f9-a37057499727", "comment": "Malware payload (Mirai)", "value": "1ace76c28b6e4cb564433485e27c97302b5d5d61", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792393, "uuid": "9d23e3b3-0a0b-44db-aec9-3d48d8f8bcd9", "comment": "Malware payload (Mirai)", "value": "9e3faab6c56362396f90613e3263f295e0e9c444e610e4aeefe88160938e1cb4cd755235d653a671be5fd5fcb3f748af", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792393, "uuid": "2d998ce7-54f0-4dae-88aa-0e137634e03f", "value": "T1F0B339376251C97AC08342F526EBD5729C13BDBF0732229A33947D60AF368DA1E99F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792393, "uuid": "503e62de-73a5-4f6f-8fca-48dbc63dacc9", "value": "3072:uirMUYZMo/QJLRZDsqtxqLX5I/uJioue2yd1m7FnVqfJXoebNb:SKo/O8qtUbKQbm7FnVqfJXoebNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792393, "uuid": "7a23db2e-a592-4db5-8279-3160adfc3f18", "value": 116760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792393, "uuid": "fbfd01ae-efe2-46a8-a600-2fef16dc3e90", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792393, "uuid": "478a627a-5e37-42e7-8699-23f6dac04143", "value": "f5af065bffb2b29a259058e9133a785d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42c3fac-04aa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629789229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789229, "uuid": "e37ca4a4-593a-462e-8eb5-8333fc192690", "comment": "Malware payload (Formbook)", "value": "1d2dbd02a4482c9a82a3df5f2aee0ff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789229, "uuid": "574c2a23-22a4-4c7d-a685-f53eff9b5c46", "comment": "Malware payload (Formbook)", "value": "c2bde78efbaeb33b33e000a332b10191adf6c2b1e5d30d8cb3a9042419e97922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789229, "uuid": "f7449dc4-dcd3-4f26-bf5f-de9c0204b012", "comment": "Malware payload (Formbook)", "value": "a7ded6e68dea6241c71fb0f5afc79dc94babb275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629789229, "uuid": "abfc2580-f3b4-411e-943e-d11ed336488b", "comment": "Malware payload (Formbook)", "value": "8803dd25e0e702aa37c0542e7ce777e35511b8b97d95240386e0c1d536ca90c72330af869704bae76c5655d6942db954", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789229, "uuid": "7042e66f-2337-4bc8-b895-6ce8af85f0b3", "value": "T1C4340201E75DAE13D394D13D8516B0FDA2F40E7292FF5CB3A366311D69BB2D82122E1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789229, "uuid": "b2429e32-623f-46b4-8fd7-3657a532a105", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789229, "uuid": "d37e04cb-a7a1-4ff9-acb4-221220dcdc29", "value": "6144:MelXmIQEXdAqsM/lqq+i/fFPvfS3Hd0NX:MekE6i3FHfSXdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629789229, "uuid": "584f9b46-9c88-41ef-8217-20fa93e77fb2", "value": 232728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629789229, "uuid": "53e2619e-98d8-479f-bfb9-a2da276344b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629789229, "uuid": "8c7f5282-7023-432d-a62a-96d053b52a8b", "value": "rockk231009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5390241-04c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629802491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802491, "uuid": "bd70a0d1-66f8-456c-993f-53f4905ce243", "comment": "Malware payload", "value": "4fe6a78b3acc6e4f636891bc5e4bd982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mymacro", "colour": "#45B0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802491, "uuid": "68820c98-f742-4079-96b1-d900bf95dcaa", "comment": "Malware payload", "value": "c2c66ec47fc9c969de74cbb8ae050243e5c51e8033811cb04bd3b975d0037d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mymacro", "colour": "#45B0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802491, "uuid": "58fbd092-fa4a-42d5-9e32-b6058ad78d95", "comment": "Malware payload", "value": "d7f76fe8d5529a535885b1a34045790b3c74b37d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mymacro", "colour": "#45B0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802491, "uuid": "d28b3785-a455-4c21-9d37-579185d54796", "comment": "Malware payload", "value": "8042bdae2b8729912a183f2180b20e6fdaa069bfef4389c587752f85095fd6ba72a4a6c416540b1c1bbdd0c97b75289d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mymacro", "colour": "#45B0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802491, "uuid": "47736263-a936-4f0d-bda7-4e237391df0f", "value": "T12236CFC5E6BBE1B0CD43C8BC8DBAE63AF564DEC90A257ACB8394FD1C507168253251C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802491, "uuid": "044e13cd-3c8c-4c83-b2f9-c7c18a4d8985", "value": "9c7dc126bf2ecfe431dcbc3f917587ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802491, "uuid": "9abdaa19-ef5c-4162-b88b-a6d8350c08bd", "value": "98304:Xg1glG4ajy2toG3AMzo3kDS0TD8QqKiuW3Am1HF3F/DudFUy6pmTK:X84H0jBigCD2FAm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629802491, "uuid": "799822ec-4de4-4f21-ac33-23b807f3f1e1", "value": 4870144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629802491, "uuid": "8fccb811-80eb-48fb-b391-2a39a38c94fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802491, "uuid": "0afc54ad-f3a5-4579-9dfc-a07dccf30396", "value": "mymacro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3719c32-04b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629792663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792663, "uuid": "cafc5497-3c95-417b-890b-756e12e89ec8", "comment": "Malware payload (Mirai)", "value": "7afac51b806fb418181802e8f058f829", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792663, "uuid": "828daa7b-383c-4a9b-aa9b-6bb4e1a1b5c9", "comment": "Malware payload (Mirai)", "value": "c468f1a915f3d3dfaa7e036283d83a08b4e9d62dd8a336320ab2da5ef69f40fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792663, "uuid": "bc626248-a0d6-410e-8b97-21620093176b", "comment": "Malware payload (Mirai)", "value": "574b85049faa8bb43e533b753acabcbe358c92dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792663, "uuid": "2ecf9f22-53be-4c36-bf0e-150a49b77e2c", "comment": "Malware payload (Mirai)", "value": "f7a48e1111bc65ee9fbcaf9a4b47341e84f98aef2c1183652c09927d1bd28ff35a3c47ec15d3a9034f3f297b82987675", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792663, "uuid": "b2a9f5cb-c319-4946-b0cb-9331c278564b", "value": "T114D3C73B27170E23C0C950B101E74332AE75DE9B34B952D7AAA07D686F37A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792663, "uuid": "8f97c725-99d0-4a48-80fe-9342e17c9cd1", "value": "3072:3v8G4ZNBQTZiNPR6Iwd9g+pxAOhmm/QMurB12CGNb:RrUlkxXmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792663, "uuid": "a2038e1a-fae1-448f-a517-227d0ca98ca8", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792663, "uuid": "5af32030-3e4e-46bd-8940-de44b9ac539c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792663, "uuid": "7d3cafc0-a44f-4991-a840-cf43b34e5c0a", "value": "7afac51b806fb418181802e8f058f829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb94027-04c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629799689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799689, "uuid": "978c52ca-a99d-46dd-bf61-65e6b84ab1b0", "comment": "Malware payload (Mirai)", "value": "7890624d257d77e38af6538a2b8f66c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799689, "uuid": "ff1eb813-a582-4dfc-9d4e-16a70d9a7e98", "comment": "Malware payload (Mirai)", "value": "c47b2224331a0b01d8072d86c97b25b7076c26ddff77d51a376ddd2a81021a44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799689, "uuid": "7facb5a3-46ce-4cff-aa9c-5f797dd7874d", "comment": "Malware payload (Mirai)", "value": "68692d7e9b4f8bf6602b36b448db1a103ea6c1de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799689, "uuid": "b515e751-87ff-46a5-a30a-e7f1be3dc8f3", "comment": "Malware payload (Mirai)", "value": "5e431d9942eac00cd1b62d5a58981733ff67cf8a9432503ebfa8de241f65859eb75628d58e23af59900f52ab6ad25a16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799689, "uuid": "b94b925f-8a89-49c8-bf3e-5e57e1bb63c6", "value": "T17E831B8EB4414E2CFD8FE9FD55214E19A920321156830B16B6ABFDD37F722E9CD42D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799689, "uuid": "3d57411e-ba7e-441e-a7f5-c27f987fa31c", "value": "1536:NV3mIDvLI50hQufXhxx7IIeg1prF4xL4sbvgPEUedm1yn82:NY4LI5aeIHprM5jgumwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799689, "uuid": "83754037-5864-4c64-8afd-18a2e93f6f63", "value": 84392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799689, "uuid": "3c810ce3-60e8-4609-b941-a83b816606e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799689, "uuid": "de7b4785-c016-48ce-b521-7a16bef08541", "value": "7890624d257d77e38af6538a2b8f66c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5bba16-04fc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1629824325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824325, "uuid": "f7fdd7cb-e4e4-47ee-a412-b67e5e4bb2fc", "comment": "Malware payload (Hydra)", "value": "9277a80e4e55c8d79db6f99406c792ec", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824325, "uuid": "f2c07bf5-3668-497e-9fd7-00c06d940edd", "comment": "Malware payload (Hydra)", "value": "c4844236e849260e5bd9d1a1d548c11667bc9f7c8c645c0a36180287a4fd48a7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824325, "uuid": "91981088-2e7b-4f0d-ab4c-971b1521b358", "comment": "Malware payload (Hydra)", "value": "728b32ec63f091909af9cc7c666f651767fa31ad", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824325, "uuid": "29c3cd80-d68b-4d5f-a50e-049008980699", "comment": "Malware payload (Hydra)", "value": "44bbfbb45085ca5825167af6bbcdb2b0160446969b36940ac02e69a4c508c1207e27a3d4e6b50550ecfcd8b5b85dd259", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824325, "uuid": "30994743-bc7e-4e6e-9796-ecac9c2079be", "value": "T1E5F53398FEE1CE0EF40B40754C629853C2027BE7A50DB2771824895D1F9ED196ECDEAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824325, "uuid": "cf127ab4-7b5d-4303-a0e2-e2b65eb262bb", "value": "98304:v9lDx+hV/NkiLjTzUV1yLrXHWeVr7inm43W3w:v9xxFiLjTwc/B+nj3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629824325, "uuid": "4d0d8fa1-30eb-40af-8478-4f458af00b73", "value": 3367537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629824325, "uuid": "5d91daf2-0c83-4456-94f6-de0ad6766847", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824325, "uuid": "c06dff34-4137-4f21-baa1-957a6a544df0", "value": "17925_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651e68e0-04a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629787324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787324, "uuid": "4a5db355-1e21-4956-baaf-2c3427bb4490", "comment": "Malware payload (Smoke Loader)", "value": "25390347b76af239fd1016a2b090ca89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787324, "uuid": "09f93916-18b9-4110-8c9e-b1ae68392d88", "comment": "Malware payload (Smoke Loader)", "value": "c55df5e9d0ea176321a29f8957c7a43188796ae0fc0ffe1ae94ad6092d30ba77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787324, "uuid": "c365b454-a684-4b2e-b864-f8748d77efaa", "comment": "Malware payload (Smoke Loader)", "value": "3dfac63f469ea0be1d235fc5d7a1f33b53d56b54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787324, "uuid": "5b7920ba-1b1e-400a-99c3-0a295c39c380", "comment": "Malware payload (Smoke Loader)", "value": "c80a7c6657e8e991202bc8ac75b439257e51c0eabdc8c3403765d8e2d5d81eee74377b22318b0a113c502c6a14bc381f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787324, "uuid": "5b8c05fc-73f9-41de-8057-9e7053259772", "value": "T10DE3BE0076E0E477C451057049D2CBE0EA2BFC61AE7195473BECE65E6F313E1B72A2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787324, "uuid": "eab2892d-96fe-43dc-b16c-c9c7221b44f7", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787324, "uuid": "4ad6efc5-e412-4c79-b4fe-94c8f0b78bb7", "value": "1536:mhIZu/M//YQ7kv+v3eCb5rKokmJ8skGmgv4JAZlfhx5HHpQ6dIvpGaJATEL+hIty:euYQpvJ5+4kQZlfhx5HJl4QaJQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787324, "uuid": "2abb5344-9c5a-4302-b415-a44981878631", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787324, "uuid": "d5478aa1-7154-457f-a6d7-03a3dde322a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787324, "uuid": "babc983a-5604-4735-86ac-a756d8fed11d", "value": "25390347b76af239fd1016a2b090ca89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb79063-0498-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629781349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781349, "uuid": "5124b12b-05cd-4430-9e40-86dc0e44ef51", "comment": "Malware payload (Formbook)", "value": "3938c79cdaba4ed8ce678b0e80856648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781349, "uuid": "4221f269-2992-402b-923d-ee397d0180f3", "comment": "Malware payload (Formbook)", "value": "c5e2e6ca1132790699601f8a322bf098ecfc4001063a94ba0fb1861e73748fd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781349, "uuid": "1fcfbc78-bf0d-40b2-82d9-27d107c09c55", "comment": "Malware payload (Formbook)", "value": "8cc115a4017d767b63d015551a265dc3419cf974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781349, "uuid": "d07ef1b1-4ea9-4132-a4e3-709fb308d82e", "comment": "Malware payload (Formbook)", "value": "aeb99cb7fdf8f0ca8ac87cbc83beab5917658d89f5f3e319d81e94b98fa6333f8daa1acc77656c3ab3bb0e5499c21dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781349, "uuid": "cf16dcb1-066d-4e89-8cd4-628c284efc95", "value": "T1D0440246615A8166C5D94ABBC98A177FB62EFD9318C335D303323AA7933C64EBD13831", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781349, "uuid": "c8542d57-be2a-4a4d-b160-09f21b207013", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781349, "uuid": "c61aa897-866c-4f94-9a6d-b87665790133", "value": "6144:s4oBymq4yflwUHnhHxOVSXQXY3ETVbfE7nMkyo:qAmeT9kVScY3ETVbLkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629781349, "uuid": "79d52f2d-4334-4038-9f01-a721d79d3973", "value": 265668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629781349, "uuid": "e6989284-23a0-487f-bc97-2f727c31a53f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781349, "uuid": "41d15ef2-2832-4a59-938c-c042dda532c3", "value": "OR71042P.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542714e7-050c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629831105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831105, "uuid": "2941d9c0-1268-4ada-b707-ef4911f04e80", "comment": "Malware payload (RaccoonStealer)", "value": "0ed48c20798d64f0da94ab3558ad9777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831105, "uuid": "53146a67-3d3d-4f7e-9aec-2213a7b87349", "comment": "Malware payload (RaccoonStealer)", "value": "c61a7a04eb5fcbba3cfc1e64a109555fbbc24a2728cd5d61ac22d2944f24d295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831105, "uuid": "3cc83df3-d432-4913-8877-d215e66dfdfb", "comment": "Malware payload (RaccoonStealer)", "value": "6fca330562d66a63c57345c7521756b2ce52c7b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831105, "uuid": "198c0246-6179-4134-8357-79f75d44580b", "comment": "Malware payload (RaccoonStealer)", "value": "4e06de0176319a5e6494d5346769fab0b0c94f9c5b3e02ae0f55e783cf289083363cbd278c74aa9ff5a353cbc860778b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831105, "uuid": "93a2bfa8-1bdd-4e40-b6c6-c3a2364085ee", "value": "T176A40200A760C933C09141B14CE1CAA0F67ABD555EF586473BEDCFAF6F653C17A2628A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831105, "uuid": "abb7f1b7-5909-4c30-82f7-ebbb248e8618", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831105, "uuid": "dc95c0f8-7d94-4ed1-8ac7-33b6eaa46112", "value": "12288:kPJWm0utlr+xdDIAhqTXo09vexzf0FJb9EcF:kPJW8qxd9QXo09vO+JbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629831105, "uuid": "208b821a-511d-488c-9c11-c22f6eb27fe9", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629831105, "uuid": "6dbcd7fc-7d53-4b95-8429-b599e2f315c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831105, "uuid": "46fb6391-a8fb-41c2-a9f6-0e213d6829c4", "value": "0ed48c20798d64f0da94ab3558ad9777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d9050a-0532-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629847638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847638, "uuid": "cbc13a25-3c95-4d9d-b323-1bfeeed4bd2c", "comment": "Malware payload (Mirai)", "value": "583dd224452f88d5ce8154d65ae8b8e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847638, "uuid": "d3dc0a70-de68-49de-9115-c297645130e4", "comment": "Malware payload (Mirai)", "value": "c7268ec3dc85dcbf1117053986f16e69e2e94211d013ba11c854fa43162ae1c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847638, "uuid": "8d4c947f-ee40-48c9-b859-5813d2680dc1", "comment": "Malware payload (Mirai)", "value": "cc3865ef3e5f83ce8b2f6bfbb8591446eedf0a1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847638, "uuid": "c92c9c80-8f03-40d4-b40e-bd744bbbf3b6", "comment": "Malware payload (Mirai)", "value": "7b74275d07447b7ae0b8d342e5987495cf4c724d88dfeab4f1385cd4f4bcfa072ee12665f2b422b7d770e9b3dc0e6873", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629847638, "uuid": "3f1744e5-27a3-4428-95fd-2e2571dc2d86", "value": "T19F135CC5A683D8F6DD0247B530B79F3287B7E97B2066EA83D799D432B88150296073CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629847638, "uuid": "67eeb9a5-a8dc-4754-9f8b-54bc665bc723", "value": "768:3pXv0h/9LvMv8l+5/mFZ6b/xAyCLy4ynVEYjvdSZxryQwsovt+X:3pf0h/BvM5EFZ6LxAyCLyYY7dSZxrBwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629847638, "uuid": "1df06e3f-0fdb-4960-88e8-0a6011dbf79d", "value": 43408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629847638, "uuid": "809caa55-1440-4745-9adf-cb1d74ce6715", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629847638, "uuid": "c5af3d93-b952-4f18-a397-520337d87f10", "value": "583dd224452f88d5ce8154d65ae8b8e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd68b2ab-04b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ZLoader)", "timestamp": 1629795230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795230, "uuid": "fa7184bd-0e83-4f5c-83d9-ace43d421456", "comment": "Malware payload (ZLoader)", "value": "56079ea11cb3fce2a34fdf0a81deecc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795230, "uuid": "00aed3f3-48f1-44a2-b71f-94642bac23ec", "comment": "Malware payload (ZLoader)", "value": "c75f4e1fd464e21826c37e5abf7fed93b48c721625f700f49aa71cbce377ee8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795230, "uuid": "f1f1dcad-8baf-4fe8-b4dd-28700230c991", "comment": "Malware payload (ZLoader)", "value": "38475dc6871d88b3c9070f4e55f8c44a07b7dca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795230, "uuid": "44a91fcd-4ef4-40ee-81af-6b605f76e725", "comment": "Malware payload (ZLoader)", "value": "edb20cf8faeb9a4e7840e84d148a053f46311118cc0592b49e5dbb0f57cd710c57db5a09f48aa4974073fe9ef44de35e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795230, "uuid": "05bbdb0f-907b-4f7d-afcc-66217a376424", "value": "T11F94BF91D7C6D678F49B013FF88B67E9102FAA824837DE679B6C19EBD7341C0912B160", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795230, "uuid": "7ec732e1-a736-4dd2-9935-1dbbe76d3f81", "value": "f9be3cad31c3932761094c0c4d7fbc81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795230, "uuid": "ea0c73a4-8971-4c6c-b7e3-68d2766b5999", "value": "12288:jS5WNqciJOAzgUOksgh/Zuss/p5V0noFJwhNUy:jS5WNqM1UOqFZusIpYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629795230, "uuid": "6ebc7552-1dca-4645-aaf1-ff928def2420", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629795230, "uuid": "41225f59-e317-424c-94ef-1287ee9fbe36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795230, "uuid": "9e6a2294-67f3-4c10-ba65-0ac82e6550a8", "value": "mic.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f6dddc-0470-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1629764165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764165, "uuid": "44370956-e62c-456e-bd68-bb128e830988", "comment": "Malware payload (OskiStealer)", "value": "c9626ce54f97b0bc2270eb091952ea53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764165, "uuid": "f8552ca4-9a5d-4b67-8815-7fe1354e2c38", "comment": "Malware payload (OskiStealer)", "value": "c76856f53bc950964cb30f0b48e80964b5162660608794d25ee919ce795796ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764165, "uuid": "38d4fe81-5c7f-4cf9-8b04-c41c967a0a86", "comment": "Malware payload (OskiStealer)", "value": "21ee67939e626714aaeaa78d4c6010cbb0e19b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764165, "uuid": "db96e72e-87e1-408d-88f6-a5ba3de8836a", "comment": "Malware payload (OskiStealer)", "value": "c5c3af6d4ae8cc8d58d53388e01d2d1feb686231186bb669bca8b027b052f15f002f50ae602d818d1efc5010d9ac359e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764165, "uuid": "ae2df4a7-c8af-444d-9831-654814c1c67d", "value": "T136F4E1AD7650B69FC85BCE728DA85C60E650B477430BE243A81312AEDE0E59BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764165, "uuid": "4de07aac-b862-4703-b6e2-6bed7c315381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764165, "uuid": "a3fb5c27-6457-48a4-88a5-8f8fb9745b36", "value": "12288:3LJu0WF/vuVlFUlat1mVeAc8CVijLA6s691+U/Ub1XQKAaC0fuke:7Jq8a5exdVijL7191t/UbZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629764165, "uuid": "10d8d131-78d4-47b6-b76f-c9c58229ccd2", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629764165, "uuid": "041d85a6-0eff-4c1c-8514-363cc3793e6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764165, "uuid": "6337a34e-34db-4d07-b6b2-78b7b824c718", "value": "SKBM-240821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9c7ff7-048c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (XorDDoS)", "timestamp": 1629776095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776095, "uuid": "dffeaff7-6321-4ea2-b648-bb209b2ac41f", "comment": "Malware payload (XorDDoS)", "value": "2a91a3170a5fd4fb3e30f3d63b9120de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776095, "uuid": "04ff9abb-baf1-48f1-ab66-02e245976e9d", "comment": "Malware payload (XorDDoS)", "value": "c9bd6d01eb7258fef88ec5c9276431c1db45f063b316f83943e45b6a40a76783", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776095, "uuid": "9b8996d0-c250-44ff-8244-2f8bda33cc68", "comment": "Malware payload (XorDDoS)", "value": "1a7a226833f43fdaee71cb6f84914f9a1e87de81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776095, "uuid": "2d7641e6-7941-4930-8e6a-9a1d5531adf3", "comment": "Malware payload (XorDDoS)", "value": "b6fe34bde6d44a3bcd077816f015eb625d4bc8257367100176941f0dce6ab7565af4f3769dd7ff6f7ebbd56e32d7ca72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776095, "uuid": "7e234996-580b-45b1-aab6-4d18d8248e5a", "value": "T100C46D06E343A2F6D8270470235BF7BB8620B23584119D97ABD5AE5AF9339F12A4D353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776095, "uuid": "a8b393d3-a882-4935-8004-98ade650d60a", "value": "12288:D3P1A0+Kvdnd4Asvhc27/ao+PzENGtkZg0/CedRlZRqR6ysen:Dfm0+KlZsJc27io2zYGtk20/LdF0+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629776095, "uuid": "8f9c0baa-35ab-4d22-8bbf-540ea972a70d", "value": 559843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629776095, "uuid": "bea133d1-8414-43e1-90d3-77f860c37178", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776095, "uuid": "743b6ecd-7798-43a6-8619-db7e9c85a55c", "value": "nyynvefzjerks", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59f7300-0531-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629847133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847133, "uuid": "d60ca06e-46b3-44e2-8fd6-8526be38c5d6", "comment": "Malware payload", "value": "a1e0aa315c2caf13f0f7edacea3e9aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847133, "uuid": "e2a52ec5-b417-451d-93c9-8ff88c14465f", "comment": "Malware payload", "value": "ca1c052698c5a5c7e5ddcd14a95709288a364cd0be7fa06d03c62c2ead4ea78b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847133, "uuid": "5058f6a1-48b5-443d-8f06-d7236ee1209a", "comment": "Malware payload", "value": "3e768bdf99b6e40d8da1a0a74f345c8a316a6b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629847133, "uuid": "d869dddc-2cdb-4873-984e-060041d4abf5", "comment": "Malware payload", "value": "a2a5e666b64cb0578552a6881301c8fa3116237471f7c8cc8831cf0a545f287be8f1b9e7417613188783479abb91a519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629847133, "uuid": "cffba86a-49f9-4286-941e-b6def2339e69", "value": "T1C2A4F05BB1E11089DBF581B6D592074AEB7070712B19A3DB6BB113B70B2E486DF3C3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629847133, "uuid": "ae630353-bc0b-4b6d-9cb1-07350db77144", "value": "f326f88ca83c9aacaa44acfb8884f1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629847133, "uuid": "3fe86376-a0cf-4367-b239-25022076148d", "value": "12288:0tzE5elwLz9Tr/G89suLMBU2R6rPfgi5QGRTYseAC+kYr8:0tA4KdTDG/hRaAiZRTyRpYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629847133, "uuid": "d38c13cd-40b8-4956-abe0-77089e8e14e7", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629847133, "uuid": "afb048ef-e911-459a-9196-c322ac2e3cbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629847133, "uuid": "81e20a0f-566c-477a-b6c7-922d4863492c", "value": "a1e0aa315c2caf13f0f7edacea3e9aea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b71d27-04f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629822136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822136, "uuid": "a4c3392e-5def-41d6-9c65-3df9cb2d05b4", "comment": "Malware payload (AgentTesla)", "value": "ce021cbc113add9bb3d3e3b8083b4ecf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822136, "uuid": "c7913cd4-d304-45a5-aad9-7061ae5ff26d", "comment": "Malware payload (AgentTesla)", "value": "ca6861b3ddccf0a7ca7bde66b59315460d586a1efcc8b6969d278727ee7fc80e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822136, "uuid": "a7b63481-b4f4-4f4a-ade9-3f207e36034c", "comment": "Malware payload (AgentTesla)", "value": "c7bf03d3e97721afac73c72baff67c5696a29e84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629822136, "uuid": "24f8fa57-6ebf-450c-9fe9-ec2ab9c9f1ec", "comment": "Malware payload (AgentTesla)", "value": "19a6aed602bf6d6456f4a07d6353556c400e1f45a5feca945e596e6a5e3b3d38f58fb89757220353dab127a3836a4bf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822136, "uuid": "1435754c-39fa-461e-b128-45d27eabef5f", "value": "T1A505C47E1ABD922781B5C2B5EBE79417F0409B5F3411AC2576D203660232A7BB4F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822136, "uuid": "21c3c9e1-2d9a-4c0a-ab1f-3c8ff438c412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822136, "uuid": "f8a59512-a2c9-45eb-aa5e-31485df76b95", "value": "12288:gp9K5E8unYwMUd9ASHzoZhHQXJowVj8wJMSRpEQaISbJICTYyj:gpI5EzYMfAS8i5NdsQ3SWC8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629822136, "uuid": "abeb8708-11a1-4ce0-b53f-bf0db2403e1a", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629822136, "uuid": "675e73c2-5b5b-411a-acbe-4a83b57c38ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629822136, "uuid": "36ef556a-b33f-43a6-9bbf-6444815db969", "value": "purchase order_pdf___________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e328f4-04d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629808014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808014, "uuid": "aa45de4c-2811-4e71-a701-239bc13b813c", "comment": "Malware payload (Mirai)", "value": "c4da4108f16d6806c0b906f8cdf7b70b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808014, "uuid": "251af775-61ab-409f-ab65-9f89e3f04b24", "comment": "Malware payload (Mirai)", "value": "ca937f72baeedc9606371ec07cd50f3271e74763e5e6acb6d02468096c021d0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808014, "uuid": "d9c22bc0-125b-46c2-9c71-5e0551ffa89d", "comment": "Malware payload (Mirai)", "value": "a8d3e9d00bef5376c76bbbfee33c99fb1b22dcb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808014, "uuid": "0c7a69dd-592a-4f7b-9b7c-09c6629c85ff", "comment": "Malware payload (Mirai)", "value": "2b61276604b06011862fb9a7960dd3240647b629edcaa6f028ec8d9c6f670793b88e6d2cfa445a01d552cab040ca6cb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808014, "uuid": "eba39d99-0282-4fb3-90cb-09080d3f8d94", "value": "T105A2E759BCD3875AC1E0D1BEFA0F8A9C336193A8D1EB730384541B1097C765A4F2FA95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808014, "uuid": "62faad64-99c7-4890-b454-bfc101dc2e4e", "value": "384:Ri0lN0zzd/Hk80MEcUsVtl91NFdVtl91NFdVtl91NFdVtl91NFdyKFCVxVZcRZkN:Ovk80MEcUsVtl91NFdVtl91NFdVtl911", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808014, "uuid": "f39fedf7-66ac-4b38-ba1a-b1461541b362", "value": 21688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808014, "uuid": "2d2ea4a4-0991-4338-a1b3-ff920a671183", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808014, "uuid": "4e0c34c6-7f09-4b37-b40d-0723d88b4188", "value": "c4da4108f16d6806c0b906f8cdf7b70b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c94313-04cc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629803826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803826, "uuid": "a13e5dd6-cd7b-4c38-b472-c0d639ff2ff0", "comment": "Malware payload (NanoCore)", "value": "e971a3d53a66d5b98ea236e3b30e0204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803826, "uuid": "800008ac-7551-4480-8a19-f0a21ddb5348", "comment": "Malware payload (NanoCore)", "value": "cb04fa37e4c2de5eb2ec98ee8c1b6b3d6e12c64cc9f37e72130918d1cb79bc49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803826, "uuid": "c942c29c-f3ca-4082-a82f-5f99461037d5", "comment": "Malware payload (NanoCore)", "value": "0be9e63a25ee7b865d42f2fdb19c28316e39c177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803826, "uuid": "d5195a69-7675-48f2-a476-edcb68b7697f", "comment": "Malware payload (NanoCore)", "value": "3e6f28c760d636188d78428c45bbcfeed20010985cdf002ae6bbf0d5ce8fea7b3024a336a0306ecc778e9211bc0e3a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803826, "uuid": "ea45ef65-dda2-43a2-8ab7-773fbc368c8d", "value": "T1BC259D7063C9C294EC1A8FF0167CFB9402F235E7B6C4CD6A16EA620C8E5E9D1670765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803826, "uuid": "1012dd04-1854-488a-82b5-f34b5c94e691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803826, "uuid": "14c13ce7-1cb9-4016-a44b-bb8cc3b19288", "value": "12288:KMhUeVfYMZ7nqXfvPnQySgrRDp3z3KsD0BT75qGMcPh4wCIuKBllpqC+42EObb6:KneVQMxonrSgr5FesD0BT75JMSWihm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629803826, "uuid": "90d60fb5-c063-4f1a-9081-1d165098c10a", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629803826, "uuid": "30f88c9c-0125-4b4b-b985-6bc714aadbd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803826, "uuid": "2b025714-b7d2-47e9-acf0-d5636151ebf2", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdeebc3-04db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629810045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810045, "uuid": "7408d34a-1d2f-48f0-9881-45cc58e709bf", "comment": "Malware payload (Mirai)", "value": "485398442d562acf45d6352fb1cfeb24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810045, "uuid": "6383032a-cca9-4965-8276-6d577f8bc6e2", "comment": "Malware payload (Mirai)", "value": "cb54c60f9e2c3644ac535945351b32bf2f34e00abbd331349f8bf55cb41e4c73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810045, "uuid": "32e88216-3f28-4c78-adba-23ebcbfc6538", "comment": "Malware payload (Mirai)", "value": "8693c1661822efb9b8031cda063c6a9d9080cdff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629810045, "uuid": "083fe942-3840-482b-a488-540663b01623", "comment": "Malware payload (Mirai)", "value": "4c6886ad414bfc9e611ddf3eb469bf931dc0b3d336f59ffd5376f6f40d5a3564fecaa0c69f0268c71bb4fe9a8d15e87d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629810045, "uuid": "dada2254-d703-41dd-ad93-67fad9543013", "value": "T1A193293565382B62C8D4F87E31B78744B2E5366D2AB4898E7C320E5FFF24B8059462F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629810045, "uuid": "bef00000-832f-4594-840b-ea75c8c46cc4", "value": "1536:JkN/p1vSUo4lL6GxYsCk7gID9vg+8lESrYVqLpd+426Qvkk6vC1O0XAkgPFO:WNzjdxpg+8lx8q84JVvC1ekx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629810045, "uuid": "dc5fabee-c141-4568-84b1-7fc095ea3521", "value": 91456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629810045, "uuid": "0faccc6f-7ad2-432c-8c15-bd5ca8eca6fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629810045, "uuid": "03e169f9-f10b-469f-a4cb-19f5737526fa", "value": "485398442d562acf45d6352fb1cfeb24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1791bcf7-04ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629825420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825420, "uuid": "c77da637-b664-4bb8-beba-38b0f2397be5", "comment": "Malware payload (AgentTesla)", "value": "0e2cac6c2d70783cade06098d4c56566", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825420, "uuid": "b6fadb88-c84b-4546-b76e-1113645b7324", "comment": "Malware payload (AgentTesla)", "value": "cc1c7659953c3f75bb563454f5a88731f3910dc16a07f89725d7a0c68f5b1655", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825420, "uuid": "b2626b00-d0f6-4adf-964c-f22f9ba56c6b", "comment": "Malware payload (AgentTesla)", "value": "4224647c338e0244478080b63c3d23e490f62613", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629825420, "uuid": "13a74a5d-acea-4b04-b16f-586c1aaf2c57", "comment": "Malware payload (AgentTesla)", "value": "b088ea06d747d9f496fbed9070b99bd3ddffa8a3213c995c26112b98cd39bd4c1e818b8ee1c1e155390740ea07ea490d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825420, "uuid": "7556ac42-bb1e-4073-ab45-3725c935bef9", "value": "T15605A37E1ABD922781B5C2B5EBE79417F0409B1F3511AC2576C203660232A7BB5F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825420, "uuid": "0ea9f638-02f0-45fa-a6d9-0bb44f42ba41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825420, "uuid": "a2f35369-ef81-4d23-9c3a-11549f468ca3", "value": "12288:s5zKlcUr82FFYM/zc5qk3K+fOkJy8ftHCuQWVIW+JESPDV:s572FFYMxqK+2kJyatK8IlEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629825420, "uuid": "9f8b0cac-040f-4e80-8353-c69d58975072", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629825420, "uuid": "1b693c6a-fde5-43a8-864a-2342d559ddfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629825420, "uuid": "a2090dfd-8dc3-4cf9-aa93-233d64dd6fdc", "value": "Documentos De Envio Originales.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacd17b2-04f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629819761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819761, "uuid": "f2dfb685-daa1-4e3d-82e5-3d614a8e1174", "comment": "Malware payload (RaccoonStealer)", "value": "160f931b678affb93d3aff2dd5a65734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819761, "uuid": "c84967fb-097a-4937-a6ad-6e10657263c6", "comment": "Malware payload (RaccoonStealer)", "value": "cc64a8243582378c46ab8b2f3c69a544fe522934856701756cb612492d59085d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819761, "uuid": "b99d8c8e-3002-4c0c-9cd9-aceea678c7d4", "comment": "Malware payload (RaccoonStealer)", "value": "cbfff062a78f532b4619fbf386ff4b7b9299e690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819761, "uuid": "4b652702-99ab-4460-950f-4f92b041d527", "comment": "Malware payload (RaccoonStealer)", "value": "51dbd168e8dbddc851330bf845e628977d7870c879f2a5743da92f90fe5bfc72c967f0307fd6d662214e2d479e4cca2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819761, "uuid": "e23c5ed9-6ded-471c-8d2b-63ee1192f957", "value": "T160A4120176B0D473C082897088C2DBE0E92979566FA5824B3FE9DE5F6F353D0762E396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819761, "uuid": "382664db-0425-4d47-a6e9-6918060d3d29", "value": "bcd64e2657251d69bf082a6790bd215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819761, "uuid": "5a4f8f6f-e1ac-48df-bc98-acdc34349c36", "value": "6144:Swkn64bL43VJiMwHhgIdRmN50NRt37OQdEFbgn8Y8jRB4g1hr/O8bEcxb:SD64nGJiZVRB7ibZ34g1BhEcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629819761, "uuid": "1c05572f-6711-48ce-8f45-133a35c4c3eb", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629819761, "uuid": "c60cbbe3-7819-4677-96b1-bb3f12216681", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819761, "uuid": "03dfc650-0f3a-463e-a602-838f8e5376e5", "value": "160f931b678affb93d3aff2dd5a65734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8827bf10-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629804993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804993, "uuid": "5bc8d6b7-28c5-41fb-9324-0a4824820fde", "comment": "Malware payload (Formbook)", "value": "302a2edb81d9e753217958ee2eccb691", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804993, "uuid": "6031beaf-66d9-46ca-90ff-044be9cb9e0f", "comment": "Malware payload (Formbook)", "value": "cc9ff3d7e92b4cd7b0a1abea6429d243b185d0f9d52d184ce91a34cb0c7a9ed8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804993, "uuid": "1615a57e-43a4-464f-8482-de60f814090f", "comment": "Malware payload (Formbook)", "value": "54fc8ec70f01fd8b5576b24ee98e11c55a50bbe6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804993, "uuid": "fa20ee72-6eac-4404-9938-52c51f3b3845", "comment": "Malware payload (Formbook)", "value": "ee9dd966828277b16a40b13dd350a30e58bb0dd62321a298b6c43c2040661f60c90c40aae6c6c41f736c4a844ccdc42d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804993, "uuid": "a021b8d3-d134-4766-a88b-9b3466d7cda7", "value": "T197552217BD612F63C22698F36ED26C327D296D442521D4A9131FB280E6F73FE7566308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804993, "uuid": "24e74737-e188-4ffc-8e50-93fe952db025", "value": "24576:1N1vQ0rjcm17dObnPrKtkDBVDBCz6jQOq6XW6zAVgX+V1VFtI8khjHSd6qbH5VOR:1N1v9jT7dOTIYBXWr6NXyEXTqZVOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804993, "uuid": "cd52c400-aa32-4078-8c4b-f3edb1a1e43f", "value": 1363944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804993, "uuid": "d2d76953-2f5e-4c0c-bc8c-b69f4b7063a6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804993, "uuid": "0b2a173b-08c2-4904-9239-224311d5b739", "value": "PO KIND122822 .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c822387c-04d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629808536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808536, "uuid": "f8a214e9-6b99-4fcf-9b31-0322efcc0360", "comment": "Malware payload (Mirai)", "value": "8143d4b3fc06ee61d5f2a4fe8b3fac56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808536, "uuid": "d92a8d76-defc-4fe4-9012-5bf259f1b056", "comment": "Malware payload (Mirai)", "value": "ccb94debb7a56317bd6657cfb22a81d29db2e66ff221c55f872541991929797f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808536, "uuid": "62b85509-f3e2-48e3-81f9-3dbf4878a8b8", "comment": "Malware payload (Mirai)", "value": "2eb61a9c33dc621a030cdbed41fa2c3204a2c7e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808536, "uuid": "1602f90d-0a32-4dc1-a2d9-daff2aa8e619", "comment": "Malware payload (Mirai)", "value": "d69ffcdc0eb25cbbfce167c2597a29031526810859c84f6752f233bc355f1f2915b5c4492380297b5f25de4e5dbcffce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808536, "uuid": "d2d56c1d-6886-4042-b3ef-a50ec36454c7", "value": "T14A73D85B6E228FEDF66C83314BF34B20A76923D627E1D685D29CD9001F6038D545FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808536, "uuid": "da4ba856-42cd-4861-8438-649a2922ccf7", "value": "1536:gzoN59l1sjMtoJ7N6h05aAJv/Gnn7eRsTL:gW5xsgtoJ7NIAJGnQYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808536, "uuid": "b726450f-46dd-48e1-b7fe-4fbeac32ce64", "value": 76540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808536, "uuid": "0e069789-dc6f-410b-9651-482bc1f41730", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808536, "uuid": "15834ec5-07fb-42a6-a4ec-ca33f95bb664", "value": "8143d4b3fc06ee61d5f2a4fe8b3fac56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd27349-0525-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629841910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841910, "uuid": "a8421746-f1fc-4ab0-8b33-66803b931468", "comment": "Malware payload", "value": "e439dfb827967cacf3813ea19c1d9dee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841910, "uuid": "c73c3241-fac0-4126-8fba-13b8b3ff75e5", "comment": "Malware payload", "value": "ccbb4b66b284b64a41b21eed6466d99b544baeea718cac14009c0054ef2085a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841910, "uuid": "f1137eb7-c927-44b2-b050-474c7940d470", "comment": "Malware payload", "value": "9b9abb110c9952cf3a0207faa7634eb32cfb16da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629841910, "uuid": "1fa65e60-cff6-4fd8-b7e8-d10ecca08165", "comment": "Malware payload", "value": "992c87d10478f818f593a167371f4d0e2d4158e0ae4f83c245cfa293ea2dd438a996c8053c1e904f0ce3e8208f718a42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841910, "uuid": "e45ba6eb-ab1b-4f54-aab7-c1300f036d93", "value": "T19413710E6E649F7CFBA9963447B79F20D64833A22AE1C941D05CFA411E7074F742BB68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841910, "uuid": "c2a1487a-bf86-4982-b16d-844569fe032a", "value": "768:G4ZGrmY97tUXgMwZxMt6+vl/R1KZiEGesIbtnnW8:G4Z8LUay6+vl/R1KIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629841910, "uuid": "a34d20ba-db20-4bd2-8a84-3bdf0121226c", "value": 43536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629841910, "uuid": "e7b2dbb3-21bc-4dd2-adb0-a4bd4f203064", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629841910, "uuid": "f8840bb0-d1ef-40c2-b8f5-a1ec535d773d", "value": "e439dfb827967cacf3813ea19c1d9dee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3fa560-048d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629776515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776515, "uuid": "57606f56-0895-4ba7-a8c3-169e035b25f5", "comment": "Malware payload (Loki)", "value": "78d76f14b18f3d1c40e9706cd9d7084b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776515, "uuid": "f28574ae-a9af-4138-8d7f-96b0e8588a70", "comment": "Malware payload (Loki)", "value": "ccc40237ec7ce2a7cf7cd02ee32ff5e9f648167e8f3180f1e91499cc083a0a80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776515, "uuid": "1a81031f-8dc7-41b2-8702-04d86e5e7b2b", "comment": "Malware payload (Loki)", "value": "587c1628cbcca9f6477618602909ed1f79b5c498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629776515, "uuid": "bb4498a6-b56f-406d-8efd-65c804fe4877", "comment": "Malware payload (Loki)", "value": "2fada07c3b23dc80ee8b39652eb3415064a129b063eadcef40973888eb4ae23504ad6b697e294b718a2d4fcb7f986adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776515, "uuid": "15e849de-18cd-467e-a326-cc30e6049f37", "value": "T1F6844B4E07EC26DDDCC1E431FF6986637D410ED4712ECA895166F84649380BA7AE8BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776515, "uuid": "30226c18-836b-4c12-8b2f-c2c73ec44e12", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776515, "uuid": "42577b27-abf2-490e-80dc-1ca98302294b", "value": "6144:uMEIokr54vnP1pidcJreaIdIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIb2+/RDE1gJt:DNSpiSr8l/RrrOYUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629776515, "uuid": "fd8afe40-8c94-45cf-8f89-8752e513e6ba", "value": 400160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629776515, "uuid": "12a90980-0e6f-4bcf-9c13-b7d411d5b6e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629776515, "uuid": "36f446ea-c6ef-43f9-8c5a-3809a5e68fda", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da40911-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629805700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805700, "uuid": "b5d13a1a-3e23-48bf-aa6d-cc22f4260d34", "comment": "Malware payload (RemcosRAT)", "value": "abedbe11fe805a6174b2e38f98d00c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805700, "uuid": "9764da87-da7d-4ffa-999e-f1c3ec638438", "comment": "Malware payload (RemcosRAT)", "value": "ccdf201b95204d0826763c23521c0c9f0b78b25b123150b6f502eedce52c633a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805700, "uuid": "49e412cc-7b2d-4b5c-8eac-e3d1c686210e", "comment": "Malware payload (RemcosRAT)", "value": "d4228434b408892f74d912702b5baa6bfd6f1086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805700, "uuid": "d695fe5f-1dd1-43e7-9b41-05fb8440bad6", "comment": "Malware payload (RemcosRAT)", "value": "5241853ef89a60c36db7ab2b53e462f6bb04da18ea2821e7e17caadb4ef2b0f7ab307d8a4c59b503c8922fc7f832c74f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805700, "uuid": "a8135316-7023-43f8-8c8f-dcd3be468eb8", "value": "T120B43A9C7250B5EFC857C876CAA82C64EA60757B930BD203A05325EDAE0D99BCF154F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805700, "uuid": "4842debc-0f54-4f5e-b0d5-bf4a7bc90554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805700, "uuid": "000ee40d-14de-406a-a18d-1b21d7478049", "value": "12288:G6b7ceLHx70SkZYyVzbRXa9Z6NQ+GVFyZeFODOSGkEw9Ola+7Qv4XiqX:5sed70SkZDP46zaw6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805700, "uuid": "c92fa766-8f14-429e-9908-55a0a0e19d27", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805700, "uuid": "324bad1a-a05e-4bde-b2dc-d213ed94645e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805700, "uuid": "efe81270-3447-403f-aba6-09613c4fc5d1", "value": "abedbe11fe805a6174b2e38f98d00c85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a064ac-04a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629788473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788473, "uuid": "d37cbf55-9467-44f5-9d68-a2e97b5f3c70", "comment": "Malware payload (RaccoonStealer)", "value": "c633b1e68dcffdae991c3f2d2d4fffa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788473, "uuid": "ae7d811d-59c8-4241-a0cd-261c678e12b7", "comment": "Malware payload (RaccoonStealer)", "value": "cd2c1dedbc8879403936ce9f750eed4acc6c2422088c7180377c88c58ad1226c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788473, "uuid": "f608f6a9-b0fa-4636-937c-7dbd4687a12a", "comment": "Malware payload (RaccoonStealer)", "value": "a1ed4d1100c46b6fbc64026b5114fb568812b340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629788473, "uuid": "793b5bae-ae6d-457f-b116-0039c0deab04", "comment": "Malware payload (RaccoonStealer)", "value": "2067d0c5a37020e10cf598588a30d119a07b531c2c65bd863b4f2b1649ebfbbf6b2755c05fb277941e9af1f82b12e4f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788473, "uuid": "648fb947-64ad-43ed-824d-0f740fd1d413", "value": "T1A9940206F7A0C037D55284385CE2DE90E53EBF90AD551153F7C8BAAE5E306D0B6222BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788473, "uuid": "8d6b7402-de80-4c51-876b-eb28002806ab", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788473, "uuid": "7480a445-e1fc-490c-b516-1d9c4ebca59c", "value": "6144:SpYoqzhV+WTyOy9w6auup9o44zi77Gmx36wcHoNhQ5InUGqkVTPbD+bIzZ1ZsWzo:S2dhV+j2z9o448FLQAlDbtso2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629788473, "uuid": "488a3728-e594-4b33-8559-cc296a081019", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629788473, "uuid": "345b7398-4920-4c3b-8990-289de656b782", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629788473, "uuid": "cd412b8a-4a5f-47fc-bdcf-2474be7b88fc", "value": "c633b1e68dcffdae991c3f2d2d4fffa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aae3b19-04a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629786770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786770, "uuid": "67d37c49-b5c9-4996-949a-e160976b321c", "comment": "Malware payload (RedLineStealer)", "value": "61ca362d4db10d3df17d5eb43686034e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786770, "uuid": "36f0638e-891e-43bb-8d24-a01396ee9fa2", "comment": "Malware payload (RedLineStealer)", "value": "ce1f53de756ad60f0e1aad5397f92b612b33be9b2a18a745e3804f71b53d988f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786770, "uuid": "e83d631f-d642-4d1a-b58f-61c49a65ee47", "comment": "Malware payload (RedLineStealer)", "value": "384579223da56793532c20065c3171ebc245c5d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786770, "uuid": "3b0c9413-fdc1-4e59-82e4-6aa6c2351b06", "comment": "Malware payload (RedLineStealer)", "value": "be7a9cfc4d52d82d75e42a582be9b574bff193d33b4fc1b51e28eed94e969f3ba78820ca4cf69a3f0c03928c7f593cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786770, "uuid": "7553a745-c12f-45c2-abcc-8f55bf1d0e41", "value": "T19B74AE30BBA1C034F1F712F855B682B8A53A7AB16B3550CF62D52AED07247E5AC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786770, "uuid": "f1254b79-2b59-4a0b-8ca9-82a2b0ae50be", "value": "9d905009ce289bf09ec9a9fc544fc23f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786770, "uuid": "ac05b409-36a4-412c-856c-ccc7176a8453", "value": "6144:D6/w4UN2Sawe/g8R+em3aeSUY6lu3vVa9ZEZJCpuNSA9+H4vL:ewVND/eIB3aeXY64da7cJ5T+He", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786770, "uuid": "2912c2a7-07c8-4887-b234-da693823dca2", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786770, "uuid": "6dac8802-c8e9-4684-b845-80073ac15a3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786770, "uuid": "2981f227-7978-4dd5-91b4-88cfac79059d", "value": "61ca362d4db10d3df17d5eb43686034e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c558869-04c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629801805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801805, "uuid": "213bb2d9-8235-49e1-a745-fb02faf2d4c1", "comment": "Malware payload (AgentTesla)", "value": "dda5aa39812331e927fe2ecbdc4b42ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801805, "uuid": "7dc1a60c-544f-42f3-a8b1-05d8d1f474ac", "comment": "Malware payload (AgentTesla)", "value": "ced2482a9d4316028a8ae3edc49a1dbe1ecd1f76b1a4c6a682505d3b7dd78146", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801805, "uuid": "36bd4d4e-4f50-49ef-842a-756c49fbdf07", "comment": "Malware payload (AgentTesla)", "value": "d8ed5212532e8fd0a1020cb58aa9a369212fc8ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801805, "uuid": "bf7f8c3d-59ed-4e6c-bd48-8888f57e66fc", "comment": "Malware payload (AgentTesla)", "value": "bc6d56e8e82058f101a8d8d4ceda7b48b68389ae027b98f5f47cca339951a33dcbcf9a3ccb6557ee03da9079b67ce3ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801805, "uuid": "b3b93db3-f3d0-47be-9867-fbe0e9aa302f", "value": "T199159C7063C9C284EC1E8EF0167CF79502F275EBB6C4CD6A06DA324CCE5A9D1660769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801805, "uuid": "acb5e2bb-1a2f-4535-b2a1-bcbea0482d21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801805, "uuid": "bffcfb18-5af1-4a82-a6f3-dcee20698610", "value": "12288:gScsGI/cCYNTPoIrBamCQE+Fop6poW5o8Wi35uESx67fs5dwxSc5Pq9s2EObbo:gzNTQKBxE+FoQpoW5o815XSx6g5C4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629801805, "uuid": "b54d8bcb-6baf-4ad9-9a3e-b2f53670ad87", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629801805, "uuid": "caffdf5c-c84c-45be-ae2f-132685aa9564", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801805, "uuid": "6988392e-8451-46fb-a3d5-b150daa97608", "value": "Bank _remittance.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcf8960-051c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629838070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838070, "uuid": "7b2e4dfb-9809-459f-9c7f-6acadd6bfce8", "comment": "Malware payload", "value": "4dc8e89c2d7492ba6eaf41dac6cf4cab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838070, "uuid": "650cbf8c-6fd2-45d3-9356-3e31b4c6f656", "comment": "Malware payload", "value": "cedd06f2440be8790c6e7173ff23ef7482e5f66dc5a0fe0960200531d6fd615b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838070, "uuid": "e7079535-a596-4f50-a26b-130b2a2c44a2", "comment": "Malware payload", "value": "78f81934976654853f951196b87c3e20da3052e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629838070, "uuid": "615daf43-1cae-4c9a-9a06-c39608e16be1", "comment": "Malware payload", "value": "ab3a62ff042e08a2ef6032019801610ecc16a913d6d0cb4c2ca9e51d7f03b90f769ecfd397fbcc244caab0dc5725bfbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838070, "uuid": "6ebc2a35-58ac-46d5-b7b3-a7972f0a1e47", "value": "T1FD331A02AA42DAB3D5431AF517E79B310132F87A0F278F56E32C7CF89B1A484726635D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838070, "uuid": "dbe8be1d-3a12-42aa-a115-ecdaa838a0e4", "value": "768:XfM26CZ6gUPlr4/5rLLormGnOUQvYp/4k8NVM1/dsITDt1k0IgreKV8:P56CZRUrk9bGnlQvm/481/dsFO6KV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629838070, "uuid": "3c0a9e44-3745-4c60-9e12-5801d3e9d08b", "value": 52843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629838070, "uuid": "04d698c4-faf3-4d61-b033-dd06494e2e7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629838070, "uuid": "b13d1fd7-3cb5-4047-b4a2-77be3b270415", "value": "4dc8e89c2d7492ba6eaf41dac6cf4cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1d7f9e-04c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629799523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799523, "uuid": "134393f1-2e27-4a00-8fa2-30cc11b19bc1", "comment": "Malware payload", "value": "5862566b7f102f146c954f670eff23bc", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799523, "uuid": "16f00af7-f839-4d7d-9b8b-a17018f7841d", "comment": "Malware payload", "value": "cf81ab9d4d772ef92e392cd97480c9119246bfb5a6593dc662440f7acf9205ca", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799523, "uuid": "c4807e4c-761e-410a-a560-933f0ca3cdfb", "comment": "Malware payload", "value": "bc1c3f25144ca25715c0abdc1db7de3198344efd", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799523, "uuid": "51b5c63f-850d-4e0c-9c78-4b00ce3c073d", "comment": "Malware payload", "value": "ff56c4afa0fabff733432db658b81f7040bdbb869bf2f83627dd105203dce55c46d3ab4234e60eb5eba2546641dbbc47", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799523, "uuid": "c9ab3507-77a1-4e89-a3ed-bdde7834aff1", "value": "T12533D64C0DAFD05AA72DC664EFD06CC5DBADE053B166D26ABB85E60C4F90CEC10C94E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799523, "uuid": "59931f32-2529-4d9b-b6c0-6756b2247d68", "value": "768:N+kDxyDiGd/cWfkxz/fNmtHXs28s3tUnBg6Oi+TwSQqHA:NV0iGd/Rkxz/fNm5XPPabOiBhqHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799523, "uuid": "30c5cdd9-92e7-4d50-ba1c-f045a1b9f94a", "value": 52010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799523, "uuid": "17b5160d-b1d8-45c9-ab2d-dd19723dbe5f", "value": "text/x-asm", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799523, "uuid": "f45deef4-56f1-4f52-b358-410d03ce7b46", "value": "2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50ad726-052a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629844259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844259, "uuid": "067095f6-a48e-4873-ab2f-e70d64d970ef", "comment": "Malware payload", "value": "21c76d90998268356aacafaa9897a609", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844259, "uuid": "6ba1d728-9791-449d-8102-6691862e15cb", "comment": "Malware payload", "value": "d0db700f0b54db867cc1d5668f19970c80ea227892d4fd9c61afd0198751c9d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844259, "uuid": "e7028261-dfb2-45ec-a96c-92fddd9933b1", "comment": "Malware payload", "value": "01681fa78714a19a72a208085edc651361c56216", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629844259, "uuid": "3fa62c23-7f43-4beb-a01e-d497d4c18c1e", "comment": "Malware payload", "value": "8be206b04d31b888bd1183701045fe95645f690a832d2f99219a015b77b37ea0c24b81b52f9d1414c7150d41d185e985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844259, "uuid": "f6d8fd94-c55c-4cd6-8829-cccccf570d2c", "value": "T126832B43E9A19FB7C0866AB565AB5E300B13E9912B4F1A4A313CA7F4434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844259, "uuid": "0fdfbaf0-e90a-4150-a9f2-63d6e82510f1", "value": "1536:ClNtAyOXSU3rUk954CKmg0KfjyJCSujEaX9LmkxVqOEeofzee:gbOXSU3rUkmmbJx94LmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629844259, "uuid": "97e54b83-aa25-4adc-988a-534b8b0bba99", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629844259, "uuid": "7d66a2b6-1cdf-4272-8e20-f83909ff7dcf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629844259, "uuid": "d4ee0e39-fdd7-4109-b15f-287e5e31bbc7", "value": "21c76d90998268356aacafaa9897a609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfcee0c-0518-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629836139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836139, "uuid": "6d018a9a-3766-4ef2-b591-c7a9985eeaa9", "comment": "Malware payload", "value": "319e0e2600dd156c1ddba3c4363eac97", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836139, "uuid": "a4a79187-964e-413e-8f0e-837f95f84d61", "comment": "Malware payload", "value": "d0e3d32d1760b236d3f7c65492091a16503414749fdc0d59912c227939646229", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836139, "uuid": "ec040366-1e32-4011-a9a8-51aa48b6fe82", "comment": "Malware payload", "value": "e41146d3796169c857e8abdda51d9fabce68e328", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836139, "uuid": "3f50d285-1952-4418-8cf8-d2285076bcfb", "comment": "Malware payload", "value": "368c408d810e37fbf5f0bdb3a8ab3d965710e65c5154350c9dc46edb2e81ea12568d11b6ca07b05b99a457f1bc6a5a83", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836139, "uuid": "4445c451-8bdb-4213-98c7-f395f9f8eeca", "value": "T17EC30229D5C8962AC2D272783803B1D0CB93629DD277DE1E38DA50D1C9436BB3F58BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836139, "uuid": "558df1d1-01c8-4fbc-be00-d8d7733024a2", "value": "3072:WeBQAhNHh83WrtH8ynSlP2UUQk+CmLSZ7kZ:PLvB83+cySlVYmLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629836139, "uuid": "4d3ff3b5-2986-4171-ab0c-672b2b8a4423", "value": 120395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629836139, "uuid": "bc70cd82-2a3a-4227-a272-42b476b49855", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836139, "uuid": "3e6b8d4f-71e7-4cde-b1c9-a8c13aebbe28", "value": "d0e3d32d1760b236d3f7c65492091a16503414749fdc0d59912c227939646229.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4475c1-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629804810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804810, "uuid": "3c6701e5-e7a1-413f-9061-7332391acc2a", "comment": "Malware payload", "value": "932e2490cefa0c0aa20f769147072341", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804810, "uuid": "d025a884-3dbd-4855-8e9d-893d7ecf76c7", "comment": "Malware payload", "value": "d1094bf7440cbb81e74ff4570bf51cb3e3a397f8bebabd51a0e93c8f4a01e077", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804810, "uuid": "76a4a192-3a57-4ed5-8ba4-60770c3ad258", "comment": "Malware payload", "value": "ee2c16c0543e023d3618035260ad46d34f564a7a", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804810, "uuid": "e38755fd-a869-4990-8f58-e92243ef9848", "comment": "Malware payload", "value": "f0a43fd6ceb868491fdc32a713bd978c6ac230a7407c55bf3d4a09e20011d1c67e951749a0f077a53947faf66c718446", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804810, "uuid": "7d5e035d-b8bd-414e-b6a9-76ab8288afd0", "value": "T18122AF52F5C2C6A2DEB2233C96A549FD7718EC705C00A31B70E8B5515B9618FAF060CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804810, "uuid": "e7f96e35-2616-41ff-a020-88cb75dbe74c", "value": "192:xrXP/GNwxguq1BYoCOBg+nxmE5n0CVGYbfmNb1Jou8hiFtRYu6/:dXPUm5q12mVxmEhR6NbXou8YtRdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804810, "uuid": "b86d1d6d-5f48-4bec-a07c-d0e06a390f71", "value": 10724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804810, "uuid": "993d9c0f-2970-4702-b912-95ee089f2d1c", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804810, "uuid": "01656b8c-670d-49dd-a702-dba26e5d4f5c", "value": "932e2490cefa0c0aa20f769147072341.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cd1dd1-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629786675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786675, "uuid": "9b5f924d-392d-492a-b691-c8493cc94c04", "comment": "Malware payload (RedLineStealer)", "value": "d1dfd5c3a44785c1764ecf2f6cc6fd00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786675, "uuid": "8b7b9fd5-68cb-4d28-9bf8-2a0d54551bd5", "comment": "Malware payload (RedLineStealer)", "value": "d1a2a57dafebab240fcbd9a0106e28293d27309a6079bcdde2ab71439e070cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786675, "uuid": "d44c73da-6ac7-4134-bd32-491b15fe9f53", "comment": "Malware payload (RedLineStealer)", "value": "d55b42fef3afe812b353f7ace8d7efbeecdf8270", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786675, "uuid": "f0d4d0fd-b4a3-4b3d-9ead-0507e202057e", "comment": "Malware payload (RedLineStealer)", "value": "83b191aca134fd76333f500914c1f5e51166ae052a3b03d644c318b6c1777fc890ca8f010dc881f78cecd530ade9cc30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786675, "uuid": "b2996c72-0d04-4523-865f-69e12d0d5143", "value": "T16A74AE30BAA1C034F5F612F845B687BCB83A7AB1573450CF52D52AEE1638AE5AC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786675, "uuid": "58aaf1a1-cb17-46b3-aea9-21aa4dc62ae4", "value": "ab6a8b01372d51e7fed6c22dcfc42852", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786675, "uuid": "2055f687-1757-4b64-aa51-0941e955180f", "value": "6144:My7+4CrM0DXRRJX6P9V2q3gHnW7CvTPcONMLQnSry1ZrcbCY2rNK8FVxC:J+BMoBRl4ug+rcOhSstE2rNny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786675, "uuid": "691bb30b-5bc6-4b09-9b66-acba428c2f5c", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786675, "uuid": "120b4d34-ba3a-476a-9a0e-02be25258a36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786675, "uuid": "851a7d09-2ff9-4825-bc62-f46b78b66bb0", "value": "d1dfd5c3a44785c1764ecf2f6cc6fd00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f38b6b-050f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629832609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629832609, "uuid": "1621127d-02bb-4952-b5bb-0173eb8e73bd", "comment": "Malware payload (RaccoonStealer)", "value": "0f908a9a2d71b70b5a0dcc6012bfc806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629832609, "uuid": "12d9fded-7b68-4a92-b971-50616d4538ee", "comment": "Malware payload (RaccoonStealer)", "value": "d25a85cd78b97118fbae08bbc727e8bbd0072b3584806eef5514c33058d49dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629832609, "uuid": "a7a2eb06-2c8b-4631-8986-ddf788d41e6a", "comment": "Malware payload (RaccoonStealer)", "value": "dcc5fc9d279a4c9265ff29cd697070c330017d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629832609, "uuid": "c42dd08c-0167-4624-9f95-b190e2a83f99", "comment": "Malware payload (RaccoonStealer)", "value": "90a92e4114704c941eedaf05c666f3a192a9d87bc1fe4accbc88179eaf715ca12211a7012cc3573faea1693b914958ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629832609, "uuid": "4bf6cf31-26e7-4fc2-82f0-9e92a65afd44", "value": "T182A40281B1A0C833C16671724CC2D664EA2DB9526FA466823BF9DFBF6F351E03729345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629832609, "uuid": "f23863fb-d16a-4002-92af-3d4a7d5a57bf", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629832609, "uuid": "2a7c1cd4-1260-4a48-abb6-1ab0de126f59", "value": "12288:8AH1mY0iK4zHSZHxVtR8Qk22//J/vvgyJbwE4cF:8qwY0v47OVv8QV2//JvvgyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629832609, "uuid": "c22b7446-bda2-4b35-8fdc-7eb214b2309e", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629832609, "uuid": "0305193c-2a05-44c9-8e79-9a7a4e596d25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629832609, "uuid": "f15e1092-f2ae-4d97-b327-e2ef39de75c4", "value": "0f908a9a2d71b70b5a0dcc6012bfc806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dfe29c-049f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629784375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784375, "uuid": "fd6557f3-47c6-4da0-ac0f-42c6c06a977a", "comment": "Malware payload", "value": "d4a65ebab5721e74b21b83395e9d0a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784375, "uuid": "28afe3a7-687e-4988-ae4b-1e9fa17fcd95", "comment": "Malware payload", "value": "d360e3168f3df834111da017e9a4e272d33747f83e572fa1094582b6c0b4d984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784375, "uuid": "2f152748-700c-42f9-94b5-5054fdd4578a", "comment": "Malware payload", "value": "0071f976e74f16e3850547c9397646a14897a906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784375, "uuid": "33577f77-61da-4ce3-bdda-4d06bf7ce256", "comment": "Malware payload", "value": "1ae7b5e9ecc8c51ddecd781f06373e36de510f8ecb837865e00171f78e10dbd56219d19cd4e2714a037f9f998bbc33eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784375, "uuid": "8d07ea07-0c8b-4b1d-b988-2c3428349921", "value": "T1AE058E35BACA4B39DC33693CED9B6A5C2C357F61BE2864494BF8040D9E33A51384A1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784375, "uuid": "0eb26f39-22b0-44f2-9951-e81efa79fca0", "value": "104178b36068d7abcd0d209aa6ec0500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784375, "uuid": "972c7fd9-0f6d-4bd2-8869-8db04835cdfd", "value": "12288:B3vbnE3OJZiKAb1AIkjb/7rAOECrVpa0GGIvACwxAc:B3vr6WMJbzkvAEpz47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629784375, "uuid": "5eedda9f-772a-4174-8973-132774906712", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629784375, "uuid": "49f2cb11-30d6-4d87-978e-c3ea380c10f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784375, "uuid": "8e635126-3716-441e-9759-04c8343bfd71", "value": "RFQ_AM1004591121_004 Aoptek,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687d6d7f-0493-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629779170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629779170, "uuid": "cd1b9312-3c7f-4b80-92f9-e33c29b173ba", "comment": "Malware payload", "value": "7345a1194982254510d32fade75ac616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629779170, "uuid": "ea8556ce-2f48-48be-9003-16233a47bc9f", "comment": "Malware payload", "value": "d40da05d477f2a6a0da575194dd9a693f85440e6b2d08d1687e1415ce0b00df7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629779170, "uuid": "4a9eb0ae-0917-47ed-a142-ff05fcc42522", "comment": "Malware payload", "value": "3d78eb7b18275a826d1d9a0dd85418c40c760caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629779170, "uuid": "8cf50920-3137-41ea-8810-7faa7d689cce", "comment": "Malware payload", "value": "6196e6a50f8a9579fd92412018e32d33959aa54a713e5a70fc7174085fd38be192d66702e7f9471cae1979f5f2cd82a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629779170, "uuid": "04542d53-1708-440c-9f05-821dcf8bf564", "value": "T123E54A17F788723ED06B5A32473386D89837B66169128C17A7FC384C8F356942A3E776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629779170, "uuid": "5e549497-c9fc-4c8a-b79f-45d70943cbba", "value": "9825b4c9a35eb9a5c5e347cb9ca988ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629779170, "uuid": "ae90160a-86e7-4c8f-ad72-0c665732bc09", "value": "49152:JEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTV93338m:d92bz2Eb6pd7B6bAGx7j333V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629779170, "uuid": "02112306-18ea-43e9-a227-02a703301101", "value": 3148800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629779170, "uuid": "7333d55a-f377-4227-ad01-2c5790c123be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629779170, "uuid": "3aaab82a-59f2-4758-bd6d-e4428463ecc9", "value": "BAE79.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3e6c8e-0501-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629826506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826506, "uuid": "5c8fe5b0-a56c-4958-81da-221b4545c3e1", "comment": "Malware payload (NanoCore)", "value": "b9f29bfdedef84ef3c987240a6f16ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826506, "uuid": "9e024653-bb25-43cf-86a4-ae463133251a", "comment": "Malware payload (NanoCore)", "value": "d47feda760c21df116a2fd8efebcd862604c8cbea8b2af2adb829e32762c8d71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826506, "uuid": "7122eddc-d283-42e3-a29e-9b7beb4ca614", "comment": "Malware payload (NanoCore)", "value": "b613154bd48067d186303b3bbfb5bdbcb8a0501a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826506, "uuid": "842d36d7-b96e-4e74-afdf-3e817a4efeb6", "comment": "Malware payload (NanoCore)", "value": "7d9fc12c1db7ef0069bcf62593c9af5f44d068efd0cba8775cb7fac285c6aa917d6671c2e9b2daa16a93dbe8c1b617c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826506, "uuid": "c760f873-8957-4bca-84e0-54b506cdd388", "value": "T1D12412056B2EA0B8D70520B255AA7ADB34134D73E7042CDBA2C63E69FBF8BC65D30075", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826506, "uuid": "427bd92c-eb4d-47d3-a87d-05d522b52b2d", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826506, "uuid": "f0fcd044-0562-4fbf-b60a-d49f5f54e03b", "value": "3072:lKIdcXBReITIQSU9IQDJR3/kAZvnYZ/HqLxm1KUz11R0OFdPovgaVyaTwL4pFuEn:lKIcXvFb99IQTcAUK8px1RpHoXxVFNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826506, "uuid": "f2751516-ff48-4b13-ad16-38976357a7cd", "value": 222103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826506, "uuid": "711d0026-76f9-43e8-869f-28a269cb2d28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826506, "uuid": "382f54ee-1c39-4010-9e87-6b30f867028c", "value": "DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7bca32-04c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629800708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800708, "uuid": "07f558b9-9495-48af-bc02-31ac4a88bf0c", "comment": "Malware payload (RedLineStealer)", "value": "bb2b32c65ef894f596de3530f60ae4eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800708, "uuid": "d8c07b6d-fbdf-473b-8e77-2678cb77eed0", "comment": "Malware payload (RedLineStealer)", "value": "d4e1fe0e12967112cb8bb178cebdee1a835d469ba917b8d67c4a81427303acfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800708, "uuid": "a0cdada0-1f48-419f-b385-32cb55acbe2f", "comment": "Malware payload (RedLineStealer)", "value": "7f9ded7e51b4ac23b6a84903e19f0c61d6000280", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629800708, "uuid": "8bea8141-3807-4acb-8d08-ee62d4ce3955", "comment": "Malware payload (RedLineStealer)", "value": "3c50615d08658b617f48cce4f42fc82b24435aa5bf76be29e89a0ce879040ae485e5215f7b9e08a72d8f74bbdd2ef367", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800708, "uuid": "27a8b5fb-b763-4e22-9d6a-eb4d846c854b", "value": "T10E74AD30AA91C034F4F711F885B683B8A93A7EB16B3450CF62D51AED56386E9EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800708, "uuid": "98892312-c161-4c2d-84c1-eebda70d8cba", "value": "4dcb3c3a3fe5e134dd41266130cc79d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800708, "uuid": "bbb33201-d4e0-4b71-94cf-f295246e1fab", "value": "6144:1Bkj4hbmAj3jXuFaCxFDY9KRKeo5dzDumypx4+sUzLeXNd6xDrrMvkxo:4jIbmMTXpvElo/zDKmn/6Drrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629800708, "uuid": "a2a82582-42a2-4647-8f66-c541f8eca648", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629800708, "uuid": "2f6c8b8f-752e-4fac-a8cb-66bf5a2db231", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629800708, "uuid": "4ab4e0ee-26d2-4f2a-95e5-3bc70c4cf35b", "value": "bb2b32c65ef894f596de3530f60ae4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7968d4-04b6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629794212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794212, "uuid": "300425da-f1b0-4bd4-9de6-4991fe578fcb", "comment": "Malware payload (NanoCore)", "value": "17d98464d816a7c58f25b2e7b56d1490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794212, "uuid": "5ea248b1-a8a7-4290-9f23-e99c2b5d12ef", "comment": "Malware payload (NanoCore)", "value": "d509a80423a90cce1f81e452bc9fdd3cac58696c8607aa45ab2e41d3de199ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794212, "uuid": "0a6d0fd4-f0b6-413f-9c48-6c88bd7e732d", "comment": "Malware payload (NanoCore)", "value": "470789e4bf907bb33b81d3129cf718fae36d0d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629794212, "uuid": "10222a51-b531-460d-8b80-fbb417ba48d0", "comment": "Malware payload (NanoCore)", "value": "81969ed2dd75988db8b0aed52853c4eb25db97aaeaaec9d29ad3fd54f975c4683951178c2ff99d10242df074886eefdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794212, "uuid": "e95ae685-8d18-4db7-9ba3-c628ab981092", "value": "T11D241247363E5918CD38E0F0149B4168A677ACA2AB4144FF92193E2A3EF1BB98F35C55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794212, "uuid": "1b950294-acf7-41e6-8aa3-640df2392acb", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794212, "uuid": "f0a3ba8b-caa1-4ccd-953c-5dd358921674", "value": "6144:GV+YEF8pO1vnArRUEYz1tWDr0rOsbDUn2j:GVH+miDz+Dlsbzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629794212, "uuid": "28b8aad5-f885-470c-ade7-604a11fbf5ee", "value": 221894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629794212, "uuid": "75306a3a-63ae-4a54-825c-f098e4f52c33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629794212, "uuid": "cd0e1c8a-9d97-452f-8054-13a73b222974", "value": "doc021082394039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155e57d8-04ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629818544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818544, "uuid": "52f1e33a-53ff-4bd3-8a95-1e00f355f568", "comment": "Malware payload (Loki)", "value": "25081243d6f6e8d94e64654b89f1567f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818544, "uuid": "ad972f29-b223-4805-a640-b6155e904409", "comment": "Malware payload (Loki)", "value": "d51199aca1fc7dfc946cedb5753555b4b1464a1964cfefd947d06c208c6b548f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818544, "uuid": "08990051-b3f0-41b3-bb66-3e17c798a991", "comment": "Malware payload (Loki)", "value": "cba90f7af75752f547d0cdf3d20a9d460b7c3494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818544, "uuid": "b6a2b5a3-fb16-4d0b-a861-4a0afdef5a1d", "comment": "Malware payload (Loki)", "value": "f852cdb73299600a7a71faec7befd56a784c594d8947fa69b2a0170439699f06b22fec72ca6c2f97184d493bd1d5d7d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818544, "uuid": "e395275a-66a5-4536-88cf-5b9a29051971", "value": "T146057C3023C9C244EC1A8FF0167CFBA502F275E7B6C4CD6A16DA724C8E5A9D1670769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818544, "uuid": "5d092391-fb99-40cc-8c57-9cd0c65e81d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818544, "uuid": "7049b0f4-e1bb-4d7f-9c60-31615fb44458", "value": "12288:rWvmS27V5DMEtUajMGYRiygSHV5mLQCanLnqcct2EObbz:rRS2J5baajHYcyBHbjLnBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629818544, "uuid": "1bb0da22-7365-4da4-b02b-50e44b69cd75", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629818544, "uuid": "e89b94e4-1ef7-45d5-be9e-0e8820ca48a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818544, "uuid": "eb48ba75-5ba9-4b69-9c4d-75d0fdcf847f", "value": "scan copies.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f894bf6-04fd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1629824547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824547, "uuid": "a88aa783-6fb6-4373-8f2c-16f259d61162", "comment": "Malware payload (Tofsee)", "value": "b150f24117c407bfe4ce13dbb456b3a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824547, "uuid": "11a3c9db-524c-456b-974e-9fab8175ce37", "comment": "Malware payload (Tofsee)", "value": "d620056c5defae218de13235fc4a509d968bd55469092aa00095ff94a0246b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824547, "uuid": "1329f0d2-b9ee-4e7e-957c-3640cb99b0eb", "comment": "Malware payload (Tofsee)", "value": "1658c72e010fb925abd053f19a92f4d08e034dfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824547, "uuid": "faeeae45-e58b-41b6-bf73-979ba29f5f15", "comment": "Malware payload (Tofsee)", "value": "688e62c6c60cb291cb207b352fae0ceb99ea22285d66d7b836e57442c6c585925c2f3eaf4d95333fd4f7eeabed9d4125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824547, "uuid": "0d047157-9273-4e6d-ad6f-2d2576960dc8", "value": "T16D14CF00BEA0CA73C056417148D2CBB0E668BD716EA5864377E8EE6F6E351D0771A3B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824547, "uuid": "192e1a1e-8fcf-4883-a0d7-6c69900f090b", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824547, "uuid": "e1352d11-78aa-4cc7-ac70-c822fde889db", "value": "3072:aPGEYPwxmMqRS8b/LyA665HSPN3JQKtOgMRZafD4UA1b:SGdxlbTbc8bEcxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629824547, "uuid": "80fa0fdb-d3f4-4aff-bfdc-4ce780d0f758", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629824547, "uuid": "1f843d81-2333-45f6-8025-846076b15669", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824547, "uuid": "9e3183dd-15d8-4e04-91db-35b48dc0f667", "value": "b150f24117c407bfe4ce13dbb456b3a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a0e9dc-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629805223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805223, "uuid": "c6f2cf52-2be6-4243-bf45-8c0a76b5bef5", "comment": "Malware payload (AsyncRAT)", "value": "b07e7500c859684b478618d9167ea3f9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805223, "uuid": "370297cc-4c98-440b-9102-97740fad131a", "comment": "Malware payload (AsyncRAT)", "value": "d69cfd8665662a448ea926cd74a925b1385af55e3df4d4439f4eea8eaaceb91c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805223, "uuid": "feda9a85-3e0c-4e1c-b14e-cc8b336f90c7", "comment": "Malware payload (AsyncRAT)", "value": "c0e680d160d4d9781e9989f641fdbac0b4d00a53", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805223, "uuid": "ce3f411c-8fe9-4ea7-a3d3-77900900aaca", "comment": "Malware payload (AsyncRAT)", "value": "7519afbf44a37380e480b16e5bd8c7ad241d254708010294ca99b73b23d2d5ee0584be119ba119a4050699407d1561f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805223, "uuid": "8c165464-05fa-4c61-87c4-16110b26b5bc", "value": "T1C931BD20CF2EC4DE460261E12B4F9D274EA55F017BD8CBCA1480C904EB1E86D45FD633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805223, "uuid": "9065ed54-a7d1-43cb-b3c4-8e291a372f71", "value": "24:qV7ruZ39Kp9Wp3Geq1qHT3WeU0exege0eY0eqveWjyekWei/eAC+:e/4t1p3Geq1qz3W0exPf70ZvstW1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805223, "uuid": "8b1e6621-d069-4048-95d0-257416d99847", "value": 1581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805223, "uuid": "30382540-5598-4067-809f-9f45c1622bce", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805223, "uuid": "95d0487d-8bf5-4467-b9b6-e7ceb45a64ec", "value": "THGKCS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd03053b-04e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629812436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812436, "uuid": "f20f7a30-ba4b-4273-acb2-6ed4ed58367d", "comment": "Malware payload", "value": "3e27316f8d7dc7de827a3efaf9c7ea12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812436, "uuid": "7eb8efcd-ceb2-4140-b858-f8ca73ebcec4", "comment": "Malware payload", "value": "d6dff5118d406d4e4c9ba203af253c4a6e5a18683e466a6d4109d75c7307554a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812436, "uuid": "198bbbe8-3ff4-4787-85a6-91394fbff44c", "comment": "Malware payload", "value": "f14e91ad1c5f71ac1c14b72e14ea85092ba49762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812436, "uuid": "b9d009e0-4a12-41c1-b9a0-4f29b8c39b25", "comment": "Malware payload", "value": "a1012963c6fadb5f3a7c35d51428ba3b2596ad82ac442de3b2c8e32bb48c9db78754677ee5ccf751240217e554cd2699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812436, "uuid": "d94f9e21-7768-47af-abf6-cc09d25ba908", "value": "T178A5331D1D1A032AE6A386B802B6B9477561919DF63DC022FE6F361DDC26F270578BF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812436, "uuid": "1a164f9c-d844-4e27-909f-80e90b9ff86c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812436, "uuid": "312a382e-e1e8-4f32-99e1-9620b869ca38", "value": "49152:rU7FHeoayZsPQZG6P1iKcF6KQek1Kun51paGIHoocUWGMC:4eMZlsfarKunTpaHHoocUaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812436, "uuid": "bb585d54-e9f7-42c1-a7ea-50eb73c1fcdf", "value": 2172928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812436, "uuid": "31823192-2d16-42b8-8368-0252fa242b63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812436, "uuid": "08061679-e330-4703-8daa-9fb5e53edf47", "value": "3e27316f8d7dc7de827a3efaf9c7ea12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448a799d-049e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629783834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783834, "uuid": "c0e84538-c139-4691-abf1-fa2206aab29f", "comment": "Malware payload (RemcosRAT)", "value": "9362b9c45f484234acb2760f19666e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783834, "uuid": "45ee2ec2-7386-480a-98f8-08f317fa1039", "comment": "Malware payload (RemcosRAT)", "value": "d89a39469a38c622ff6d1c36603491bedfc5d5dcc92cf629aa50057eda35f563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783834, "uuid": "af287d74-e1c8-4c17-8fab-4806904b9fbf", "comment": "Malware payload (RemcosRAT)", "value": "8cfb13742b157322fc4ab01b4c164a5a6eb35634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629783834, "uuid": "4f19cd73-ed3a-4ea0-86cf-aded1793e415", "comment": "Malware payload (RemcosRAT)", "value": "ef575dc74c47a2a0c5e2a94c9e81575e09085cbac1e886c666cbbf3cf5f8497b9136f598ba4e3c28d4a112c44f136ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783834, "uuid": "ad8697b1-4d3f-40cc-846e-8aba304bbcef", "value": "T18D05BE66B2D2BA35C4372C79AC7BBB683B357E1125B019517AF6294C1B3D3013472AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783834, "uuid": "a760c05e-85dd-4511-9efe-aad687c7c14e", "value": "104178b36068d7abcd0d209aa6ec0500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783834, "uuid": "2aa3efbf-5cc1-4cec-a1cc-dae2b47ff293", "value": "12288:A//jvndsrOuazS6eBY8lYvbTLDRPH9HVuVEEGIlV8YXui0agFV:A//L4NZpPYD9PXuKa/8YX/0FFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629783834, "uuid": "e7c24905-09f6-4c6d-8a1d-69c0db4772b4", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629783834, "uuid": "ecf89d27-c86c-4b01-b2a9-03068bd90c2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629783834, "uuid": "6da9d058-1a2d-468d-9551-193ddd5b4ead", "value": "RFQ_SMC14416 Nuevo pedido,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1136144-0534-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629848494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629848494, "uuid": "cd9f3cee-07f2-4bb1-9c1c-72dcc33b4a52", "comment": "Malware payload (AZORult)", "value": "c0facaa9561e361afe9d92d38e2793a0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629848494, "uuid": "0efa2d52-ed8d-4603-b9a8-7033d035b7f7", "comment": "Malware payload (AZORult)", "value": "d8eb6d3fe02a890173827c242182acd22aa699e4bbd918fd22b95c00aa3a6445", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629848494, "uuid": "d5a5dcbe-9b55-4f6c-84a9-338493128566", "comment": "Malware payload (AZORult)", "value": "135c63fbf3659951888c74dde12df75575664eca", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629848494, "uuid": "68eec660-89aa-4afb-bfbf-a45431d6a9d0", "comment": "Malware payload (AZORult)", "value": "94b8b301119db77720298f06e358fdc954e0aa138b232627f543d3e66734cdf5db6870d203621e68f1ad7a5780497ff4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629848494, "uuid": "a8a45143-32a7-48e9-8e4e-0d4f84b6b576", "value": "T10F35120654B44DA2F05A0AB51AE2C9F44B3BEC2351529D0B7786BE0A19B3BD77CC0B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629848494, "uuid": "3f8e51a8-4b29-4a34-b437-df011cd9cc6a", "value": "ca357d1c9b605d95e9d31e67e1c53033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629848494, "uuid": "a61efb0c-251d-4be4-9123-abf7964b6f0d", "value": "24576:nqqPzCBX6k4NCC0pOVXPbhH4DZ0XscH93EyLvWvfwi4Zm3:nqqGkRkCNFhH4DZ08cH93EyzwolZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629848494, "uuid": "7f92cbd2-fc7f-4941-8052-db3255fd91a0", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629848494, "uuid": "25c13933-e781-4f1c-a604-4738c5547b5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629848494, "uuid": "32d6c0c8-8be0-40b1-939a-0fdfb2696e7a", "value": "C0FACAA9561E361AFE9D92D38E2793A0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c410039-04a7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629787712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787712, "uuid": "5ab28555-ed3e-45e8-80d7-db51daf9e31b", "comment": "Malware payload (SnakeKeylogger)", "value": "7998165d0db2acc29c72e4ea081a1f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787712, "uuid": "561d923b-e036-46d7-922a-e5fa1e1f474d", "comment": "Malware payload (SnakeKeylogger)", "value": "d8efa6cf84ac542a7bbeebf0e3962a676be0ddfd2bee442576607928c1b8b0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787712, "uuid": "b8dd7022-a7dc-4516-bbea-d188af11ed51", "comment": "Malware payload (SnakeKeylogger)", "value": "7dd82119edaf9da3f35b56c63f17bb6225ef3e1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629787712, "uuid": "48a6c7f9-a94e-4256-90d2-e8ed72ecdb89", "comment": "Malware payload (SnakeKeylogger)", "value": "21af48c0b426d326aa7295af26270b0a5dde5899626520654890c7f9421b230f3633def13c3394653474d0721564a972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787712, "uuid": "1b29b9fd-b79e-45a4-bc01-b71d9e10ca8e", "value": "T161158C3063C9C284EC1A8FF0167CFB9502F235E7B6C5CD6A16DA724CCE5A9D12A1764B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787712, "uuid": "334e841f-e51e-4981-bc1f-e265d9072fbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787712, "uuid": "3fa312f6-fd43-4d73-9156-7b56b73889c1", "value": "12288:CXcsGI/cl1qIU8gFPOJxxPFAsjHf11YxmbgkFemZcbyyhW5qF12EObbf:C8QIZx9j/11HgDmyb85qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629787712, "uuid": "2bdbfa5d-d558-47e9-80ab-1c9d9ec2f810", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629787712, "uuid": "65528763-66bc-40fb-ad97-9c83d7577c7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629787712, "uuid": "26314cae-0429-42ad-a735-f30f9cc158d7", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8900b1c-04a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629786203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786203, "uuid": "5cdd4f2a-6402-4297-9f9c-72879a02a788", "comment": "Malware payload (RedLineStealer)", "value": "73ca4c10afa6a3f712facb40aa8254ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786203, "uuid": "1e2d0d97-0a13-4f1d-b966-09335ff925ef", "comment": "Malware payload (RedLineStealer)", "value": "d8f723849493f85b6bd44cf8b94261f30ff26fa3080d5e53b537a5eacfdd873d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786203, "uuid": "3b365381-7220-448e-b85e-79ef9fc7aa4a", "comment": "Malware payload (RedLineStealer)", "value": "ad824606d6c465a46296b736e8fa116bb67309a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786203, "uuid": "7da980b6-eeaa-4ad9-aa74-f3f5ad8081b7", "comment": "Malware payload (RedLineStealer)", "value": "57af6bac1f62ba77b17f65fcd4680d655f11089424369781382930eb2bfa2b6f28db04826fed35d639b0b7344e972d9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786203, "uuid": "0ecd6e02-c2c6-48ee-b421-bfa11d2ad770", "value": "T12A74BE30BB91C434F5F711F854B6C3B9A93A7AB15B3050CF62E52AEA1A647E5AC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786203, "uuid": "c7392582-02df-49e8-af2b-9babea9eb287", "value": "c3357f55d714ba99dcfee6966059bf12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786203, "uuid": "6b38858b-1893-4043-a1e2-3571342739cb", "value": "6144:W5cg4yf/CHeM7JSjrkIKN3xyGUyOxDIjl+WMIzgjnHwpR3G8WhQg1CM1SzQf+:Tgffa+Mt1zhUBxDi4WQHxJQwZg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786203, "uuid": "cc0b6fb3-9908-4cfd-84b6-8e7dd8ee1bbf", "value": 367824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786203, "uuid": "96ec4cee-f41c-443d-aac8-e245cfe8ca0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786203, "uuid": "3435307e-99b4-4289-b253-78427a01e22e", "value": "73ca4c10afa6a3f712facb40aa8254ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ea207b-052d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629845439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845439, "uuid": "230de3c8-659e-4581-8c4a-82c95dd7003a", "comment": "Malware payload", "value": "92d6baf79e990130a1db2175731d4e46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845439, "uuid": "563d559b-ec5e-437a-ac70-3f5ef7f423e8", "comment": "Malware payload", "value": "d9fa9a6d2f94da43ceb1e54df2cac4e099d6700ad52db757e5cbbece821e73d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845439, "uuid": "438b7f6a-344e-471a-bcd4-c3ed7b58b95f", "comment": "Malware payload", "value": "db9efd2c26760ce555c1c31ca8d80d1731b26771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845439, "uuid": "44725369-4157-4b0b-859d-316f2c2a02dd", "comment": "Malware payload", "value": "3caaee74181d7fc624c194ed289abddf80293bc933bef92165082796ae4200e3c12a34966ba4b9cb6a43244d0e2c6055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845439, "uuid": "59ae04c0-92c3-4c5d-9b6f-bd0a6b46fb5f", "value": "T16CE412881AE8553BC93DAD7CD0A6AB41C2F0C0A55283F3267EC8DDEE97857C81745B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845439, "uuid": "03530be3-151e-4e21-a8a8-545aae5ef60a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845439, "uuid": "2025f168-5162-4893-87cc-739cc9a417c4", "value": "12288:PsIi50Ynk0H5sQH0YDMr1se/fRlA6EiNxcBO3XF02kLxEz33n5+mEJqyOx4:PtiKY/OQUwekXCcBmF3WS3Jta7O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629845439, "uuid": "affa43e4-c43c-4522-93a8-e0e2186009e9", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629845439, "uuid": "6207fce7-df72-4877-94a7-58d741b85538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845439, "uuid": "a3486097-0ea8-4d3c-af50-1bb06ec03b50", "value": "d9fa9a6d2f94da43ceb1e54df2cac4e099d6700ad52db757e5cbbece821e73d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3238eac2-0498-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629781226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781226, "uuid": "175b1924-f2e6-4e46-b738-2291f479ec5e", "comment": "Malware payload (Vjw0rm)", "value": "6c8cb6d8a307774cdd5229cae0a74fa2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781226, "uuid": "db41f8c0-e708-4e57-ae6f-1dbc5e24b1c3", "comment": "Malware payload (Vjw0rm)", "value": "da60503512af869134e5698522fd48d794e650e0749feaf07d120b17f4cccd73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781226, "uuid": "3e980b26-a05e-4b59-93ef-e82119f7d377", "comment": "Malware payload (Vjw0rm)", "value": "1dae1ca15bdc9eb2d3250f45b612d852c7caefda", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629781226, "uuid": "4fadc48d-0862-413f-b6fa-e17d845c6b4c", "comment": "Malware payload (Vjw0rm)", "value": "0066885b07d34c6bcbe00eeb2ef16560e2e70971e0ba2b5cb7dadc213c4af5ea580995488c7d9e06d1906a12d73dbf07", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781226, "uuid": "fa30faf3-8b48-41b3-8481-a1db578c9054", "value": "T18A7283882ED5A35817B1D43F29AB708AE159DC81F98C4D68E318F4B4FDC4B06D1B7BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781226, "uuid": "c2d2790d-a533-4527-8ca4-ee12212e82f7", "value": "384:s4ws20zJwYx/HaeXI5wRYVShCGO5WJFHuBUlxa:sR0l7o5+8GJJ/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629781226, "uuid": "b458df0d-17ca-40ff-9f2f-b461789d33c1", "value": 15978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629781226, "uuid": "11568eb6-ce48-4589-b11f-23ac04a1b252", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629781226, "uuid": "72376102-8997-47f4-965c-226089476c67", "value": "ISO certification-0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99364f1f-04a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629786982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786982, "uuid": "6f0caa92-24bf-4b29-9c29-83e9ea060d37", "comment": "Malware payload (RaccoonStealer)", "value": "1125affa1b6019121459177922270303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786982, "uuid": "cca90292-a2ff-43da-b588-be5669dc170d", "comment": "Malware payload (RaccoonStealer)", "value": "da8777fa1ea919560e5fd0fcad56f265546fa9fa5e061776705da8a79ec1ca7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786982, "uuid": "428b1694-0110-4178-8e91-eab68b39056b", "comment": "Malware payload (RaccoonStealer)", "value": "a636964f8b268b8fb29840f0b3efecee05e66b16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786982, "uuid": "a997d356-f1da-409b-b383-3d693efaa489", "comment": "Malware payload (RaccoonStealer)", "value": "a0b2bca6e027cc745a65cd288474b38e8c7a5bf92495ee298cc42e918d21d47f2d958bc9f9631da91e67e9aa12f8827b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786982, "uuid": "d4ef5204-8567-4286-a1bb-a513c839f0b3", "value": "T1AD45493D19FA1637D1B5D355EBE18423F149986FB410AE696CDE03A7030BA8735C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786982, "uuid": "c15ee521-012b-41a9-997f-f485a43e9daf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786982, "uuid": "ff4d676d-20b7-42ad-9c06-2094f2b2bdb5", "value": "24576:1MHKTBl0ZwUgSasNSeBFTmgwcPFHw80A7E/T8i9372I:WKTB2wlS/NTTmgwcPFQA7iIi937j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786982, "uuid": "e10b56b6-7821-4a7d-b5e8-0ef87cb00c74", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786982, "uuid": "2549c6cc-e03b-43e8-8db9-e0b072062c7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786982, "uuid": "2723a000-c63f-4dea-b5de-f5512d650f81", "value": "1125affa1b6019121459177922270303.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb6e56c-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629805054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805054, "uuid": "981713d4-e027-48f1-a1ad-8f09034e4fe7", "comment": "Malware payload (AgentTesla)", "value": "1c5a11bcde0ae2e57df453a8bf58f3c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805054, "uuid": "49d61a9e-5a4b-47ea-8e6d-3de931568f25", "comment": "Malware payload (AgentTesla)", "value": "db2b922912610e779cc7e06e262f4b23a00950dce0bf4152a4ce87fc4dca992e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805054, "uuid": "eade4edb-aae7-42d1-add7-799e51cdc5eb", "comment": "Malware payload (AgentTesla)", "value": "b4cd51725dc33d7c628579ea828396ab743da18a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805054, "uuid": "352e5b03-6898-47eb-a7ec-b131bfbe769d", "comment": "Malware payload (AgentTesla)", "value": "7f265f3ca32cc6bdfdaefdc97981d6e62bb1882839dccf5dfadd91d1f325ba6644036ab91b5035c4692ed4c169963d8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805054, "uuid": "6d4c51a0-8adf-4e77-a807-015ebf63daff", "value": "T12A341209B766985AEDBAA07C51824408267F3F63B7040FC2937BF7AB2CB4E5485F1718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805054, "uuid": "76b23013-5f89-457a-b274-8690dc9de5d0", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805054, "uuid": "e773c34f-a85d-47b2-ba1e-db6c051456b9", "value": "6144:D/qnfY++bQsUrv68utaZXYiNRgK6cBCoMSN4gdVISRn:DCfHA3Uz68uceO20fP4gd/Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805054, "uuid": "376db4b6-5e5b-42de-a72f-249ffd8b0196", "value": 234967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805054, "uuid": "f35d5f6b-b1c1-4b5f-9672-d035ba5c9075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805054, "uuid": "55ab6592-27b4-4117-921d-491afef6380c", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716db6a2-0470-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629764152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764152, "uuid": "1919202b-a9a2-4cde-b89b-417bd2e9c01c", "comment": "Malware payload (RaccoonStealer)", "value": "c82528b8a7642c9f68cbe6d9b84e5fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764152, "uuid": "527e619a-6950-4f8e-aa4f-63617e57806e", "comment": "Malware payload (RaccoonStealer)", "value": "db99c0aef3016fe2ea6d3172f4493775270a13a177af4ce19a2c56fa95096737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764152, "uuid": "a28a5b5d-a6c1-437f-a04e-7f898861068f", "comment": "Malware payload (RaccoonStealer)", "value": "2bd85d40e3c6e2fa47481a411d50719f024f48bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629764152, "uuid": "c10d4791-b0b8-41f1-b686-eb288f74352f", "comment": "Malware payload (RaccoonStealer)", "value": "998fe1106c050065fd9af3a3c63bafa5f4cf8256fffe13cdc554005a2c512b9ab28aead69020aca7983b064537474740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764152, "uuid": "699df66a-8815-4733-a86f-63856d5d27ad", "value": "T14B941221F9A0C1B3F04297314DD6C3D0E62AB9A15A36127B37ED5E1E1F62391762633E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764152, "uuid": "fb072b26-b6b8-4524-a453-61a60cf38bab", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764152, "uuid": "2632d3c1-255d-4dbd-9431-472b3323034a", "value": "12288:Wa3D6eQWZhdC1lh0eD4/vdZFXqOss3/7:WuO+D+/0fZVxP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629764152, "uuid": "40ce7037-34b3-4560-883c-7da901594fe5", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629764152, "uuid": "008bcf16-f559-451f-b419-8de6a7147443", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629764152, "uuid": "590686f7-3c7e-4c2e-baa7-2b5a118a5cca", "value": "c82528b8a7642c9f68cbe6d9b84e5fa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c1c2ca-04c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629799940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799940, "uuid": "e8ed8e4b-15e4-4cf8-afb4-fb825742b424", "comment": "Malware payload (Mirai)", "value": "c9b18e40e7a1df539f1e4bc9b4769afe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799940, "uuid": "088b5cd0-7c48-40be-ac3c-cce8eb59f1f1", "comment": "Malware payload (Mirai)", "value": "dbaf83f6c7041f80cf1d35cf34cf9316c4041967f86729d7322a9ecfbefdf452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799940, "uuid": "c50c395a-ea7a-45ca-9a86-0fcdbf7ee81d", "comment": "Malware payload (Mirai)", "value": "cce9e8460513b4f9fe43bdafb166cb543d8cb3ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799940, "uuid": "1e48ed18-f60b-4f06-984f-d49100a0117f", "comment": "Malware payload (Mirai)", "value": "c30e0409dc89585203afe1f307abf325a778734747840d3031802e10cc6ad4996b72cd62e7100fb531c72d46bb59fafb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799940, "uuid": "6b00f8ce-f764-4636-aea1-2ad5fecc74fd", "value": "T15CE2F136C056B75183B42DB6F7B12DA72F151DBAE0073269A178DA3CA0B1A4F836A143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799940, "uuid": "72b33cee-0116-4008-8d01-ec3889fd5332", "value": "768:2eHlHk29rbDTcTJQsr7FsZypqIws2qY5mrrii9q3UELCw:2eFHzVfgTW8JsZiws4wrsL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799940, "uuid": "fa3fee95-0018-493f-a808-4b5598aa1dc8", "value": 32188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799940, "uuid": "1fd5a916-828f-472a-b1b3-1f7cb2170cc3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799940, "uuid": "8e12278f-c80b-4e4c-a6ab-3dc95105c457", "value": "c9b18e40e7a1df539f1e4bc9b4769afe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba534df4-04c0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629798634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798634, "uuid": "fed12cf8-9079-4438-89bb-d89c6a15ef33", "comment": "Malware payload (SnakeKeylogger)", "value": "2c94dd555d927ad1bee732c64d4dec5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798634, "uuid": "0e024e94-b938-455c-82e1-6a4eb3f0be3c", "comment": "Malware payload (SnakeKeylogger)", "value": "dc157362e9c0469b3d8909770c5879a1e5cbaa6ae5e0d8203c536cbce6131901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798634, "uuid": "5dd76bf3-3df0-4e6d-ab10-86568ada7a4e", "comment": "Malware payload (SnakeKeylogger)", "value": "1f8faf2cd27eae38ed505998ceaee96674df8332", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798634, "uuid": "78c98e8d-3708-4c8f-9b81-f03b45ba78a7", "comment": "Malware payload (SnakeKeylogger)", "value": "6e7be9017250f33d89cddd315ede2f367c1b2e4de6ad1b0c1d906beae809963312e094f67a2d9dc45b6919f8221f246a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798634, "uuid": "5702a946-1dc8-401a-8dc6-7b195b36fc22", "value": "T1FEC3181D3BF88804E6FF8A7305B25120C7B6F851195ACE1D1AC1F95A3A7DA818D1AFD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798634, "uuid": "d80500a6-ac24-4e6d-aa11-faab75847408", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798634, "uuid": "c82e6bae-650e-43f5-bb41-39e2316f9ce9", "value": "3072:NQyVffZ79CXBzek8BYbCH/UfBwBXknbY:Ziskhbiyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629798634, "uuid": "3a16d826-f00b-4c95-8b82-b6f7dd9c6ec0", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629798634, "uuid": "467f3353-15d7-4348-adf3-65b5b8e5c6f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798634, "uuid": "efdbca91-467b-4799-856b-90ef6339dbcd", "value": "03_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d08cf5f-0491-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ServHelper)", "timestamp": 1629778265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778265, "uuid": "0c0452b3-2045-4b58-b337-fa0ee60956ca", "comment": "Malware payload (ServHelper)", "value": "a6d47e21e6372b85a265bfd07606c4ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778265, "uuid": "4bb7257a-2d3c-4b5a-a781-4a08a40c4f16", "comment": "Malware payload (ServHelper)", "value": "dc1ae0bd13880962598783520b2f445292c4274b0d815a225012a1984d99ab9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778265, "uuid": "16e6ca2a-b982-408b-99c4-2accc73a2622", "comment": "Malware payload (ServHelper)", "value": "04568a77eea7176b146c0c667176c25f98b31f2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629778265, "uuid": "063eeef0-0ba2-475f-b410-6541fc4c30a6", "comment": "Malware payload (ServHelper)", "value": "f90d9ca30dd4e2ddc904e200081fc67457c600cd4135fa2f63466b9f9836930996f453f29fa4814a67ace7ceb6faf49c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778265, "uuid": "d150c8ac-c21d-4e5b-a748-f30168398ce1", "value": "T1C1A402207583D932F095413684B5F6E144B9F992DA581707F6603FEFBEB07D0A22BB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778265, "uuid": "9191b101-68b9-443b-93e3-a23eea8fe26f", "value": "eb816bdcb34642ae497d2f004d3c6914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778265, "uuid": "af05c985-cf34-45db-9f8a-01e23b21ed39", "value": "6144:D06y7OZetU/Bxw95n/7ffLm9PMvIU1j3UhETh6VAprTsxyGLZ1Zl88Yl+gKDEnE:Y6yaBxw95TLm9kAekWh6Vsg91Zl8j+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629778265, "uuid": "d2a12b43-92a3-4280-8a1d-d749a1cee5f6", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629778265, "uuid": "0ab50658-9c8c-4226-8b68-5460d6030c6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629778265, "uuid": "7460de4e-0230-4f8c-bb12-988915e26a26", "value": "A6D47E21E6372B85A265BFD07606C4AB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddc22a5-0487-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629774105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629774105, "uuid": "fe3b9b56-c6f7-4514-bf74-b26621cbfe96", "comment": "Malware payload (njrat)", "value": "8e8249d4ebf2dbec1bb388b88734d300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629774105, "uuid": "1ef547d4-7f32-4e66-b5a3-411f6f8ef855", "comment": "Malware payload (njrat)", "value": "dc58d938e8f68fef1af196256367de389e651f5db9b7e6ea6a64dde018d6bb81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629774105, "uuid": "2500b974-9320-457a-995a-e3f41dfbe336", "comment": "Malware payload (njrat)", "value": "5067fe1a24f7e4d1411b56cd37c135e8618b60fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629774105, "uuid": "6e738f79-e8cf-487c-88d0-26d073136872", "comment": "Malware payload (njrat)", "value": "39f3c52dfe1a4cb2cb618a2505c66a0d1b07a6b4d1c55b0e50413dd58c810f743c14b4692fa25bc4d3c0ec8a14948d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629774105, "uuid": "0b8b874a-7cc8-4b4f-8731-d218d3ca678b", "value": "T140E24C0F3FB8CDA5C9AC17B495669A1003B091470823DE2E4DC568CBAF736D96E4C6F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629774105, "uuid": "13cf5545-0b65-46da-8fb3-1167d5020b31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629774105, "uuid": "bc35bbd4-7d6a-4867-93b0-8d37a8505420", "value": "384:8cqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZ5R6+hR7Rk:b30py6vhxaRpcnuU6+LhpiyuBhY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629774105, "uuid": "022c0a12-a83e-4f42-889e-1d00adc93e15", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629774105, "uuid": "9c0679c8-1328-48d7-bee1-527de36806a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629774105, "uuid": "71286a39-270d-4ca7-88ed-3d7ec6d4f71c", "value": "8E8249D4EBF2DBEC1BB388B88734D300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40302a05-04c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629799718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799718, "uuid": "c221490c-4ec0-4ea3-88f0-48d19e8ab680", "comment": "Malware payload (AgentTesla)", "value": "721d36cd31987e0e397b72f63d89d772", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799718, "uuid": "454957df-8584-4f15-be55-40be5380564b", "comment": "Malware payload (AgentTesla)", "value": "dc5e77b6763a1088ca179df3085bc33ddf121689a75ba87720e1171f17b1cd6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799718, "uuid": "7e1081e1-fdce-41ec-9bcf-f839ab496ce0", "comment": "Malware payload (AgentTesla)", "value": "01f2a54585c7b84e1843b3d18909de4f34961cab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799718, "uuid": "b5001c7b-175d-4be9-9793-cd3c6341dca6", "comment": "Malware payload (AgentTesla)", "value": "0172fdb08b537b4c092212cfe0cf8c09718ff2dfd125b448454cd31a2abaf6cd700cc38fd77a22cd2b6740cddda6bc0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799718, "uuid": "2408af57-efc6-4548-bf71-a7951062364c", "value": "T1D6947B003B986A6BF135D6774B57C23682B24ADBD1D5D740CC14E3AD7A30331AE89A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799718, "uuid": "4fe7f3cd-3f9c-45a3-b9f5-17d70263624e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799718, "uuid": "8191c4e1-9ac3-4d65-bda0-3e107b1549b2", "value": "12288:9GCKnlfgGTc7eMGNKA4P1EBE8Y4eOms21Gr:9GCKnlfdSKwLP1z4q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799718, "uuid": "a854fe0c-45bc-4330-bcf1-70a3da5fa6b0", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799718, "uuid": "a14acdf7-1e7c-44e0-9c4f-961aca491a48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799718, "uuid": "3e8518ad-101d-40e4-8d46-77cfe610df55", "value": "01_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13be654d-04a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629785470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785470, "uuid": "50147dd2-de63-4270-908b-0b95b40baf7b", "comment": "Malware payload (Loki)", "value": "2fd4775adfa08cb75fc10a437c38b4ea", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785470, "uuid": "fa67249e-8fc1-44b7-839d-061735867147", "comment": "Malware payload (Loki)", "value": "dd004cbd296a41adbf57ff1fa6d76246275d5318c5eb410670745813a1fedc9d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785470, "uuid": "5c45686a-03e5-4e6f-9858-4ec7aab1d2a5", "comment": "Malware payload (Loki)", "value": "01e7caf6665b1bc32fff491c83cee92be93338a9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785470, "uuid": "859365c8-bc7a-4f42-92ed-86e65f2f5f50", "comment": "Malware payload (Loki)", "value": "5373d249f8ca36f4411c6879094412360ccb952927f79078659968ddac5216f27917f0d415d7e7549a7566ae5f7bc16f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785470, "uuid": "7110bb0b-c954-4d32-bc34-205a4574b4f2", "value": "T1D44513E86981BEC8F40384BB1C026C45911F9F6B3E458423A7547BD92CB9B716DDFA38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785470, "uuid": "ccbeec99-1631-47a7-8cbf-b8136f1e6591", "value": "24576:zWOgpLUlAOlSA30/q7ziqXHFbZyGJUV755H15x305ESBnKtTQ9kIgW0I4MF/iGHF:zDgpAlAOIA3oqy0mTGESYS9Iu4y/ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785470, "uuid": "2afe17a5-968a-42f8-bcce-8c944645b478", "value": 1237608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785470, "uuid": "2b46c4a5-5a85-4de0-bb04-c5b7cd245bb4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785470, "uuid": "e601159d-9100-40fd-8124-34f292370d3d", "value": "shipping doc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27b0cad-04e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629814486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814486, "uuid": "7e4841a1-787b-4eee-8d29-a050cac35135", "comment": "Malware payload", "value": "f2c672c2db12a7e35aafc60aca6073dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814486, "uuid": "c47bc94f-0fcf-4a79-8627-fc739c8a2813", "comment": "Malware payload", "value": "dd86c917c4548b4f27cda37e46cf981f0b30c3418d6b5a4e48c1a451e19b72e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814486, "uuid": "bcd0cfcc-bf4c-437f-8726-0ff0327f41b2", "comment": "Malware payload", "value": "d73fb76786e84327107ddbdbccd74daf4d836a36", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814486, "uuid": "cbf9d58e-2740-4b74-a331-d8faa6c579e0", "comment": "Malware payload", "value": "3410e15f62397d9d27530687a0daf81cd11fd9556c7b78d1f56abf617d22abf0acc6e535ffcc03848fe80527ad12461e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814486, "uuid": "b6c1e118-13fa-46fd-8ad7-a9ddac15453b", "value": "T1B0C2F1D118908FE9DA3C4B7011E700E2305BA6144BA7A76782A08DF87BBED995EC3790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814486, "uuid": "a8bbdff1-a5cc-4a81-8322-37f1e74ca04e", "value": "88c4865d3b20090a83f31e66a2726ef1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814486, "uuid": "cb721002-54d6-407b-89cb-c2f28f97e8cb", "value": "768:3Xll0rsDKAd6iWpbMM/E6TtCZbCEtmDI8Xjee:3Xz0rs2m6VBM+LMTm/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629814486, "uuid": "b31e2def-cf20-436f-9993-c3b8b525c178", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629814486, "uuid": "04c631c6-8eb4-4703-9313-0fdb50684641", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814486, "uuid": "ef8f8e2a-9233-46e9-ab90-373bbc7512b9", "value": "dllt3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56adf32-04b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629795190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795190, "uuid": "92d70d63-f4be-4310-ac5c-b7df1464b7ef", "comment": "Malware payload (AgentTesla)", "value": "d641c84420db85b7a773939d46b281a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795190, "uuid": "2883f133-170a-479d-8f24-60594f70aa50", "comment": "Malware payload (AgentTesla)", "value": "ddd3516af5803b6e1a58e7eb7160f8ac9cffd4036db6610ab0a74ce6a3dc0af9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795190, "uuid": "4e935f32-cab3-4010-9e20-02ec20094feb", "comment": "Malware payload (AgentTesla)", "value": "7e5730fd4e977a4b2bd62f968244f304ab43a3e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795190, "uuid": "1d375e0d-0ab5-4581-9c7e-eb856f9f2ac6", "comment": "Malware payload (AgentTesla)", "value": "bbd071c562d699e7a786b63c52b858f76850d63fc6f63e82e72e13e272196e9080f9d5874ea9a3c7f083bb45c515c930", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795190, "uuid": "517805c4-57eb-4ab7-a0b0-5894c56f371a", "value": "T1DC259D706389C294EC1A8FF0167CF79402F235E7B6C4CD6A16EA720CCE5E9D16A0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795190, "uuid": "e68f3ded-c74e-4985-befc-b583499572a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795190, "uuid": "3d142e02-ce30-4978-9220-a4107d08c5dc", "value": "12288:1xcsGI/cDpJAyzD14hVHQcbMhpazbtiPFj6LbN2p30XpIYlrXdG8VP2EObbE:1yAyzD1+JQcbMXw0P8PN2GZIY5tG8VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629795190, "uuid": "e3bc0a79-d07e-45f1-a1f0-0a49b47e1b28", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629795190, "uuid": "38734cba-0c22-41bb-8eeb-4494e5d70c92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795190, "uuid": "29c809a1-8128-405c-b85d-56a5f2081f88", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DVA.genEldorado.24648.20797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3f9943-0534-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629848167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629848167, "uuid": "7be133b6-4c38-4c79-b00c-5abf827466ef", "comment": "Malware payload", "value": "e5296651d1257b749a73154612201b32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629848167, "uuid": "25d2ef77-6a61-4715-bbb2-273b9d1e1e43", "comment": "Malware payload", "value": "dec159a766ac7dd06c32494caedac0fc8abd79d588ff347dac8f394fea760c6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629848167, "uuid": "96203626-12aa-4941-b728-c1c6fcfea551", "comment": "Malware payload", "value": "ae4d20b94f89ebfa5de473aecd2fab69e72273b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629848167, "uuid": "6ac1298e-d83a-4b99-a83d-32314847626a", "comment": "Malware payload", "value": "c2fe0928fbad34f02be44f59cb80f8acc7005ada06a75bc4676436a27afbf00808592add5ce6e85df99bdab7b22a9e99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629848167, "uuid": "782a94c9-5f6a-45a4-aa40-59f1bdc6ada4", "value": "T12086331982933535F3C083B05D32A57874772FB189AE5D5E3ACDF9946B3A3E8E05A0D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629848167, "uuid": "cb1edd2a-dc32-4fa4-8e6f-92a4ecec6355", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629848167, "uuid": "6ff1d533-59c1-4d40-9760-0e6b659b29e4", "value": "196608:Eqc+TjDFupRl5ckPwYPDIbrKgeU9aHRQB:EdeFuJ5TPwYrIbrKB9RI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629848167, "uuid": "d717ea69-bde2-4cf7-9138-6d7618847b8f", "value": 8087596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629848167, "uuid": "d6c5d6af-aaa6-4083-8561-131f6068e71d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629848167, "uuid": "073d60ca-cb66-4bf1-ad25-1729598c406c", "value": "e5296651d1257b749a73154612201b32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be78fcb-0520-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629839815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629839815, "uuid": "992f3d8f-c465-4f1f-892e-53464ef81a9c", "comment": "Malware payload (AgentTesla)", "value": "40fb542ca46dbdcfe9ae934aeec0a8c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629839815, "uuid": "5c7780b7-ddd2-4156-ac1c-fc78ded1e554", "comment": "Malware payload (AgentTesla)", "value": "deeb5dcdd0c7e025bcc044147c0d3c8b959cb791a169a9d57a02162353362a9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629839815, "uuid": "e9daceb1-4404-4392-a3b5-688c4284aae8", "comment": "Malware payload (AgentTesla)", "value": "b93b4ed17fea50cebc63803e8bfb5bd5be6d2348", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629839815, "uuid": "b50afc60-870f-4b7b-88cc-84243fbe0311", "comment": "Malware payload (AgentTesla)", "value": "ee3c6e604e66cfc44aa9cab677e630bb28551d48d3bce99c9dcfec51f0f0d2a024d84bd3011bb904a325858da06d549d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629839815, "uuid": "1fa226b4-351f-4905-8069-509dce2b353e", "value": "T1AAD49DE1BB8469ABF53AE2338777883642B519D7D1C4C70AC844F3696E71330A94B94F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629839815, "uuid": "45acbd1f-3b6f-4fa8-a83c-424d6afbd965", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629839815, "uuid": "ed0ce84d-1861-47d5-aa00-e17507bb5265", "value": "12288:EofBJjQvYq9r8usx6DVU8PIVgnn4bobhhJRYmCC9jB:ZfjM9rdsxkU8PVnnISQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629839815, "uuid": "343b9853-fd20-4244-8036-5447f8da54e3", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629839815, "uuid": "9311142b-4a81-4c37-b03e-44e4189966af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629839815, "uuid": "e9943412-b150-457c-b07e-0138d28ae2bf", "value": "STATEMENT OF ACCOUNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d882610-0496-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629780306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780306, "uuid": "888ebb3f-f530-4a72-9c7a-be3dce436ba5", "comment": "Malware payload (DanaBot)", "value": "f359895c51e61de1170ea9e6441a36e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780306, "uuid": "51531ee3-28a1-4410-8418-a8a60ecc7b79", "comment": "Malware payload (DanaBot)", "value": "df03220ee207a1be64e9f25b74a78684ecd00fd75dd3e44e38e2b1678060e8be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780306, "uuid": "a12e6eba-c01e-4e1f-bdc5-436a96a4d146", "comment": "Malware payload (DanaBot)", "value": "b994387bf15003efcf8aa578d28622da91e93860", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629780306, "uuid": "30f4033f-a46a-4a0d-8212-ebc0da6911cb", "comment": "Malware payload (DanaBot)", "value": "bf334172431941c4add6d0ceb16dc877251debff8de823b17da677ba363bc16ce54afa2f29bb0f8eced3c452e12fc131", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780306, "uuid": "3a617c2f-0fe6-4463-a34d-e4ff135e7cb8", "value": "T1343523103A548077C3851078A8E3D6C0EBE6BDB25A356A073BC1BB9715647C5BF2F36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780306, "uuid": "39464c94-1b51-4e80-ac7e-72b222b51bea", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780306, "uuid": "252a41b8-ef8e-44bf-b768-846e88e0a056", "value": "24576:18Wemq6coWBkURMJpMeghq9mYjaDaPdqpvK1:18W3q6NUR+ZghQROaFqpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629780306, "uuid": "11fc6bcf-0187-41fd-ae5f-04e7b8f2b154", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629780306, "uuid": "1534c676-46be-4db0-a5f7-589fb1124a3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629780306, "uuid": "5e8809ff-934f-4eb8-9c16-a30537cb7e7b", "value": "f359895c51e61de1170ea9e6441a36e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3124d25-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629805548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805548, "uuid": "23e01a65-df2a-4d5f-b85b-aa7902be3d07", "comment": "Malware payload (Formbook)", "value": "c0345902862e4782be9d8449c83065de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805548, "uuid": "701f412d-f3f1-438c-98d8-f60d1c06cb13", "comment": "Malware payload (Formbook)", "value": "df19a60152fff0338d5ee7d2b969a4dbded6d3f2752ae246090e7e8f79c43815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805548, "uuid": "d2eaf47c-33df-47cf-b3f0-4095d76538c7", "comment": "Malware payload (Formbook)", "value": "fe73c9eea01abb9abb158f4cc2450ba101f1cd52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805548, "uuid": "11b1820b-5c5d-4d34-9433-5e36ead1f102", "comment": "Malware payload (Formbook)", "value": "c0cb25b2806d9f98aa651527b3d99639094c7c6606d5fe36f7d34f08b3c8a721fe78782c9ec250a897f2e91e78b27133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805548, "uuid": "cdc6ba02-80b1-4c54-a676-be9965058060", "value": "T1CE259D7063C9C294EC1A8EF0166CFB9002F235E7B6C5CD6E16DA724C8E5E9D12B0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805548, "uuid": "d4380342-7211-4fbe-995a-19b644955271", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805548, "uuid": "32a0b860-0d20-4a58-b8f8-c3e3fc10f3a1", "value": "12288:l1csGI/cnx8S2b1rP1KYbNhgIbp8M/09h/S8lSG7LcEjMZuhDn3DgBI1E/dvUmig:lI83prP1KYbXaM/mP0QMZyDn0q1fh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805548, "uuid": "ee515627-c196-431c-9906-219c97d770c7", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805548, "uuid": "849530fa-6f61-4656-9d1c-bd6c2a7f4bae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805548, "uuid": "c7feadb1-7db8-4c10-a703-760002fbbcce", "value": "c0345902862e4782be9d8449c83065de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92567ae0-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629805439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805439, "uuid": "1d0e7d0f-4d13-4947-9a2d-8945c9464c7f", "comment": "Malware payload (RedLineStealer)", "value": "d83b3316844ded8616b10fd288a9e874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805439, "uuid": "0822ae0e-8519-4a49-a694-9e6f13e9f029", "comment": "Malware payload (RedLineStealer)", "value": "e031bb84afc57bbdff6ab04d1bf56b714c8744462afcb60b6d02928e49872aa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805439, "uuid": "8b6af361-f4e5-45c2-b003-280281e09080", "comment": "Malware payload (RedLineStealer)", "value": "5c64729ad8b18c0de8ff6b7837e3ee2ef532ebae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805439, "uuid": "b13a5f8c-e467-4173-bc4b-403cd7fbc781", "comment": "Malware payload (RedLineStealer)", "value": "68258e19a091b9bbde7c9d3c74413457cc19218e9a5efd088fead41f13fbf0c3f21281edc08588046fdf3e0560db68ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805439, "uuid": "930bb0c9-9358-44d8-8136-a36848757ff6", "value": "T1F4149E6724609497C50C1B79E4A51F4B327CDD3819C0F689B08AB3AEDC3D39E49F93A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805439, "uuid": "d9be7587-d8d4-4789-8e80-6486a4651395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805439, "uuid": "0db0cf21-fe8f-4033-a2ff-5767013abc7c", "value": "3072:vXeF+DOWQ7VrdxKacDJnlFyT5qf/n26lmn+9JVTjLEvRlYNklZL7:mF+DOW45UJlH/n2Ym+NTjrNkll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805439, "uuid": "d60d58a7-9844-4a67-bdd4-70a57e4ff829", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805439, "uuid": "09348437-d1b4-45f8-9fb6-00db1a890f67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805439, "uuid": "83a6b4df-bc8d-47a2-a66c-458d7f6274e3", "value": "d83b3316844ded8616b10fd288a9e874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793867f7-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629786499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786499, "uuid": "1ec1e6fc-5715-4bd0-9703-7a9b0e79f17c", "comment": "Malware payload (AgentTesla)", "value": "6756f5d87da0f71e6ea5cb1cae085453", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786499, "uuid": "74a12675-b2e6-4a41-9d60-9c77bc7cf6e7", "comment": "Malware payload (AgentTesla)", "value": "e0543a036d36db22d823aebf589cd0adac6902c9ae3e2c949348652fc9d729fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786499, "uuid": "5c77533e-3074-485f-a006-2ccf865979b3", "comment": "Malware payload (AgentTesla)", "value": "88da9ba4e8fadf55dd668e3e61229b61f515b0f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786499, "uuid": "07ffefe1-e636-44f0-9122-36a8a3ea7341", "comment": "Malware payload (AgentTesla)", "value": "72ce7ba7788ab41ab250a73921c8f0ee68380e564aa5e6c423a0ab2291e427b64db8e62a1bcd11542b8cbdd3efa8221c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786499, "uuid": "09a65a11-49ff-4cde-800b-c99da273ff9f", "value": "T10FD46B9C7250B2EFC857C876CEA81C64EA60747B930BD203A01316ED9E4DA9BDF155F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786499, "uuid": "652eb5d5-a01a-48f9-ba14-a2e76c5020f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786499, "uuid": "13c80f7f-d581-42c2-bfc6-8b09c9ed7e8e", "value": "12288:GX9Mc0evj4GMykoU2JbQamq+2dlMVrCB/DUUOC4moDGlZgk43pc5zrxVU46psRDF:3wj4GfP8a5bdY2JAUJ3oDQHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786499, "uuid": "fff023be-b515-4bbe-9ad3-dcb92bc5f6c6", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786499, "uuid": "31c160e7-10ba-41fd-a837-9f5e2b3f95ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786499, "uuid": "82a911fe-6cdb-4510-803e-fa292f2c61c4", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.14681.3124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a902e3-04e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629812583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812583, "uuid": "5a70b1c3-6815-4ff9-9b97-43aa687f1ef5", "comment": "Malware payload (SnakeKeylogger)", "value": "55016ff947ed179d90361c7004e57101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812583, "uuid": "5bcb017e-c0d1-47a5-a198-5ff623e938f6", "comment": "Malware payload (SnakeKeylogger)", "value": "e05fe5513d1fa53dac03f434163f654968a43e04bb8ced21d016a925406e0f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812583, "uuid": "1d69c78f-f9c5-44b3-a127-46958ec88839", "comment": "Malware payload (SnakeKeylogger)", "value": "13cf47286b9b1d9718f82a2a45e47a0c2aea7d09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629812583, "uuid": "db1a7391-1362-478a-896c-d118fc0434ec", "comment": "Malware payload (SnakeKeylogger)", "value": "9ff26e06c4281b597553547f89da414af14dfc1374ad05c677bb8b08e8ba9bae4a7f4ef9e546c5d20a75f8a436a18401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812583, "uuid": "68c8f8de-6364-48c8-9f79-232df0cc9710", "value": "T179F4817E1ABDA22781B5D2B5DBE78417F0409B5F3411AC257AC203664232A7BB4F732D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812583, "uuid": "c17d3a58-0c36-444a-b550-b7b0f54af4c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812583, "uuid": "08e0e21f-c264-44b6-a504-b7eb81e27ddb", "value": "12288:ltjOhVeAzr8hDmgieyH12PiDC9Cy5HARBwqj069vrfc8Y:ltjOhVsYH/12PiDjORgrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629812583, "uuid": "4a9bc08c-ec06-459d-8565-2728fa9c7943", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629812583, "uuid": "25d6ba87-7638-4a8d-ba80-2f9257a8137d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629812583, "uuid": "ca3c0418-d525-407d-b863-86dfff4f7552", "value": "55016ff947ed179d90361c7004e57101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3497359c-04d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629806141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806141, "uuid": "1b89b521-d16a-4054-b6e6-882603503747", "comment": "Malware payload (AgentTesla)", "value": "cda382f609acfd4752df90394ecb1947", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806141, "uuid": "960942d5-3084-488b-96b6-e50c2cb1b615", "comment": "Malware payload (AgentTesla)", "value": "e083747d934cf70497881e7d9201f13aa8b90fa6e833f33d595936858268cec0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806141, "uuid": "07b4d729-4160-4d5c-a1db-c6563cdb9ebb", "comment": "Malware payload (AgentTesla)", "value": "1ba9049f203e1122454f75b24a71cd99a6cbe040", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806141, "uuid": "5ebf9978-78da-4fe5-a51b-77f805ca82cd", "comment": "Malware payload (AgentTesla)", "value": "1e8187dded2fc7f22044fe5158c8e56ecd08cf1cdac24777942b348b5c447d85e09daf47f352ce7fa251b71cc3447eaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806141, "uuid": "0c44ca7c-f1b7-4119-a8a9-d3b5c4c09878", "value": "T1D6D45A9C7650B5EFC857C976CEA81C64EA6074BB530BD243A05312ED9E0EA9BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806141, "uuid": "2c90b5dc-4545-4b30-9289-e314be76a54c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806141, "uuid": "b74ca0d2-802c-4e71-9196-b2b9dd73c557", "value": "12288:seOqPW0Msim5oWNYXR0fkUQzcAtqmIRQSZckr/r/C39QHwTtBupWF4YnwYL5WX8C:+AWa5oW6Sk/SmIRDCazRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629806141, "uuid": "42d9d187-f612-40bb-81c4-b20b9044f704", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629806141, "uuid": "b3804ecd-e1dd-440e-9097-65e268810aa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806141, "uuid": "bdd2e4f7-d46f-4f4b-9fd4-143643f67c08", "value": "BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1b5884-0518-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629836492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836492, "uuid": "49338b43-f267-436e-a455-798fe57dfda1", "comment": "Malware payload", "value": "f5c4dbef3d934821e183619967022767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836492, "uuid": "2b620bb7-3823-4dd2-9de4-b24ef5973e8c", "comment": "Malware payload", "value": "e0b1dc004a3db060f6e6c96fcb8ef22ba4cf94aea42ef4afb40a3168f9d97296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836492, "uuid": "9cdcc411-1e93-4e46-a875-6323d402394f", "comment": "Malware payload", "value": "1c17bf19acf83f7d4e6880cf8e19e088bd1b5aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836492, "uuid": "edf5166f-95a5-4f97-8cc0-9476348f160f", "comment": "Malware payload", "value": "c5ddb7ef481935fedc6a464fc836e855d61c48c1a6ec9a0106fb2e932453facbd04c2276665a760e40fd835f4660ed92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836492, "uuid": "d2d1288b-5a33-4cd8-9e5b-d19a5a243c5c", "value": "T1E905917E16BDA2278175C2B5EBE79417F0409B5F3411AC297AC203564232A7BB4F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836492, "uuid": "c14c5f9b-3780-48c5-ae51-3123ad82814f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836492, "uuid": "ac68a67c-901f-489d-9f6e-00563dd8748c", "value": "12288:ZqlVwldf4k+r/Q/aXM15r9wUz+eeEB2CLT+Srd8P:Z4VwA/mDJxem2CLT+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629836492, "uuid": "f45cece7-ac36-4300-950f-cbc066841e9e", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629836492, "uuid": "1f44e086-3fdd-4853-b84b-9504931bfe7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836492, "uuid": "4942272d-fd86-4959-b953-b6a00f6feddb", "value": "OBL PN210700369.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b25e56f-04c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629799683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799683, "uuid": "4f0e0e63-bf57-402b-9596-d715f632c752", "comment": "Malware payload (Mirai)", "value": "d29e3843f28877806e685a2ded1d2ce3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799683, "uuid": "55bc3a41-d94b-4f66-9488-585aad637532", "comment": "Malware payload (Mirai)", "value": "e1e6647575f84bd56947ec00915eea0f81213e3ccb7a09fc2685d42ee0c74804", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799683, "uuid": "6d536317-fd50-4d80-b1e9-4ad76a9de26b", "comment": "Malware payload (Mirai)", "value": "4c3abd5e5cecb01cb1f747151a8c9a7d2cfece53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629799683, "uuid": "0eca2305-0ff5-4cda-b761-414044e711ac", "comment": "Malware payload (Mirai)", "value": "67977499f4bf60da0bc65dd29984341a6597de0ea4b7ba638034ea43ffdbdf7b59599b9f0db01201fc16bc77aa0ebf4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799683, "uuid": "90268b01-a3f9-457e-bbbd-78d18c9d6c21", "value": "T15FB2E13A0609FC70C2708874E97A87C73ADF08E8D1BA363336D5876A7A4554378792C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799683, "uuid": "73c42832-1a26-41a7-8e1f-fa84bcc8124a", "value": "384:qrR5Z6gtWkY+iTULFUycBswe573K9VAa/SM7OYIjPmMJ4yGZydbnhymdGUop5h7Q:DoWkq0FUEwelR7M7Ajt4MFns3Uoz9GB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629799683, "uuid": "fe698a19-dca2-4fe9-b143-3c883571ad10", "value": 24184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629799683, "uuid": "a1349e63-c865-458a-aed1-7edd6100e52e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629799683, "uuid": "78d6f199-85d0-4809-88a6-b4d801421d93", "value": "d29e3843f28877806e685a2ded1d2ce3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19705134-04f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629819410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819410, "uuid": "c6d238bb-047f-4912-9baa-0e1f27c7471d", "comment": "Malware payload (RedLineStealer)", "value": "d1ff98a3c0754daadbf56d60cb28476a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819410, "uuid": "975320c8-caf5-4f2b-8859-751c57c6135a", "comment": "Malware payload (RedLineStealer)", "value": "e23d4364b33fc8c7b0194d34e8d970b282ef356991542f9d96bee56b0a6cfe37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819410, "uuid": "a26d1f00-9c45-4f43-9aa7-2411979ee672", "comment": "Malware payload (RedLineStealer)", "value": "bdbd4e40814483b7c92e133750b87f7e95857e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819410, "uuid": "bc74b1dc-6caf-429c-8e7c-6f8f13ce7810", "comment": "Malware payload (RedLineStealer)", "value": "60bf0a76fbd29963f57c7db111653fe62e473b566744a1e7cff2f018d07aeaedd994da722513ef30e8bb695cc2fcd555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819410, "uuid": "bbadbe8c-665d-4458-a9c5-565d4f46b600", "value": "T1A4E3BF1134E0C433D196483548D2DAA4EA2EB4215BB1894777D99B2F6FF33C0BB2EB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819410, "uuid": "6ee6e2f0-69a9-4ce8-b489-87b9ffd282e7", "value": "3e77a5228ebd8b068a37deeb2c688fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819410, "uuid": "264c0c52-db78-4aaf-8af0-fbe101af24ae", "value": "1536:lXOEr3r+lh4/Ck3l8bXjShnN+5Bg5+XLaLJSS/b57kNvdckjeKe4LXBriobhO2YM:l+14NEXehuC5x3/b57kvckHvgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629819410, "uuid": "d5d47862-130d-430a-bb32-d2a68554a669", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629819410, "uuid": "7a1a7775-eab9-482e-82ba-5495c41fb735", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819410, "uuid": "f461ccfa-bd37-42f9-91bb-362b87ddf48c", "value": "d1ff98a3c0754daadbf56d60cb28476a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3eea1cd-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629805093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805093, "uuid": "d79614ed-2db3-4286-b565-fb6e2f316a0f", "comment": "Malware payload (AgentTesla)", "value": "0b40c5e2f3f659230621dfd83a602f4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805093, "uuid": "fc5aef15-eb96-42e0-ad26-95291a8b99a1", "comment": "Malware payload (AgentTesla)", "value": "e2b62b444615e4035c3a411a446a6dc5b0c7e6fb3bd31f3adc77c2da5fa0b068", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805093, "uuid": "9b29a587-5e19-4fb7-84f9-2764851f58a2", "comment": "Malware payload (AgentTesla)", "value": "9ea11e801fef371742faddc12ff53849d1dbd845", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805093, "uuid": "63a6139f-fa6b-47ba-84ce-d2451005acd3", "comment": "Malware payload (AgentTesla)", "value": "e0d5f5839a8febd58abb736229a3129c5f05ab5b63f6a923a9bce8f5bb6ab02417d51a133de7319e6f03d7b7be7e53d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805093, "uuid": "781b50e6-cc20-42e8-ad83-36121b55ff99", "value": "T1FA159D306389C294EC1A8FF0167CFB9502F275E7B6C4CD6A1ADA720CCE5A9C1670765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805093, "uuid": "1f0ce64f-370f-47ca-be8e-649f7ace59fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805093, "uuid": "e8ca7e0c-17ca-4772-96c4-a8b4d2ead46a", "value": "12288:NYcsGI/c0XcYPCKdyshv9kxjcRBhFKomQEjGeGkh4SURKVMX2EObb9:NYXLprRpGHS3H9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805093, "uuid": "b534e5ab-9c4c-4993-a7ed-5f42ef578591", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805093, "uuid": "7721e22b-b2ea-41c7-8e2f-653ea9b7d9eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805093, "uuid": "f4915e8a-4843-4cce-bcd5-ebc107eeec7e", "value": "SWIFT Giden mesaj bildirimi - 70.350,00 EUR - I103.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00ba05b-04bb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629796443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796443, "uuid": "1211b923-8f16-4acd-afbf-35d7d1937919", "comment": "Malware payload (AgentTesla)", "value": "53791f522041d3d882f1c7db54d68ca0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796443, "uuid": "b7ad8c8c-2fe2-499e-b9fa-9f74355b3152", "comment": "Malware payload (AgentTesla)", "value": "e2df5d455b06abcf80707f326185cea53563f60cb4fb1319a549c725c4588fab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796443, "uuid": "f134f211-74c0-4d0a-acae-a2caa41ddb80", "comment": "Malware payload (AgentTesla)", "value": "e7fd141bad480f11aa8baa3defc57d1156d19ab5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629796443, "uuid": "50edea7a-15a3-4baf-b2f6-c72d9e76364c", "comment": "Malware payload (AgentTesla)", "value": "d7e9fa2eb41f9f928fcf317eda7342eedab63a0ecd8bfc94f398796812ab9559477460b99caace74c6fdc7a8d61381fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796443, "uuid": "fbedad97-ffe0-4238-bd05-19f930451c43", "value": "T168158C306389C294EC1E8FF0166CF7A502F275E7B6C4CD6A1ADA324CCE5A9D1270765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796443, "uuid": "cd78f944-a592-44a9-84b6-07f04bb329d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796443, "uuid": "e39b7d06-2d65-4d16-889c-74dede4de551", "value": "12288:0wcsGI/c1LFvK1i8AGLauuaGndy4uqPT3LWHk4mkZezQRGGn7wq/CF2EObbi:0ly/LaXaG84XWEvkeQRGGnhKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629796443, "uuid": "c3a32cd9-62f8-4b6f-8dbe-67333b98fad2", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629796443, "uuid": "c2f89c8f-a927-45d6-b9f8-5f01f93e0420", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629796443, "uuid": "2b10c3c6-ad74-4108-b63b-055fe4bd95d3", "value": "Po copy. pdf......................................................................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55f4ad1-04b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629792694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792694, "uuid": "1581d192-e491-43e7-998f-2ddf0d7c9c89", "comment": "Malware payload (Mirai)", "value": "6f4dc328a9b44814bb0cb2b56d2fbba5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792694, "uuid": "f26e4748-d529-48d7-bf05-3880f9f55a9c", "comment": "Malware payload (Mirai)", "value": "e33f3b4e9a2ea902abc4762a78c70948d34d45e961cfac4d5f4cd66a014cfb01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792694, "uuid": "d2c0cb39-3ea0-416a-857c-e4fd2ed5861b", "comment": "Malware payload (Mirai)", "value": "e3a5b1c3f361c2d241d7cf8d2ee78b83cf7d185b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792694, "uuid": "8d451144-ed49-4d3d-9fa7-1de180552310", "comment": "Malware payload (Mirai)", "value": "d74c03f00420a1dbca0d7abb16fecbc58aef0ea53171bbd58eccf2e8cdbc58ab2add3144a0058507107bf4c98aa38a17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792694, "uuid": "6355a834-5d32-4b50-bdeb-de0967ad52dc", "value": "T120D3F730E8044B1BC2D227F6A79E469E3F351EA7979733115A387DB02FF27992E25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792694, "uuid": "dbc23030-ab7f-48c5-bfb3-d3a9a99c0623", "value": "3072:+DShVLkDZ6waCAdclPbYJOmP46aQyfPluesNb:VhVeZ6zclPboOmP46aQyfPluesNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792694, "uuid": "27a4567f-056b-46b7-a970-9ffded604c3b", "value": 130115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792694, "uuid": "b35c1168-728c-4a0d-9cb5-60865385d2e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792694, "uuid": "79771c7b-9d89-4685-8642-ca3c907d4d63", "value": "6f4dc328a9b44814bb0cb2b56d2fbba5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f749b56e-04ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629803032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803032, "uuid": "964bc53f-e952-4d58-8d11-08bb4e93d15f", "comment": "Malware payload (Dridex)", "value": "d2c657b1d893eca12b46e79b0ae908cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803032, "uuid": "0fc428e8-3656-4443-9ba8-407b874546a1", "comment": "Malware payload (Dridex)", "value": "e36b5edc1b66572fe970f23acf55c527e91e0f31b644a5a8ce1873e6ca681286", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803032, "uuid": "b5447479-2dbf-468a-8529-c2e8d6c73f13", "comment": "Malware payload (Dridex)", "value": "31d2a66417a233e8c6712f661f998bf0d2f869d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803032, "uuid": "6002cd3d-2d92-4c16-8037-69e42f5ed0ba", "comment": "Malware payload (Dridex)", "value": "c2a14677c0dacfab822e415cdcfd529c5c3bb18eb3753d9d4af06d3a8e2669f239b6a5760993f86e009150094abef6d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803032, "uuid": "9f31438e-b695-4aba-bf27-e9b64646cf5b", "value": "T1BD641208C4F3D97ACA9A4CFF4C7914E263A78A37C1958AC788C531EC2E531765298BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803032, "uuid": "20654a6c-7dd0-46b0-8c64-4396d47aed3e", "value": "6144:ognXz1MHi/tmXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5Ax:1XCHi/tmX7ifASkKTzSwkPFduQx0uD+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629803032, "uuid": "638aa353-a811-408e-ae30-08b49112e58f", "value": 329103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629803032, "uuid": "f4fe1126-44c5-4081-b436-729ac308e4cc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803032, "uuid": "6ca094a7-9007-4203-8ab1-66ff68575e8f", "value": "Details-7125618_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22217ad0-0481-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629771321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771321, "uuid": "7229aa1a-9f83-4661-810d-361fc8dcdba1", "comment": "Malware payload (AZORult)", "value": "70993af369c1515d57582eca676ba213", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771321, "uuid": "2659cac6-0457-4d89-b3e6-07fd8b7be61f", "comment": "Malware payload (AZORult)", "value": "e3d292ce4f5bfec8b177e52504dd03046795938a91b4c00560367e13016e3301", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771321, "uuid": "01cb3842-5fd2-4f2c-ae3b-f9d99de3d845", "comment": "Malware payload (AZORult)", "value": "6f6b9251bcda2f73733dc969af7f0821617e59a7", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629771321, "uuid": "ba55113e-37fb-4ad6-b172-7c2256635395", "comment": "Malware payload (AZORult)", "value": "670da0abef17cf59d44088a2ab5017cd34ea31434ffb3a2b692028bf4ed2fe4762bf0eeaac8eec6952a1ee5922ed1142", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771321, "uuid": "bf34242c-c977-4509-ab81-5cc45aded12f", "value": "T15A94AEE17A13044EFDAC9EFC47CAA148693C9D7C4EE407767A283A79C67293C0C8D965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771321, "uuid": "da3fd5b8-6559-442a-8f5a-3208e151eaa0", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771321, "uuid": "9acdb951-b89b-4588-8c84-7afb63c78fb8", "value": "6144:rMDmO6XsxLeAEKT8OmGW3TS7moyepYbkA/B5Z+zd:rMUm7qEgkKTZ+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629771321, "uuid": "5765288e-4479-4364-918a-b9b42b7477f3", "value": 417686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629771321, "uuid": "5e8f7f76-2256-48f6-bea9-5bc9eee1bf8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629771321, "uuid": "33b4ad12-cf9f-4f52-9ce8-45940a53ae75", "value": "faturalar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32faefb6-04a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629785522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785522, "uuid": "bfab2fc9-369e-4821-91e9-520e7340b837", "comment": "Malware payload (Vjw0rm)", "value": "1151de818776c906cf7e06cc24c91f5f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785522, "uuid": "1c77fd8c-fcb2-484a-9a38-ea2fd376892a", "comment": "Malware payload (Vjw0rm)", "value": "e4310114f26e15fa07e71124920ed389f53e21ee57aad649e912ea15ef4e5ebf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785522, "uuid": "53b3aaae-597a-4bec-aed0-cfa2526db897", "comment": "Malware payload (Vjw0rm)", "value": "6cd199b2909eea9731de0dfcaa73a1370d7bfdd7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785522, "uuid": "a419b76d-ff0b-43db-af3a-05b13d73a335", "comment": "Malware payload (Vjw0rm)", "value": "a67b00ca85fa4272dfc15f58efe8d40bc05d726e7f574121509fef20d180dadff085db7eb57a1edb3ec7e48844183039", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785522, "uuid": "5edd7449-5602-4721-9d5e-f53b7c904eb1", "value": "T1A1D31277B28D9978A20ACF2E9E5B31D5345FA13F33AE024D27A0E19D923055D0946BEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785522, "uuid": "d51903eb-0c64-4e44-8ac1-e01d11090a14", "value": "3072:tlf2sc96eDRPXOIGdZ5XNKgfTuoTnA8pUfJ9Ifs20mBtHux/:/WdvGdNVLuoTnRpOUkEBtHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785522, "uuid": "037ce526-a776-46c8-ac7f-f0fc8b76673e", "value": 131638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785522, "uuid": "4080ea6f-3ebb-4e89-ac1a-80777989c58f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785522, "uuid": "d456ca0f-c07c-482c-8f4e-db9a14cbf2d8", "value": "SWIFTUSD45005.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513757cf-04ee-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629818215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818215, "uuid": "f783fa5d-901f-452a-9a71-d5c8964f7aaa", "comment": "Malware payload (AgentTesla)", "value": "2bc9a7200e3195ae8143aeda3c972eec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818215, "uuid": "3d6a7116-b49e-4d88-85a2-115da3069fe0", "comment": "Malware payload (AgentTesla)", "value": "e4850597fd4ae26489658f15a2cd6f412c5575cecfae7c8890c699c8a798c263", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818215, "uuid": "ccc963ac-d120-4b21-9122-6a163bf56617", "comment": "Malware payload (AgentTesla)", "value": "3d17f0a7af181e491d24e00a067b1460dc1f30bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629818215, "uuid": "b13145a0-05ec-44ba-be32-85fb1461a86c", "comment": "Malware payload (AgentTesla)", "value": "9ef4558012ac8d6ac99d09298c9426583ab7c549fb456027a014a547c9eb42e2816164902403daaaa210e7e10cea89cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818215, "uuid": "04600764-90ca-44bb-aa8d-2c4911280a23", "value": "T1EDD42370AE88648759E705003DCAFB35CA0E512CCC327BD9A3A62B45D4B9C2DB629777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818215, "uuid": "17d9a2d4-7009-4eb8-bc79-4d433a4cc040", "value": "12288:tJp/ED2iUnZBlCcR2DJlekd/Ggdjtw2ab3Zvu53tAMrd/FIjS7zI:tUDWCq6fugETOR//nI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629818215, "uuid": "4fa19c3c-3e98-493c-8369-cdd1941de9bf", "value": 655716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629818215, "uuid": "0d15c016-0448-4f10-b572-7f6abc1be565", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629818215, "uuid": "0a4984f5-1c76-4256-949d-0c994d52b8ed", "value": "NEW PURCHASE ORDER FOR AUGUST 2021.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb12df6e-0506-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629828727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629828727, "uuid": "8a86298f-9d5b-428e-bcba-f23da38c05fb", "comment": "Malware payload (AsyncRAT)", "value": "311c980507dd679498b5c9aa4142c8ac", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629828727, "uuid": "13f0ba01-3970-464a-abd3-5bfc80dc06d3", "comment": "Malware payload (AsyncRAT)", "value": "e53d06ac2274db3297fcc6116ad9a529924bc594068bc74678882a3ff7bfc9f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629828727, "uuid": "801fe47e-bf52-4027-9e5f-bc1110953e6c", "comment": "Malware payload (AsyncRAT)", "value": "c8a714d6873a8ebe5a0bc87b08bc18c41b2b72bc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629828727, "uuid": "aca50f72-48be-4da2-9a7a-1686041bb3cc", "comment": "Malware payload (AsyncRAT)", "value": "1039361e39a70c29a5f7343e01adac86d01c18265f0a9c3c2c9efeb3280c15e9bd856ccedea89a56360a416eb68d800b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629828727, "uuid": "7f424fc6-5ef5-4cf7-9cd9-80ad5a1b5359", "value": "T16825173D19B91637D1B5D375EBE48523F158985FB404EE6AACDE03A7030AA8734C362E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629828727, "uuid": "12d18005-4f5e-4220-a133-1adc5cbadf95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629828727, "uuid": "bbfaf3c4-eff5-4c62-bb41-390385d5fdda", "value": "12288:CgRZxZi970ubQLjdfAESkGDEU6E7PjA2TbzJpTggoaN/XETRR8RyIiI:CgRZxZUSRSDEUfbJbzJNgGN/ARRrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629828727, "uuid": "74cb15cb-03f4-464c-87ef-2b3ea6ecb4b8", "value": 981784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629828727, "uuid": "8e1acf48-cde1-42ab-ac89-593c1e9735b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629828727, "uuid": "472e4a81-2e46-49fe-9684-3da05fd1557b", "value": "311c980507dd679498b5c9aa4142c8ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0414e04-04d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629807744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807744, "uuid": "b3c39d19-edf1-4d50-8dd4-bd49c889b0b2", "comment": "Malware payload (Mirai)", "value": "21c038c384a99ba4e5ebb88da58ef05a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807744, "uuid": "21e42f5d-5b51-477c-9074-957f943ed828", "comment": "Malware payload (Mirai)", "value": "e576c87e991a0754c3791290c8f417ed42c10359175e5495907755f962ab9c43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807744, "uuid": "c8596e40-e2b0-424e-be5d-fa08ee8a8af0", "comment": "Malware payload (Mirai)", "value": "af8cfd9b4e6cda9beeb0e561441f447ffb0d6544", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807744, "uuid": "ae355328-2a04-4793-9edd-fe9f7f6e0811", "comment": "Malware payload (Mirai)", "value": "b2fba54e780d0b772fe375994489ffceca94197c250735072262e6b7cdf9ba3219f3189a0fb3461ea843e76966da1513", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807744, "uuid": "9ce4b503-0886-4129-9e90-0a54250be53c", "value": "T1CD337C528AB86E18D59E8AF0F0A0DF7647A3A65080471FFE11B5C3794183E9DF5893F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807744, "uuid": "5c09fbee-b53b-4f7a-8424-b26d3c42217d", "value": "768:l6nTzd4c/46bz/QGTNlIPgOtE5aoCUeb25KzI7MakDo1uf2KPCJSdJI:l8dtnDoPS597KzI7PkMmCQdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629807744, "uuid": "a1489ba6-efbb-4564-857c-8f32c1adc425", "value": 50500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629807744, "uuid": "0dd021ce-1e72-4c69-b514-4808d4644f10", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807744, "uuid": "0477290e-b0a6-4fd7-82c0-d4f50816e651", "value": "21c038c384a99ba4e5ebb88da58ef05a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb74ff33-050b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629830848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830848, "uuid": "3076e557-9ee5-42c2-8e2f-efa4fa0dc1b2", "comment": "Malware payload (RedLineStealer)", "value": "2b63c934475ba4c4bdb988f0f76edfaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830848, "uuid": "50061d96-da8d-455f-9dc0-ff2c3999c927", "comment": "Malware payload (RedLineStealer)", "value": "e7e2a6b03469fb8c542986035a5a67997e1afc3e78d93f267028db4672c68207", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830848, "uuid": "efa1f082-7e54-4a1b-bc68-c0e9dd9fca43", "comment": "Malware payload (RedLineStealer)", "value": "32279705705b68656d11c690e85455df6a034c76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830848, "uuid": "6e7947e9-16a8-4076-85de-96b7722fc23e", "comment": "Malware payload (RedLineStealer)", "value": "1b2fa82270cd5a79ab8b6453cce91c23bceaef9d81a52eb77f5cc058504d6ab0e091aa4b2c3b05431c744f390de93075", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830848, "uuid": "d7c39718-3a84-41c5-8bba-04b0ff0bb833", "value": "T18924D8102368413BDD7F0EF86465E7340AB49CD612A5A61669C93E9B3AF1F32F70325B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830848, "uuid": "a11c5ffa-116a-4a57-9aba-c68da025adde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830848, "uuid": "b0f7ded7-2575-4079-8bbc-07183b06d529", "value": "3072:v9Z+PPf1rLJTVzqicaGlnjyjdWsYDcDZfl:utfJxzqiGhyIjQ1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629830848, "uuid": "ee339eea-5ff5-479a-8f29-6df82173fecf", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629830848, "uuid": "ce32a28e-bd11-48d2-ac15-d3dc3c35054a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830848, "uuid": "d79e8f6e-bf63-460e-b5ed-3603b45a2739", "value": "2b63c934475ba4c4bdb988f0f76edfaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4de48a6-052d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629845521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845521, "uuid": "036f37da-6711-436d-b5b0-015a3f1b61a7", "comment": "Malware payload", "value": "2a000e68693fc94e1c93d7649712eb2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845521, "uuid": "3e134870-8191-4dba-9b35-c19f35fb1c93", "comment": "Malware payload", "value": "e8fd915f6c176308283f7567c4b2cbdbdcf617328492c9d09fcfd6364a6ddfba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845521, "uuid": "f22c6afa-d7ea-4f84-828e-788dae26d595", "comment": "Malware payload", "value": "e5a8846d7161c3464987acb8c6ae610cafef4da1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629845521, "uuid": "e972c45a-d2e3-47b4-b058-1162a6c9dcd4", "comment": "Malware payload", "value": "dd8f44023be0aec0e5007ed11a3e5f742cdf4db0bdff955be002f704069d987d0a498975676e67a7774e5fa2fb4f0e15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845521, "uuid": "aa0b5f7a-e1c8-451f-abb8-58588ee4c4bc", "value": "T1E0146D30B690C035E86310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845521, "uuid": "606fa4f5-b1ce-4c8d-804b-1d20528f520f", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845521, "uuid": "a7616de9-b8b0-4662-a339-21c413daec8a", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIU1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNB1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629845521, "uuid": "bd64fb4c-d3a0-4dbe-9753-ec263238ddbc", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629845521, "uuid": "88ed5671-2c37-476a-8d2f-86edac07b2dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629845521, "uuid": "abcc074f-c9f1-4310-b29a-58f4b004c6d0", "value": "NamedPermissionS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bead21bd-049e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629784039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784039, "uuid": "b9293d53-5f95-49f5-a883-29f6e99e886f", "comment": "Malware payload (AgentTesla)", "value": "21198de5d48358043506b06b08ade2f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784039, "uuid": "50098a3b-cd55-4d62-9a9b-5adb2e71245a", "comment": "Malware payload (AgentTesla)", "value": "e9347faf0d1e6550f89019a63e43e37b606184d23523400be37b8d6d91dd0895", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784039, "uuid": "6b1786b4-7f48-4e9b-bd7f-1564393ee992", "comment": "Malware payload (AgentTesla)", "value": "b6bbe102f4b221c46051b027325141b9adc094c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784039, "uuid": "6119ae9c-172d-4ff5-b32a-e5b7a2429894", "comment": "Malware payload (AgentTesla)", "value": "11a822916fc612a34adc75bd2a33eeb5ed3a1c2fff2e57218cf34a29d3b323ba07a57365721d980107202bc22413657f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784039, "uuid": "04314b12-3957-44f4-9573-6973fffb4f12", "value": "T1F63402058B3CA2E6E64AA7346959437FFC840FF461BF02E78700359849369D9DA71EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784039, "uuid": "155d9e20-cd65-4eaa-90ca-82ea6eb262cd", "value": "6ef74f7b87fa15b6df54d064a5b8ef31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784039, "uuid": "8b98881b-ae32-4e49-a4df-d4a77a6b2301", "value": "6144:FQGfwvDmBA5Yw6dHB42aTIuQGMJ1yyq6lnS5150awobwk:FQRvrYwohCIuQ/lnS5Pwobwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629784039, "uuid": "a588817a-2bde-437c-b6bb-bab71f1d1c5a", "value": 240275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629784039, "uuid": "1cce35a7-9b8f-4712-8ab3-f30b9a3304b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784039, "uuid": "3d5203c3-a8ce-4133-88a9-4b595180f80a", "value": "PO 0038990-16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541f81a6-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629804905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804905, "uuid": "794c3284-c7a0-45a7-b735-afba030f37b4", "comment": "Malware payload (NanoCore)", "value": "4a5bdf87ba9e4d51f9cd50ad96263db3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804905, "uuid": "8a907c63-a6c2-40e4-ba0d-f963378b6438", "comment": "Malware payload (NanoCore)", "value": "ea2bf0d849a44cf65e2fe9bddd0c37fd22da5a807b5a6605c6c3eae859da6418", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804905, "uuid": "9cac8aec-e9a4-42e9-8173-d6fe95df873f", "comment": "Malware payload (NanoCore)", "value": "87e0723e4be70a3c75c9b531bfdc792d9d13d0d9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804905, "uuid": "d0eeef3c-7d97-4983-9303-26d3766a57ea", "comment": "Malware payload (NanoCore)", "value": "a4372a5d35af0dcf09197e57851f7b13b16794c7350b510d93b869e47444b5e86caf6ba1dedaddab6dd3096b89dc5a42", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804905, "uuid": "0e76a754-436f-41cd-8912-3df35be4d704", "value": "T118A33DACC45302958F45ABF8171B6F45228CB61EF388A67332349B742BE6D7A5123C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804905, "uuid": "cd90f419-dfaf-43e0-abaa-de3227922037", "value": "192:n/gbBmLxpkJXV6eMQRUQlcVOglLgB32pWToePaXRq6zYb7vaavWmT/zJAmFk:n/lLKl6eMQRpcVOKcB5Tu8AYbxvWmTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804905, "uuid": "74311751-8264-4ac9-b7a8-84217847583e", "value": 99043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804905, "uuid": "93f519d3-3f7e-4f51-b721-1e8b124d003d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804905, "uuid": "6682bf20-e6cb-4357-9c88-4a268213c785", "value": "NEW Order-05271.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43223b49-04c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629801441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801441, "uuid": "c064dcd8-26aa-4179-b552-5c748761d0b1", "comment": "Malware payload (RaccoonStealer)", "value": "2446fc04a3e83c36b236da487dea1161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801441, "uuid": "0a5a8c96-1db8-4300-aff2-79ee7625c6e2", "comment": "Malware payload (RaccoonStealer)", "value": "ea37e566aca7bafee068385eda34b4f3b3bb1cfb71d1b83b2f6e255c879e3d28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801441, "uuid": "6d985a89-1666-46f1-b157-819b30407f1f", "comment": "Malware payload (RaccoonStealer)", "value": "96ca31dfdd70d05d03636e6fb23420dce1368fe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801441, "uuid": "5bec0bbc-c3eb-40f2-ade9-b67e26cbd099", "comment": "Malware payload (RaccoonStealer)", "value": "8717200a80612214cb7b81aacab64d0731fb22ef2c70a55f96806285ecf3f872c54c1f75c73b734db660d90b3d3ec746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801441, "uuid": "504a2d62-9ced-4a6b-a8af-5fe93261c74f", "value": "T19794122074A7C473DC0780B15C99C399EBA6BA419B765343B7EDDF6E4E202D07A2D362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801441, "uuid": "66adb475-4de9-44c2-be0d-b38c4aa56c8b", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801441, "uuid": "acc1370d-2fdb-4b85-a967-6781817b220e", "value": "12288:EZSePl9RXOJVl0Qe4XTWbCuU6iR2s/5a:EXuVl0b0z6iwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629801441, "uuid": "5f49059a-ba3d-4328-ad36-2738bd427af0", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629801441, "uuid": "ef722b59-247c-49af-af1d-b59d659ba927", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801441, "uuid": "47e95dad-9464-4665-a746-5b8260a33e76", "value": "2446fc04a3e83c36b236da487dea1161.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0c449d-04fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629823627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823627, "uuid": "047dd611-8676-428f-be37-23883e49f2a5", "comment": "Malware payload (RaccoonStealer)", "value": "ae184334f95325bc0a52e10b74c0c755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823627, "uuid": "f1b58a9c-a280-462f-acb5-61c1ec8cec9e", "comment": "Malware payload (RaccoonStealer)", "value": "ea435f8deba53b4fd4a17dfd99f6d41ec709667aa0c79fd2ba8d5e896e93a0e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823627, "uuid": "6737e3fc-d717-43b8-aab4-9d2638cd883c", "comment": "Malware payload (RaccoonStealer)", "value": "09adce223485b4963ba31ee0733b764e9d1a51be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629823627, "uuid": "87a9df3c-c5d9-4fa3-9e64-5a9903032578", "comment": "Malware payload (RaccoonStealer)", "value": "70da969ab38bed2d37e417716d168fa1b926122411a0ec74942436fc04f5f45f91299baf66438840a2dd4d9c28c6e1e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823627, "uuid": "70f50418-ff4c-4925-b1b0-23d1379df3e8", "value": "T1C89412D5F4A0D571C02419714C16F7D085AEBE22EA6466433BFD2B3F2F722819A2B367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823627, "uuid": "c3229f18-0bf7-4b14-9663-11b69a6bb7c3", "value": "d62b54fca512105669e8801d03a30300", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823627, "uuid": "9a90a3f2-7f64-4cd9-9918-0e99f1d210b1", "value": "6144:fQzP+O+5JfAxm+lTFGGezyGhBi6vzu0a6ABTWVAPKZ1Haoxt7b24Yc1e:ozzIfAxRDQyG3i6vS0ZouZKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629823627, "uuid": "259c138f-ecd0-4e64-9da6-42259ddccc67", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629823627, "uuid": "e7aa0e0f-69e1-40cd-bd91-ed0df9afad14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629823627, "uuid": "249608ff-9d14-4435-81c1-823e985d59e6", "value": "AE184334F95325BC0A52E10B74C0C755.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c43e492-049f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629784276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784276, "uuid": "e8eab049-8253-48a3-aedf-fd5c0da2f14f", "comment": "Malware payload (RaccoonStealer)", "value": "4bb1ae8b28c09ad2837ec96d1a6a486e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784276, "uuid": "6a6ad910-7398-4acd-a0d2-b68ffb097414", "comment": "Malware payload (RaccoonStealer)", "value": "eb6ac5caf1ad01b01f9f32b4aa60a27c97d24b1b77903ae407641dfd149a715e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784276, "uuid": "203701c3-1a04-4952-a428-e31644cf0355", "comment": "Malware payload (RaccoonStealer)", "value": "65d12fe2e2fec3ebdca9463e87b16ddb59c63fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629784276, "uuid": "b44b8afa-f4b0-474e-aee5-fac4ba7a84cc", "comment": "Malware payload (RaccoonStealer)", "value": "f39b316528a1017cdd257e6e81464651fc44f5f97933e400f63206636b6b74b3b13e8a97813b50ddad2e105a5ed2b539", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784276, "uuid": "50e62b03-0d60-46af-bfd7-818557c4c32d", "value": "T17D940232B881C133C0514070CDDAC7A2FEAAFB946A69414B37D85AAF2E711D4751EF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784276, "uuid": "420aead8-8a24-4d15-bc9f-199f4d3b59ba", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784276, "uuid": "1547407d-e448-4fb9-830b-6c01c467210b", "value": "6144:HGEamIBXyB09CXsjsIjJOuUNTiQlRcWPOxtYhMiV2wFUKfwP3xa8w:HhIBixXsjsIcF1ZOxtYGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629784276, "uuid": "5a71f235-e04a-4386-aecd-057257530dcf", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629784276, "uuid": "4446675a-aa7f-45ef-9536-200c46c45166", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629784276, "uuid": "4168cfc4-af86-403a-b173-64cab463085d", "value": "4bb1ae8b28c09ad2837ec96d1a6a486e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369c9872-04de-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629811298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811298, "uuid": "c57151b3-7fbc-41c7-b668-193ce8b8acb7", "comment": "Malware payload", "value": "acc900c72b0485c9a53bee4b4fc007c7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811298, "uuid": "fb061557-967a-4a41-8819-e245c1753c43", "comment": "Malware payload", "value": "ec78dc52818e3f0ba1b0c8504fc199c5b0c17e5bd82b853e21dbd9dffe7d5266", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811298, "uuid": "0a4251a7-7463-4b3c-9696-d1cd9149892d", "comment": "Malware payload", "value": "030468a4486ff2d9c20c1612877a6b8ee9f1d83e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629811298, "uuid": "b11064c7-eae8-419e-897d-79486d707ebe", "comment": "Malware payload", "value": "9736c5a9a3ac438dc231607f23ad68ecc1df210659afeee9258622c01613fd3d6a3d4f9ab86286a10f5ab421c9c4aced", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811298, "uuid": "613c6f3d-6735-4fc0-b830-4579e7c9c599", "value": "T15693027631EE42C232C90B1E3E11EA6BD190986B432F75DC7F390EDE38D6A936564491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811298, "uuid": "5e6e0ab4-1357-46ff-952c-71a4566bb880", "value": "1536:J/aRcW0U2l2jDbzQiBBcBh0+2F8NLkkzCUhl4O/GQTxVgJysG2vwHhlguCKo1rdJ:AcJUpDrBBcHNKwLNBuQTfg4snIJCKo17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629811298, "uuid": "950acf8e-28a1-460e-a293-453eb95848d6", "value": 92253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629811298, "uuid": "e2e6ad55-01bb-456f-a332-efd8f936e58c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629811298, "uuid": "0acd193b-0e39-4fc2-b4a4-0bf303390cf9", "value": "401k-statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d7c7e6-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629805022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805022, "uuid": "bc927b7b-238d-4dd7-84fb-f7623296ac97", "comment": "Malware payload (a310Logger)", "value": "1e02b92b4285adf1f1973b20eb5b0a91", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805022, "uuid": "720fa93e-8326-42be-ac7a-4a4445c00ae3", "comment": "Malware payload (a310Logger)", "value": "eca4e5db6bb4788a6a07bc6774c82c3e64a95054f2d70e1810fad80bff3b2f3c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805022, "uuid": "c97a4c54-34d9-47e7-9271-c2d598848e29", "comment": "Malware payload (a310Logger)", "value": "31184f25596d0e32cdf343a9d993c547f95b7b4e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805022, "uuid": "08fd0de7-206b-4451-8b7c-9d061c41a4e6", "comment": "Malware payload (a310Logger)", "value": "c81948a0cdbccfa6289fa47463dd4945ba7184836c0237a2750a2f48cd8fd07f4395c965de7665ed5885ee99ae549477", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805022, "uuid": "8d06e563-00ea-46e2-84ed-3bf52bc1b67f", "value": "T19E4512C07572DE01D1AED8B0C8F3DB6A8B248D6395504693F54E7B94E27A313B2AF1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805022, "uuid": "084cfcaa-c2dc-4121-ab9c-ea9c226259b1", "value": "24576:0MfBmcbWobOClpaDX1p3+iHrdhUFpQ0+nrIegtm/RVHy+PB06:0MJ7H/lor7lrgrQBdgt4+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805022, "uuid": "a9ef592d-6a00-41a6-80f7-be137ca0d22a", "value": 1257224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805022, "uuid": "b5e89509-ac50-46f7-9063-fed4b71c5588", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805022, "uuid": "7edbb03e-f1ab-4c74-ad68-d5e7e7779920", "value": "Alkonda_product_listing.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e807e59-04c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629802319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802319, "uuid": "dd31f0d3-ef99-425e-98dc-4899fc09e03b", "comment": "Malware payload (CoinMiner)", "value": "e724c94c5fde14451bf200e0c42d1a56", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802319, "uuid": "5784800b-55de-4521-aae9-20d4a3c5d889", "comment": "Malware payload (CoinMiner)", "value": "ecc608dedd0b55df6c75aeffcd51e11f3fd50d7422e4a1b26d4515a18419b9c4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802319, "uuid": "1e9f6fc6-ba35-477f-b1fb-810b741b2bda", "comment": "Malware payload (CoinMiner)", "value": "0d59cb420ef6cbe674cf0c2bf54a8d7c31fd98cb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629802319, "uuid": "62747721-0377-4051-a945-74aa043f2524", "comment": "Malware payload (CoinMiner)", "value": "b72e0eaf30f8052087f7e25fe928e293548f6bb43608c4bec80b2698111f2fdbf74297a469038cd400c41bc8effa4465", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802319, "uuid": "d31b1a31-bf80-4f9a-9b44-b3e522ac7f23", "value": "T1ADE3BE2134E0C07BD16749B048E5DAA0EA3BF8226BB5544B37E85B6F5F703D0B62D396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802319, "uuid": "01c4b750-0f36-469f-be80-cde65a20b1a3", "value": "162ff6c25457b1f40ac1c6c4d1ab5060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802319, "uuid": "8fd69180-59df-4a1b-9072-8998bd8293aa", "value": "1536:yahteMEh3Nik3v1sR442/3i41ZbzK/yDGm49oU1QW6TF5oYl14J+PBriobhO2Yp2:xYN19o44cS4DvjD18oUMTF5osQ+tgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629802319, "uuid": "978ffd34-5285-4ba4-8054-8ab19e6acf1f", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629802319, "uuid": "10842fdf-072f-432c-ab2e-4d6e8492ad68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629802319, "uuid": "aee891cc-3dee-40e0-aa69-5aa23ff6ffb9", "value": "e724c94c5fde14451bf200e0c42d1a56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060c739c-04cc-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629803486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803486, "uuid": "3a38aa7e-3784-4ce0-8b75-019525044268", "comment": "Malware payload", "value": "8557db5993d920a52b6cbeae58336a2f", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803486, "uuid": "c9326f33-99c9-49d3-8b15-93c5eba23771", "comment": "Malware payload", "value": "ecf828151383904275fac7e728e769adcf46a23738f2f33b6d1e98e19c5b3e30", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803486, "uuid": "f849a444-57e2-4813-9808-48a02f6036de", "comment": "Malware payload", "value": "afc545a12b555ec05a0d04bc3e9d96e1fc6d9e8f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629803486, "uuid": "9338b4e7-0d7f-4840-a6cc-970d780b30cd", "comment": "Malware payload", "value": "848b8570c832636d284f2b44b4df73641f0892af15e490f5af6852a465cf45ab5418363b307b3bd67939da44fb8b0423", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803486, "uuid": "5dfb657c-c33d-4527-8887-9ffac929f473", "value": "T1EB74126892A1C46CC84E813F62D70FB1D7721A06E685BB1FD2B2B30D6F16D3E4B5B059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803486, "uuid": "9daed36f-09ba-4536-a541-702fabd26a11", "value": "6144:o78AMNsC2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNfs:1BgL2OGY/TTy2jEIJc6FNu3uPmNfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629803486, "uuid": "e4b7c913-7478-4e72-bbaf-fbcd0e79d7b0", "value": 353174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629803486, "uuid": "b083c9bf-d7dc-4026-a48a-11a9a5b536fc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629803486, "uuid": "ba84f8cc-f578-46f5-843f-01483ebcd02a", "value": "EoY_TAX_Details-1417369183_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc49135-04a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629786908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786908, "uuid": "881dc252-c34b-4b70-b4ca-c652f5363d96", "comment": "Malware payload (RedLineStealer)", "value": "29903569f45cc9979551427cc5d9fd99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786908, "uuid": "e9067b9a-5861-4eb4-9724-dd005daa894d", "comment": "Malware payload (RedLineStealer)", "value": "eec05dc9ade2a7ee74ea5fb115bdd687b457d1f81841238a61e9775d6cc4bfa6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786908, "uuid": "7fec6065-1834-4aeb-897b-321590ff123d", "comment": "Malware payload (RedLineStealer)", "value": "0487682dd1300b26cea9275a405c8ad3383a1583", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786908, "uuid": "c7583486-0ccb-4407-82c1-dfba67f135f1", "comment": "Malware payload (RedLineStealer)", "value": "634e3f8d2e7793879441ef35db429972cb3f4572dfb23addacab4e3e8a9702ce6c8b087083996eeba1dfc42d1b7f936c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786908, "uuid": "8d5d6875-8211-46a0-bd23-72fc65879670", "value": "T1C5D4EC1865BFC019C0E7EEB12DDCA8FAE99A95E3640E75371064A37B4B11B94CE0F0B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786908, "uuid": "90135670-a170-4162-9229-fdc9a62a74fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786908, "uuid": "6f87324d-ae3e-4742-bda2-bd49f8d42421", "value": "12288:+zoXpiQ70M3HvlvGWE/FckBRi+9wjQPf48a6EzMzPxiDOZ1z4/2fH:T2GlvGkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786908, "uuid": "03aa0114-434d-44eb-abc0-934cfd244173", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786908, "uuid": "505536db-011b-4597-abfb-4651a04342c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786908, "uuid": "4c4fafbc-cc52-430b-bc46-0d054aa02bd0", "value": "29903569f45cc9979551427cc5d9fd99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f4d67d-04b3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629792970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792970, "uuid": "8e59bf60-acca-4372-8660-95d89fe1d8bf", "comment": "Malware payload (Mirai)", "value": "d2db93e7411586a63f740b37bf63755b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792970, "uuid": "523e47c9-4b0f-4281-ab08-e935e9af9b7d", "comment": "Malware payload (Mirai)", "value": "ef03d1cf9073b038fb44669d896aa5bb0e153446a4bf7e21adc763bed585b852", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792970, "uuid": "47f432f0-7120-438f-99ac-6418b54a27bc", "comment": "Malware payload (Mirai)", "value": "f37960472a7f1aeb88fbf640bb12848a436feea2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629792970, "uuid": "9fa1ac8e-2c60-4225-a241-8103ff1c82a3", "comment": "Malware payload (Mirai)", "value": "8c919e34752a56bf99555dd1e59da51b689b93cd0c0f50c352a8bce28dc75d0006d1166ceea1ef2558b3241f48ba62d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792970, "uuid": "1551b8e3-928a-4388-a804-8806b72f5f8a", "value": "T164A3F972E642CA72C44306F102A79A6B0D21BE7B0A3A5E86F31C3DB49F334C97555F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792970, "uuid": "0b110563-2a95-4cc5-b08e-db82e085885e", "value": "3072:SOGAEtZoGZKWl6u4YTnbHbbimmFVcqq0G27ZT:SqEtZ755nbHbbimmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629792970, "uuid": "1818d8ef-2f85-47e2-98d1-f6af4a462d8c", "value": 104139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629792970, "uuid": "f9fb33bc-c5e8-4c93-b4ae-472b260c9caa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629792970, "uuid": "f44e19cc-dd6d-4418-a856-4fbf67bf02f0", "value": "d2db93e7411586a63f740b37bf63755b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317530de-04e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629813008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813008, "uuid": "32c9caa0-f569-4d8b-9206-dc56f60093ff", "comment": "Malware payload (Mirai)", "value": "6722358094220aee1f7ff79dfae1fe1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813008, "uuid": "09cdea5b-1ac6-4fca-a29f-2a06d328b28c", "comment": "Malware payload (Mirai)", "value": "ef3f8c623dca32648272348b33a61535702f1d18928f603397947d685500a4ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813008, "uuid": "87f2d668-f657-4ed3-b293-f749876737b0", "comment": "Malware payload (Mirai)", "value": "d63cc8af3a73d54a917d12bc5aecf6dbffabba0f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813008, "uuid": "c00a57ab-140c-4eed-9bf8-3bddc3ef1250", "comment": "Malware payload (Mirai)", "value": "f6c60d828f059ee924341321ecf7de9ba8168a75a117a58413a834302897bc519668d46a63812ae7134c71225533dca7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813008, "uuid": "a926acb7-434b-4e31-a61f-8379e46035f8", "value": "T1856319817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813008, "uuid": "79a3dad3-fe79-4f52-a57f-0cdf62617ca6", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8vM:GbtexU0r8QCKw2FbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629813008, "uuid": "a55699d1-2f7e-4fe2-a273-1224e65ce318", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629813008, "uuid": "6bbe3340-d58b-4e6e-80a7-ff4954f47dbc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813008, "uuid": "4ee5d86e-813a-4013-a41b-1155d8a4b5c5", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bbe5b1-050a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629830193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830193, "uuid": "387c5706-4fb7-4591-b606-309acedce8c7", "comment": "Malware payload (RaccoonStealer)", "value": "73a2f064162d835b3962284d33d140c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830193, "uuid": "3331cba9-90b3-4079-9048-b6e662a6c4b0", "comment": "Malware payload (RaccoonStealer)", "value": "f006a4c59daf7922ed92456c39741cd47d0c7e277473551a7b78442b2bec29a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830193, "uuid": "81625445-f7c8-4d00-aebf-83745c9d4be6", "comment": "Malware payload (RaccoonStealer)", "value": "9595a63fb6695d4952b7245831fc5cc128a0e83d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629830193, "uuid": "7819368e-24f2-4f0f-9079-d93dc755328d", "comment": "Malware payload (RaccoonStealer)", "value": "5ce03103c9996f4748cc305516f3533db179c8549d680686107e173d11fe043185bc2910e1d7284ff36627822bd8ccfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830193, "uuid": "d28891ae-ad3c-4cfc-8bcc-dbe8908f5bc3", "value": "T1E7940221B8F0C873F45141700D54CED17366B8E3B6A501473FDB1B9E5EAA2C09A6BF6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830193, "uuid": "4e855231-9054-4d3c-9854-017121905cbe", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830193, "uuid": "273bc32f-7a54-4d4a-b754-392dbaa49d2a", "value": "12288:xS9vGyQg3xZgi7GDrD2sNSyfPTmHTTtZL:xSFGyQg3xZgtfLcyHTmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629830193, "uuid": "704205ba-0a04-4390-ad47-326514a2cc7b", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629830193, "uuid": "7237281e-3f23-4af3-8633-3ca508ff0514", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629830193, "uuid": "228e8447-4580-4cad-9154-3755768b899e", "value": "73a2f064162d835b3962284d33d140c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34f24ab-051b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629837814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837814, "uuid": "ae6f23b7-0ee5-494d-bb9f-b88ff9d3669d", "comment": "Malware payload", "value": "8ad75784f54efcd3a35ade89980fc179", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837814, "uuid": "6477168d-21dd-4322-9991-8e2f9c35d428", "comment": "Malware payload", "value": "f20e0aed6b42b9dc0b586f7446b0827b1c5b4d11ed2f7e0afb4738fd1766e68a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837814, "uuid": "4e72b67e-df91-472e-9c5b-42c336bb0fdc", "comment": "Malware payload", "value": "28cbd4f6b20cf96c7da189ded73816720090ca11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837814, "uuid": "f65752b1-55e0-4668-a2b6-aee8a6f78ac5", "comment": "Malware payload", "value": "aaff329f79fe2dd201e0998b0515f10daa435174790520814c643626dcd97fa2a306a43681e33fa92e16823bc8bf32bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837814, "uuid": "cd4362e5-c829-4350-b269-e900708d6d32", "value": "T116630B45FD418B17C2D227BBE79F439D3B35A6149BD733116A387EB42BC279C162A220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837814, "uuid": "5ed005bf-9b9f-4589-bbfc-c42c91fdaa3e", "value": "1536:Rl51czNgBA879AUTFc2mQg/Ia7f7+YotfIHDF1:DczC79ypQDa7T+Y6Yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629837814, "uuid": "d4e6a857-e05b-4b91-a7fb-f462e083ea3c", "value": 66829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629837814, "uuid": "133b2025-ba0f-4013-8b30-1416eade8b9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837814, "uuid": "adb1c61a-f831-4d6b-90b1-b8a99c8a7f12", "value": "8ad75784f54efcd3a35ade89980fc179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95409fc0-04bf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629798143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798143, "uuid": "138786af-664b-4403-84df-80de646736ee", "comment": "Malware payload (RedLineStealer)", "value": "7e0528c468de5e4a4724bbc03c388912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798143, "uuid": "48c051b7-9804-4330-8df8-b379b83ab104", "comment": "Malware payload (RedLineStealer)", "value": "f3bd165982995400b2f861021e54b7b17f58fac7bf031e27a7edc34b8be0a936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798143, "uuid": "765490b1-e006-4425-a887-fad3605f261c", "comment": "Malware payload (RedLineStealer)", "value": "ccbf81d5aeeb03dbdb49a37c5e33bc1e8e287de2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629798143, "uuid": "28b8afab-4e47-4497-b29d-3ce77a3d9673", "comment": "Malware payload (RedLineStealer)", "value": "8af4e37f80919d3626b387f0fa55032babef502001a4f9c746f2b2c43ce2f687beaacf6ac8eb813641f03ba24f44db02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798143, "uuid": "d7062d6b-e483-461f-b91b-54cfb647fca4", "value": "T12EA33A2263ACCA29F7BE0A366470012587F1E0CF6442E75B5EC1B4DA1E767826644FF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798143, "uuid": "427dc384-f7e5-47b6-850b-e0345ed1b735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798143, "uuid": "41dc57c6-0c8e-4bf4-bee3-300c96fe9983", "value": "1536:Mo6aGb2CT0jE68cZVCb5IBAPpkFauKwbeVgbue7vluvNyAsdRWetx5REnG6WAaoc:MdxyCT0DAb607lOe6nlulydddNW9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629798143, "uuid": "e7066873-9197-4662-be6a-9d481fffcffe", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629798143, "uuid": "d4b4856d-4d35-4969-a696-c4a9a941f684", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629798143, "uuid": "441ac18a-e57f-4c63-91fb-63977f8c5e63", "value": "7e0528c468de5e4a4724bbc03c388912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ade84b-04a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629786216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786216, "uuid": "37c949a2-09d1-4f9d-8069-88b41bb74c66", "comment": "Malware payload (DanaBot)", "value": "9d3c2ff258c5d4c06cc51d063c007248", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786216, "uuid": "4f2087fc-a0be-42be-a237-9294e4d3d1cc", "comment": "Malware payload (DanaBot)", "value": "f43c76a153e03551456a21ebd15a07017fbabd51a1080752ddb5241f9d599782", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786216, "uuid": "e28af16b-b647-4ee2-acc0-c9f21a3226e0", "comment": "Malware payload (DanaBot)", "value": "02c3af2affe3f5b8cfcc0721e12a71df12c6c6ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786216, "uuid": "59b1384d-f849-4d28-b5c7-07fd012ed013", "comment": "Malware payload (DanaBot)", "value": "137dfd7fe9fd18ad89823d2457739cb65e6a740aeb3944911ecb276e08584d03524373ca01317627bc6872415fa71471", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786216, "uuid": "ad1bb027-5ce8-4c83-8621-f53dc2ca0d71", "value": "T1053523007A428E7FC00742B540A7EAD6DA26F871952500D63BF2FB691F313E1BA5ADD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786216, "uuid": "88eaad13-de7e-4343-9cfe-a633bb32c5a0", "value": "02fed18d5788c3d9bcc1897631bb2a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786216, "uuid": "5faa101d-b631-48eb-aca6-4781d0963f4a", "value": "24576:i5o3PDoj9ii8hW5YdFswKy+/3IJ7irH9C1Fs:i5APhRh4FwKycro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786216, "uuid": "5514b2d2-0b84-43f5-b55f-9374bfc333ba", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786216, "uuid": "b5900b4c-31f4-4745-88ad-581ebceddf61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786216, "uuid": "c414a223-166e-4dcc-8f90-59b0cef95cbf", "value": "9d3c2ff258c5d4c06cc51d063c007248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3986ee4-04d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629806381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806381, "uuid": "50f3977c-2ae6-48c9-a65a-d539317c50e8", "comment": "Malware payload (SnakeKeylogger)", "value": "4afc9d94860ac778b73732de221d5816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806381, "uuid": "979e1336-d751-4531-90a9-8af79d5e20da", "comment": "Malware payload (SnakeKeylogger)", "value": "f45329159eb496aca8c17ec79ffab0118bb39def014de362340c8c04ce748ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806381, "uuid": "374f3463-69e8-442d-ac5a-4ce917479a24", "comment": "Malware payload (SnakeKeylogger)", "value": "27bc2a20cf7e355fb6a72ec197f9a91e01cfbd4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629806381, "uuid": "f8497ab3-d61b-44bc-9a66-c89df4a22874", "comment": "Malware payload (SnakeKeylogger)", "value": "2827f3873423f2051fe821370e2b6c7fc31a9f3eb46135ff6e1cdaab88d8f431ba94bd75a09eeb3de0ee748422ed8818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806381, "uuid": "7dbb6b75-218e-46e9-8e4c-c7488393046d", "value": "T167058C3063C9C294EC1A8EF0167CFB9402F275E7B6C5CD6A16DA720CCE5E8D1261769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806381, "uuid": "bd5c8ebb-06db-416b-815b-34e796ddf91d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806381, "uuid": "9c68029a-dc0b-4082-bfe8-59b5b1ddb2ea", "value": "12288:igcsGI/cSJDttuKTByPRYfrXa4P1IlGwlwyfZZi35dEXRm2EObbv:iOtF/frXXPmipkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629806381, "uuid": "e3d9a4fb-9d17-4f7b-acca-b5d9740faa07", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629806381, "uuid": "6aac5bcc-d798-4986-8831-9c1d2f7ccada", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629806381, "uuid": "fac8af24-9ae3-46cd-8555-f62c972868ef", "value": "QUOTE 24082021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb57c7f3-04e6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629814957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814957, "uuid": "c50b0960-2f2e-4bca-802e-3a30cfe9af58", "comment": "Malware payload (Formbook)", "value": "b3104364708fa64e5242cbe54885ec56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814957, "uuid": "4bc827b3-5b95-4464-94ef-104e373ebe4f", "comment": "Malware payload (Formbook)", "value": "f4abecbd1a56abc36103d0595086bfd31c50f33236b9431b53860e5c1e20c2a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814957, "uuid": "d1e534ef-dea8-4238-9477-91e009232039", "comment": "Malware payload (Formbook)", "value": "4be2064313b2f72e472b8a81797e7b14a5b3aec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629814957, "uuid": "197ed4f3-e879-4521-9d05-ece356d06dde", "comment": "Malware payload (Formbook)", "value": "7dabb62da624f1b396383863fccdaccfb36f50f01f730e844b3f491baaca17afb6160dc44f361135e3f5dbb650993e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814957, "uuid": "c08b93da-81c6-4bec-9a61-9669f6a5fc58", "value": "T110341210EB2AC922FD4A66793C238F65DD453D1623C98CC396A93E6948F1FDC51312FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814957, "uuid": "39d153d4-1607-415f-92d6-765e1cbc4c01", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814957, "uuid": "60b46ccd-6d9d-4b2f-8ba7-ed929a97da6a", "value": "6144:2wVqCOiGWu2dw9r6bDo78j+JEwh3pc8aMxfcPbwoP:2KyWhw9x8spc7MiPbwoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629814957, "uuid": "82cb9445-a8f7-4ba6-ae32-d9f39526bda0", "value": 232574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629814957, "uuid": "65be75d3-eff4-48dd-9973-f0b2a002d6c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629814957, "uuid": "c2aa8dcd-df37-4578-950d-cf2d0cb72b8b", "value": "b123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf53d68-04a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629786801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786801, "uuid": "dac1a81a-2723-408c-9f78-1fd0493766be", "comment": "Malware payload (CryptBot)", "value": "c28030a4a8e623427f69412a8fd5ceb3", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786801, "uuid": "4ce04779-806c-450b-8f0f-48000357ef97", "comment": "Malware payload (CryptBot)", "value": "f4bb809b2c49c6106a1fda12ce05f7f2db60f2fb56f82b2f0fe9b3dd748c5f3e", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786801, "uuid": "86ce7775-d3d8-4313-95c6-58c89ee0c233", "comment": "Malware payload (CryptBot)", "value": "2b1bfb02602ca1d5d661f96abc95cf299b848530", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786801, "uuid": "a23c58f6-1c7d-4ef9-b597-f67ca0f2e0da", "comment": "Malware payload (CryptBot)", "value": "de9b76b53d952d2008cc2d7e2c839e32ea78574912a3f15382dc30cdaa83eb005e74eaaf1a0d0bbbee33e948b9473569", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786801, "uuid": "80e9c3f6-f2e7-46c9-bcb3-7af53bb0d76b", "value": "T1D0E533762265C7BBC57584B21D83B77C092A4F3CEAB16BE61A1E96C052D48FF0737890", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786801, "uuid": "04986c0d-3a9d-45a2-9843-8fb95aac7c92", "value": "f8d9e6f58bdad8d3f277d01c805576b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786801, "uuid": "1187d362-c02b-4120-871b-da72fd8f99ba", "value": "49152:cC4McpouDoYZFn9PhD0H+TQpi0skvCduYN2aEf7h3vYoMIwc5aOt12o9Fn63kjz7:V1czEkhthD0LkJUzlQvi12o9F6Ujmih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786801, "uuid": "273731f5-f28d-4d2b-9d78-775042e2636d", "value": 3205120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786801, "uuid": "354db7df-116c-43b3-bd9f-3a21c05ea7ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786801, "uuid": "dc6fb92a-e53a-4a63-97c0-67cb3117a2e5", "value": "c28030a4a8e623427f69412a8fd5ceb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f613ca5c-0501-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629826652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826652, "uuid": "c3a75813-29d2-4734-afc6-bd13c62c768d", "comment": "Malware payload", "value": "230340ff9daefba2d4876a53bdbaf632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826652, "uuid": "caeef09c-2047-4fa1-9891-2ca9430cfbfd", "comment": "Malware payload", "value": "f4e1fc78ba0a65bde5687a67eb89e20166e062356b77227c9e0211060bd14dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826652, "uuid": "56777f3d-cfcb-4437-b51d-359a1c509f46", "comment": "Malware payload", "value": "fde93145500a33d1006f7bc39a9f447682b85e8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629826652, "uuid": "e47b5ea7-187a-42c9-b068-082e68b0bb61", "comment": "Malware payload", "value": "cfe74b5dfabcf7c9698a6d2659e24ac5252c6cd8bcde1c6da70af0f3f1d149c56345783e437f09d8877bb13f7945ae12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826652, "uuid": "ac310a8c-267f-4c67-a62b-33f56ea8789b", "value": "T11414CF0032A0C973D75A017144D6CBA0E629BE716EB5864337E9DA5F2F312F17B2B396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826652, "uuid": "dadd4859-5df8-498c-9762-24a265e59656", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826652, "uuid": "eb5393da-2fa3-48f7-b2f9-f28fa57bc295", "value": "3072:WGIpCLhRFYKQF5gSEU6H7JQKtOgMRZafD4UA1b:WGiCLhsoRU6HD8bEcxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629826652, "uuid": "6183daa7-d276-4945-90ca-4a247f026477", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629826652, "uuid": "e0e52805-5b9f-4253-b20a-982e0e2f88cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629826652, "uuid": "822726eb-719c-448f-8cad-26377ec8019c", "value": "230340ff9daefba2d4876a53bdbaf632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681072a3-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629805368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805368, "uuid": "7f96eeae-fe93-462d-ab20-22aa8c359409", "comment": "Malware payload (RedLineStealer)", "value": "44bd483ec703442a2ecf6ea52e7cbacd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805368, "uuid": "ce1dddc1-a6ca-4094-a901-4366ce70835e", "comment": "Malware payload (RedLineStealer)", "value": "f4ec629473fbe96fa82fe1c1e30e6784144163d662e1c977acf5bc1d62b20c0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805368, "uuid": "c2c53aea-5808-4259-a4a6-f020c6a19dab", "comment": "Malware payload (RedLineStealer)", "value": "5438628759dc6347f8988cdcf5bc68ca67d9acc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805368, "uuid": "3e402864-a821-4b2a-9794-32e376a8fc2a", "comment": "Malware payload (RedLineStealer)", "value": "dc0e30f03781c6690946a068bd39b7c7654f8ed233012cfa2b23c63c5faabd8f20904e4af0cf1212625144475d14a3f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805368, "uuid": "464ad377-3f5b-41a1-aaac-f1f32bf9e629", "value": "T150C4F108A7F943BDD3AB5EFEADF496C317B4761BC623931E4689271819022B786053D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805368, "uuid": "21803e60-9533-4335-8a12-9c2f1e641c39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805368, "uuid": "636fb944-c896-4b60-b50c-951fd2c2aeee", "value": "6144:jYCWVJNY39gj3fHzeiLMyB12ZUhzg1RolNSo1Bofet3Agp0q9ygbX+1RzDU8:C3Pz3LP2CMLovDLosaMJcR/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805368, "uuid": "e879be4f-0e2a-47c4-aa90-31bb3780f284", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805368, "uuid": "19ac6ffc-5e96-4f84-95c9-095b7e199975", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805368, "uuid": "4a65c2d1-ca94-4a37-a6cd-bc69f9bbba0f", "value": "44bd483ec703442a2ecf6ea52e7cbacd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5084e2-04d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629805721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805721, "uuid": "b8c4cb40-d0e8-4f92-afda-ba15919665ef", "comment": "Malware payload (RemcosRAT)", "value": "256876a198e1b3f8e579ab00a4615e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805721, "uuid": "06550e07-1e2f-44a8-9d25-cbc258897d97", "comment": "Malware payload (RemcosRAT)", "value": "f5502d660f4b1f1110b7ba4fd0eab36ec5b44ff97c12b146a48ff8e38efa4745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805721, "uuid": "d4876c93-2f3d-4311-8a64-91abba8576b8", "comment": "Malware payload (RemcosRAT)", "value": "37cf76305eca785a9e76f102ad364f21e1f2ffb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805721, "uuid": "b538a002-ae16-447d-8089-877d4c0a7d0e", "comment": "Malware payload (RemcosRAT)", "value": "0aeffdf1805d6f7263c54549dcc8db3aadb965a5b624f98308d8850a2d512ec083708b3881b07dbca4d30d3366bf9f32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805721, "uuid": "9c8d181c-bf0d-4df3-b58e-6ae80d4f317a", "value": "T1CAC3C8D35B211824D3B52C70A8A7BDC123159F155EC35B3F21CFEAAF29A0792A5C734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805721, "uuid": "a1b2c58f-1b58-432c-ba2b-9c923395c608", "value": "c65aff2bab39ef464a2bad0c06b18bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805721, "uuid": "a9519753-69da-426c-8064-f9e0708ca588", "value": "1536:xjHslPpuCTL13mdJlU25vO5l5b9bBIb49RVxFMy/Y5SqYzAtnRGfa8ethrYUVDV7:quK13y5lW51BM4p/QtRGC7hrY+VEosW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805721, "uuid": "5975b1e2-adfe-4a30-977c-7c85728d6a1a", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805721, "uuid": "d29bad86-3d0d-42fc-93f1-b7b04947bcc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805721, "uuid": "98965d31-daf7-41b3-b9d3-8c57765fb7bc", "value": "256876a198e1b3f8e579ab00a4615e73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89466f23-04d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629808001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808001, "uuid": "c7ed2ffe-7a51-430f-9393-a8c2208e40ad", "comment": "Malware payload (Formbook)", "value": "5d4344f2c377b22297ddeb0c98fa3e4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808001, "uuid": "34c4bbb5-f4e8-4b7e-9ff5-be4819078e9e", "comment": "Malware payload (Formbook)", "value": "f5572f8b1de7c0c418f9acf1d30896bea3ca9dfa369b0f27df851ea69e36cb4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808001, "uuid": "f6a4a2e8-22b3-42f7-ae3c-bb9f91c4428b", "comment": "Malware payload (Formbook)", "value": "f2552a1e584040b9a0eb9129e5ec8fc10f4072d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629808001, "uuid": "72e6fc59-257b-4da9-bd6b-708ebb98c95a", "comment": "Malware payload (Formbook)", "value": "818ecb4a9cb15de1dc86e1c5d3b541fdddd629b4bc0fe833e18a3ed1115ff76f1730e87ae5d1b003cedb6e0c053e3c16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808001, "uuid": "688bac5a-3c4b-474c-b567-a75e3618a80d", "value": "T1B4159D3063C9C294EC1A8FF0167CF79502F235EBB6C5CD6A16EA720CCE5A9C1661764B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808001, "uuid": "67337eeb-9fad-4e8e-9c48-53e18c267561", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808001, "uuid": "220e8f92-7201-47c6-9b20-081e62d9dc24", "value": "12288:7NcsGI/cqpxtozFusYAinX8OeL8cMmXq1yv94K7WW7eW/Yt06av/t2EObbJ:75tozFBWsScMwKyv977W0At0PXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629808001, "uuid": "48e62c3d-ed90-4162-be26-cea3ed60386f", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629808001, "uuid": "06e80fd6-69a2-4579-b9f5-e4e0b7ad62b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629808001, "uuid": "0f5b44c6-2fc4-460c-8051-63ca8b2d4e05", "value": "5d4344f2c377b22297ddeb0c98fa3e4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa1c615-04d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629807421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807421, "uuid": "5d708def-c46a-4018-930e-3af7c879b04c", "comment": "Malware payload (Mirai)", "value": "c5e18681e3a4e472bcecd10bd542be74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807421, "uuid": "94c1e89a-d154-417f-b1ee-2f4a55c8df14", "comment": "Malware payload (Mirai)", "value": "f6054d1dcc917148e61aa1831e90032c360c8fddb32af6509ff9cc6f72f7959f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807421, "uuid": "8d757111-2e3d-4268-946d-cef2cb575d32", "comment": "Malware payload (Mirai)", "value": "a84d5a84eb3d5325e26ee12d3af6a884a84189c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807421, "uuid": "4f230267-41cd-457a-9d95-242ea7408cd7", "comment": "Malware payload (Mirai)", "value": "c28899e84fc728da73535438d28c115fd8720cd915199181319d19a0c7ef98dfe90fd6eefa6d7e53127511276a4af17f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807421, "uuid": "b83f1974-ca9b-4763-a361-0eb0cbc8e595", "value": "T1D66318E7F801EDBDF81DE73B4847090A7270E3A14A821A366367741BEC7A0954977F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807421, "uuid": "2b48e5f8-4f2e-4826-9b57-f55c5f60212b", "value": "1536:HFK1524BZEZ8QYrsj8B4JcUfLmty4DMJ1DbtEf/C05U4Br:HFEL7EyE8ueUfLmty4Dolbtp4Br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629807421, "uuid": "ab586ff3-75e3-42f8-b655-1c993beb117d", "value": 68084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629807421, "uuid": "6af7eec8-0eda-4007-80f0-e99604ffb646", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807421, "uuid": "11a2164e-69ac-411c-bdb3-27a5e433919d", "value": "c5e18681e3a4e472bcecd10bd542be74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382c9de0-04d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629807435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807435, "uuid": "3e2a5d68-5793-4e0d-9e70-be97b3872be2", "comment": "Malware payload (Formbook)", "value": "3944f145debc1534644835299f350f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807435, "uuid": "460985e7-d081-49a0-817f-e1fda8b59d1d", "comment": "Malware payload (Formbook)", "value": "f658ac4fbbbd6c505cba225df9a6d177ba3de7d4a12a034df4ef17ae288cf069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807435, "uuid": "13ee18c1-dd4b-4b5f-b014-dfc11deb9d31", "comment": "Malware payload (Formbook)", "value": "c6f893c4f5afcfb0720fe957c9a800c2613a1c8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629807435, "uuid": "d666deaf-235d-4d56-a3cc-fda6d55f5f88", "comment": "Malware payload (Formbook)", "value": "711120f5d777fe898eae4e58bb333e0b0ad23114111d5e95ddec2e180eac321dff4ef8089f4d8f38f243ed0efd36924b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807435, "uuid": "830a8ceb-bb4c-4fc1-a4ce-7659afa6d220", "value": "T18A158C306389C294EC1E8FF0167CF79402F235EBB6C4CD6A16EA724CCE5A9C1661765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807435, "uuid": "bcfb8d37-484b-4537-8beb-4fc96b0d5eae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807435, "uuid": "2bbf18bf-8cdb-449c-9743-0047a2ef3e50", "value": "12288:RYcsGI/c4BAUkpdzVRKc2ELz2DcNnJ+pn71STXvyG3bVuB4vI9pTx2EObbl:RCAUOdzVRlrLqDc232bYiA9pN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629807435, "uuid": "7664c1a7-1bd8-44b3-903f-e7574f11cb39", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629807435, "uuid": "4707615e-6124-46e3-b781-f6e950ba23f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629807435, "uuid": "9fb4cb9b-5afc-4ca9-b970-0811a991fc84", "value": "Purchase Order.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89fc7e1-0479-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629768191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768191, "uuid": "260dd201-f0cf-44bd-973e-82959521d2d4", "comment": "Malware payload (CoinMiner)", "value": "df466035296d8df2cf390c3a291caebb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768191, "uuid": "2cb5cac0-7f2a-419c-8e10-db804138763f", "comment": "Malware payload (CoinMiner)", "value": "f74c97d626730018ba9a8dd5e6fb806bfcc42d15a8b20ef328cc5f0d6a052ccc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768191, "uuid": "71690641-375e-486c-a098-a79e207ee464", "comment": "Malware payload (CoinMiner)", "value": "34c423a440f0cd520e2208cdfc3624c87f6e1729", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629768191, "uuid": "47031d3e-0c52-4444-b120-de3999d13643", "comment": "Malware payload (CoinMiner)", "value": "3e7cafc29ddc974cbc9643ac882872509756ff675268a35c797b746269ac633a15c41ca2be7190f66eab8fe457ab2a1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768191, "uuid": "2d83c75a-1bbc-472b-bedc-6ad81ea17182", "value": "T12AE3BE2035E8C037C451453148D6C6A0D63BF866AEB185073BE8E65F6E753E3FB262A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768191, "uuid": "0818bf03-2eee-4788-ab49-822cbb85af07", "value": "7f519e58768c36b2651aa4c0b9c28c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768191, "uuid": "3c3ee56f-e69e-47f5-acf9-216f04f651ba", "value": "1536:Rh4Ze/M/PYQ7kTAOoLOjGqDP4PL8BOdeKGnOG+ZeK/7Px5AYdHMKa12x11JATEL0:5+YQ0gayg4T8YIOGHqzx5ALwv1JQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629768191, "uuid": "8f6748e8-15c5-4715-a77f-91575241bfaf", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629768191, "uuid": "5f4f8343-a1dd-41a2-a8fc-6926ce6dfb83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629768191, "uuid": "5e9f844b-83c8-458a-90ba-13734e4df63f", "value": "df466035296d8df2cf390c3a291caebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb2f4aa-04b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629795607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795607, "uuid": "f0695e0c-2dd9-4b67-93d9-479dc1e07f73", "comment": "Malware payload (Mirai)", "value": "5de4ee5a355b795b249108f244fe576f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795607, "uuid": "dfe22ffb-e303-4bf5-a556-5d7dfc710bbc", "comment": "Malware payload (Mirai)", "value": "f919dcfbd9f40ce299e15b87f2672c12be4c3d0856c542c6c470d3b7ea9734ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795607, "uuid": "2acd9a23-9a73-4eb2-b384-675ea63a7dc7", "comment": "Malware payload (Mirai)", "value": "10eafe1c76ea95a2ff1bcdfb07bd7a9f195c94b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629795607, "uuid": "a2692e86-9223-48f3-b191-64e5fa15be83", "comment": "Malware payload (Mirai)", "value": "17e3e7d65085d1a41d07fe1b37b10c09ceb0a3d57e82d984f57e824dc073b5dd63f514c9b7bcc071b0e735d212fade4d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795607, "uuid": "52bbe9bd-3529-4ad7-ab24-7f036f9272b7", "value": "T19EC2E07016863B21C66018318C79C7C66F2737F8916DB8E614790AACE0DBA8F657DBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795607, "uuid": "afa18b87-f602-4d13-9754-b7b0db1b30a3", "value": "768:dQaaX8dMsZUIj84/11d5PKBEVXjvI4MSQP5ps3Uozbk:dQaaXP+Fj7t1KmFwSQOzbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629795607, "uuid": "a50fbd83-160e-41c0-a5b1-7c42fc34588f", "value": 27928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629795607, "uuid": "3b39d582-b189-41a9-910e-56f04bdea55e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629795607, "uuid": "6732e659-e70a-4c3e-9504-1c2d0d03f153", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee34ce72-04d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629805593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805593, "uuid": "96ab2afb-ebe5-4448-9210-4ff47be08402", "comment": "Malware payload (RedLineStealer)", "value": "ad9d32f656a53feb70f09fa54040b9c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805593, "uuid": "06ed3f91-d087-4ff4-a2cf-b453fa1aaaed", "comment": "Malware payload (RedLineStealer)", "value": "f98183a2ad674f8aae6ad47e7da8b48c80175148ba333f0f57b3e6eca64bfaa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805593, "uuid": "b30b858e-155d-4fb5-9935-1fe1a13def52", "comment": "Malware payload (RedLineStealer)", "value": "dd4883dd089ef1490dc018eaaa6ed72b9b26f79b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805593, "uuid": "2ddb2565-2386-4403-bbc9-18b13e2f8a06", "comment": "Malware payload (RedLineStealer)", "value": "527759b7ed42d48cc2d583ed519fd15c18e329111e8c985e9b3ce1bcdd5db0de2869ce86ce6c4361f44ae660f6b548b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805593, "uuid": "2bf58170-04f4-4c9e-8fd2-c48e709a4250", "value": "T19CA4F0AAB1E02088DBB581B7D5525742EB3174710B21A3DB677853B71B2B8C69F3D3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805593, "uuid": "70d535f9-2446-469e-9e29-4948b0098203", "value": "f326f88ca83c9aacaa44acfb8884f1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805593, "uuid": "c538b44c-1f4a-4e0e-9dff-4e6feee0e5fd", "value": "6144:K5oaqJhJMHW69B9VjMdxPedN9ug0/9TBahLglY0OVhDrSDHskLyb5ILSijq8FZ66:K5oaqjp/9TchAkIVokSij5j6gGsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805593, "uuid": "12c9edb1-f6d6-4ff2-b014-3ce59a430a00", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805593, "uuid": "deb3c51a-0ebc-44fd-8806-165e4d85a03c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805593, "uuid": "37791153-896a-4b3e-80b2-6168a397e366", "value": "ad9d32f656a53feb70f09fa54040b9c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617a725b-051b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629837569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837569, "uuid": "57ef4fc3-dbc1-4b29-9517-d11742025884", "comment": "Malware payload", "value": "6b31959fc87f3f34dcdbe3d3ce5d97be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837569, "uuid": "245bffbf-5707-4c09-8b99-14d64bacb6b2", "comment": "Malware payload", "value": "f9f6cc9701be933fda8d378231d2c56a5fe9fbb7d3bc66944a2337e8894f5030", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837569, "uuid": "3d2b99d6-17fe-4ae2-9907-dc5003e020d1", "comment": "Malware payload", "value": "01ad6a59f98ec6467010c0559297650f9bfe544e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629837569, "uuid": "5e02ccb4-b3ae-4413-849a-054769c9dd83", "comment": "Malware payload", "value": "b5b44947952a9f93e31c3a1dd6227998aafbfdeda0b802642e376a81c4561952a68016b3ebb1d437c0ac7dbfbb22767e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837569, "uuid": "9ec1fdbe-e772-4a14-93a8-3bf6d1f82e65", "value": "T1E7432813771C0F93C06BAAF02DF727F187A6F96016A75285E20DAEC45332BB02916F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837569, "uuid": "8e1d0db9-f5fa-4720-9505-5e171b10a717", "value": "768:2OCO8/2wwgq9x2HmTTuaJqfFDCtKp76iNeIAHFD4e83S6v:2F/6gExCqaaUC4p76iNefl8C6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629837569, "uuid": "6bab2da9-91ac-4b8c-a137-b6adf1ed6ef1", "value": 60081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629837569, "uuid": "48b40789-d09b-48df-92ce-4528f1063409", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629837569, "uuid": "5e8a41b8-a016-410e-9114-084bd5e09d32", "value": "6b31959fc87f3f34dcdbe3d3ce5d97be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575130b3-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629804911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804911, "uuid": "7ab02049-9042-4df0-9b79-77a0a0118ecc", "comment": "Malware payload (NanoCore)", "value": "26142a66164165431d44e1db84a185de", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804911, "uuid": "617892b2-4de7-4487-9c4f-4d768f2f18c7", "comment": "Malware payload (NanoCore)", "value": "f9f713bbaade69598402ff54432d4bfae8ef1da04293939fd8f3118c168243ce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804911, "uuid": "d7cdded8-5c28-4c81-89e5-6b01dc5102bc", "comment": "Malware payload (NanoCore)", "value": "ed5165730618ea57b52ef2619193d1bdbff74094", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804911, "uuid": "8384d393-f304-44a7-9a52-608a8a29a56c", "comment": "Malware payload (NanoCore)", "value": "74948c0f67abab09af42295fadedf8aead6a98d9c4f7518c4022806d2120e46132d6e59ce6bcda180312ee25932771a6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804911, "uuid": "ae728e39-8547-45e6-b297-ac4450a6e6ef", "value": "T188B34EADD19702A98F8657B86B1F5F05054CBA2DF754A273723C9B306BD2CB7812293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804911, "uuid": "f802b7a2-bc50-49f4-bb52-4fe8a6dabd28", "value": "384:ey1XwrVXe0+tTjDDCZcuRzmuSSLQt2HbiWAM/JRi:ey1XwrA0GDWOF5p8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804911, "uuid": "4c740363-d783-4c02-b5fa-30e7d84638b3", "value": 108081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804911, "uuid": "9e1d299c-6006-495b-8a6d-dc1ea5b7b2f6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804911, "uuid": "e514ede8-19ea-4c85-abf4-5e9e8f07212d", "value": "TT_ COPY_080190211.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ed18eb-04f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629819424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819424, "uuid": "6dc4f1c9-3839-4379-ba6e-c3d928b1317b", "comment": "Malware payload (AgentTesla)", "value": "83d3cc4cbe3d794077935091dd403a38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819424, "uuid": "5b69af0a-1816-4565-b14d-b271285eff96", "comment": "Malware payload (AgentTesla)", "value": "fa88c9d7dcfac75ae440673f335e4da8faba4c9fe4d500ae5de053425e69910e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819424, "uuid": "81c405a6-f9bd-488b-9024-578964c25017", "comment": "Malware payload (AgentTesla)", "value": "d8fa6120afca65102358ec2756b621a5c516e7e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629819424, "uuid": "3e012b34-c0d0-400a-a9a2-419d450b4130", "comment": "Malware payload (AgentTesla)", "value": "6ccb6bdcd0fbe4b68cdd9aa31fb936830de35f8275ab46ea640f3d3eba807b09f5e444186df872c067a460622acd1d9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819424, "uuid": "7a336dab-6ab8-4877-9fad-da2dafe32876", "value": "T16715C3BE1ABDA2278175C6B5EBE74417F0409B5F3411AC257AC203560232A7BB5F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819424, "uuid": "581228f4-5aa1-4969-864a-5e14142db163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819424, "uuid": "49f70a58-385e-4402-94ec-030aee2edb66", "value": "12288:8Bonujitmy7DJhbAW2RE4NLAHfqqzS8mHvk1tAuWoa4QVbK:yonl4yHT41kfqqzQvk8JV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629819424, "uuid": "5f198b10-e5ae-436f-9d25-b569a30e1e51", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629819424, "uuid": "e06bded0-caa7-4c58-a83c-0e871bf8eb3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629819424, "uuid": "12f27cf0-50f7-4536-94f0-17ab7e1a2f30", "value": "83d3cc4cbe3d794077935091dd403a38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50af00e-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629805175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805175, "uuid": "7796079e-6d42-4bb4-b4e7-58804338c7ed", "comment": "Malware payload (AgentTesla)", "value": "7b33f6cb222505387a69ea5ea03ba059", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805175, "uuid": "7ccd95c8-27b3-4c33-b378-f63cebebb78f", "comment": "Malware payload (AgentTesla)", "value": "fb909739c9511461b3b46e51f8bd4cd8bc879e251d41782d9d523bfc7ef686f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805175, "uuid": "8af81b6a-38d9-4843-a5f5-c3dfc7c88998", "comment": "Malware payload (AgentTesla)", "value": "3f075cc547e4a8e3f51ef8ae75de64fd1a799f1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629805175, "uuid": "5735c60d-ee47-4e6e-afc1-ab6df9c0102a", "comment": "Malware payload (AgentTesla)", "value": "a1e7fa41859e3cfde15d2e1dc6f66765d5e9bbc8d0b7c11fbfb580733149f6a1e81e0f484f118286dbaff6c1cf6096a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805175, "uuid": "d4d87c7b-c900-47f4-acd4-a71eb37dbb3d", "value": "T1B7057A318404B91FCEEF1F87B5102FD37C78287BCE155058A98F16B9AA68238597AF74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805175, "uuid": "4e27983b-6354-4f75-a572-7f2e6b6e7cf8", "value": "24576:QgwOm2uZRZEVOgKGLsDdt5AWvUpHVlpNRVBlt+kLEHf:Q8Yk/K9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629805175, "uuid": "509a4bd7-ba15-4924-9d2b-8afc253cc20b", "value": 823155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629805175, "uuid": "357f6e67-c457-450f-883c-942c3fd82416", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629805175, "uuid": "9b499672-4e26-415a-8bda-16d64473ba9d", "value": "inquiry order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2abe68c-050d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629831720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831720, "uuid": "15b2abf1-3fdf-4ca2-997b-e930ad0287c7", "comment": "Malware payload (RaccoonStealer)", "value": "af175128a823db1274fc244d8f5a46bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831720, "uuid": "40f6866a-9c71-4724-b0d4-4b149696c3ba", "comment": "Malware payload (RaccoonStealer)", "value": "fc10619c7cb6b5de6ba8f58fd3ff889045ef77ea4cde4de7c5f313dbef1a7bc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831720, "uuid": "213360e0-57e2-48f5-9e76-0fb298f0d2e8", "comment": "Malware payload (RaccoonStealer)", "value": "9d67400fb5818a6c573c36eac8650458d7f1d07e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629831720, "uuid": "0abbf54f-3cea-4e59-9f79-3f8390066440", "comment": "Malware payload (RaccoonStealer)", "value": "87b4585628e414470f94171d403704994e50bf9eb0cc0e067920d4595a59a291a034e1c59474ddfdbddb26ce23e4a6ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831720, "uuid": "d1d0473b-7234-4c80-9fb1-0b56f7745734", "value": "T1F80733E14230E26EE3796C7C3CA5953FFB785CE25A4E37170F84B4C6A6786C92A14493", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831720, "uuid": "3860e6c0-bc1b-461b-95f2-f0761ef01dba", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831720, "uuid": "904d5e1a-ed40-4448-9c43-caa23681738b", "value": "393216:7Q4l1FoGr1o4X3LKq/LnF+aOeuKAxt9zpaz3y6Jqx5mDsLOVEi:7Q4l1Fo455LnVupJpa2ADsKVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629831720, "uuid": "86836dfa-5cdd-4f19-a592-dd109b3504a8", "value": 17433353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629831720, "uuid": "5ca5811c-5bd9-456e-9720-b4cbaa6643e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629831720, "uuid": "e7029995-9ae0-44b6-921c-dec75a632de0", "value": "fc10619c7cb6b5de6ba8f58fd3ff889045ef77ea4cde4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6298a382-04fc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1629824257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824257, "uuid": "4dd85e8a-922f-4cec-ae46-ed990d36ba94", "comment": "Malware payload (Hydra)", "value": "f5beab46dd72473a4d1cf3339ef6aecd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824257, "uuid": "157733c5-2cfc-437a-bf8f-c2bf0def9524", "comment": "Malware payload (Hydra)", "value": "fc2e4bb692325fc6c3919b3961eb74ae0852c80ff2f02d2438bc45ca9d8be0fa", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824257, "uuid": "771888fa-d3e8-4597-8183-939bf4661726", "comment": "Malware payload (Hydra)", "value": "0c4f9b6957c583b554b2ec595eb0158b3a3ed13e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629824257, "uuid": "d9c7a65a-f866-4c40-a373-138634f90fd8", "comment": "Malware payload (Hydra)", "value": "153aab712fdcbc04b0e1117d6c715f936a69a3928fe7b16afac4e6af45ce38c1a00f5789e2e40f2e4c98eb6a7c10fcce", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824257, "uuid": "4cbd06ec-fd09-423f-88ce-1c60882528f9", "value": "T14EF533B9DCC2DF8AE54FC07140CBEAE7D4064A456526F0975BAC23580021F6FDB92DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824257, "uuid": "96e7244e-6c5c-46f0-80a2-316c37583975", "value": "98304:7Tv8nFP88EEdvvnJIgCP16rt5qiTSIqmeWNxWlzLrXR8cB4e3W3t:7TvWzJvJI50neIqmeIxKpBf3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629824257, "uuid": "14561434-0078-461b-bc97-b6be1fc0a891", "value": 3367537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629824257, "uuid": "c0e89b5e-c8f3-49bc-a8bd-3cc556a99219", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629824257, "uuid": "cc4e2854-20b0-4413-8e69-e12d574e00fa", "value": "69437_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09661ebb-048b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629775574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629775574, "uuid": "eec7b17a-1416-4ec6-8a10-346edefd6fff", "comment": "Malware payload (RaccoonStealer)", "value": "98850987581febd7e726c9a300831b31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629775574, "uuid": "414cd6b1-b05a-4b8d-8cde-4d13f57b46df", "comment": "Malware payload (RaccoonStealer)", "value": "fcbb50a296ee18e6b9faa18e6ccc93294d0068307e1e01d7edea2603d08add81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629775574, "uuid": "d27249c2-7389-4ce9-8ee1-67df6d848f81", "comment": "Malware payload (RaccoonStealer)", "value": "b10346bc080b14f00ed589b623395b1b1e2eefa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629775574, "uuid": "37f31b7a-df0a-4f88-9b6e-738ff08267f1", "comment": "Malware payload (RaccoonStealer)", "value": "0ec6b062c72c015653419942e1fb56f846655c5a27c50504c30dac9081a246974bed3d85875c3e8228df8cbc8ed76607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629775574, "uuid": "2b74097e-c948-4f6b-a38d-cf9972b48085", "value": "T1C8B4E120BAA0C138E5F712F459BD93AC79297DB06B3051CB62C626EE62376D4DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629775574, "uuid": "4a9dd3c2-5e13-41d7-ba44-062238a64874", "value": "74369709aeb55fd7f8dd333fd3dc6eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629775574, "uuid": "7ae587bc-b004-4ac5-814b-d9d979e596c8", "value": "12288:SD6Wg3bRfpM7CwBOhSLabziBBijcQY/GSsMXmrp:So3bRqmSZBVKSnXmrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629775574, "uuid": "5efa17eb-81f7-4f42-a832-dcb7c05e2cdf", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629775574, "uuid": "26aa3e04-451a-4b21-93f6-dba982149e4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629775574, "uuid": "e4ed5c8e-2d5e-426b-afd7-b12482545abb", "value": "98850987581FEBD7E726C9A300831B31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321ed1f9-04a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629785521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785521, "uuid": "79754d35-6f0e-4917-88c8-656134947279", "comment": "Malware payload (a310Logger)", "value": "6c90d471c7fa59b51f1a820b0fada9e3", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785521, "uuid": "4f0e3378-322b-46ca-827c-0ffe292111ed", "comment": "Malware payload (a310Logger)", "value": "fce1e5d65d8375a41cd61ec690febb3ca3d2b6745194cc7b0f54727bf48197a9", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785521, "uuid": "3ea896e7-4881-410f-8eb9-bb22406866df", "comment": "Malware payload (a310Logger)", "value": "b3ec13231b0bf2cd938c8edb531f6fc087bdb083", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629785521, "uuid": "1a3c9fff-c792-4a24-88fe-2fcf9380e3ef", "comment": "Malware payload (a310Logger)", "value": "2fe58634925fd4d4f26ae138bc36c058f36ef53230fd9f8718088f47fbf44dc84e5bb84b778c8cba918835f857a50980", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785521, "uuid": "26c965b0-1763-4bbc-8b5f-f3230cb4289d", "value": "T1A7B58283EA3AFD27FA6C38F5E888D9A12C1D3D650AE3747239BAF76E94335115700152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785521, "uuid": "3be56493-6208-473c-b99a-509dbc58bb4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785521, "uuid": "5bf2181f-b736-47fa-9a5a-7823293979fc", "value": "12288:e7tckxtGtCP7svhJrXFlrO02jle+qcs2eXNPnrEdrE:e7JxUtAsvhRDZO/qcsxXN/odo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629785521, "uuid": "ce521074-d147-42e2-8fe3-302dde7be59d", "value": 2438656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629785521, "uuid": "1ea15a86-d800-4cd3-b383-834626c780b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629785521, "uuid": "f772c98d-a29e-40c5-9ed4-b32a8c54161e", "value": "QL_00120721100IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a494d0-04cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629804834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804834, "uuid": "05331816-4a88-4272-a9a1-363d3ed91818", "comment": "Malware payload (Loki)", "value": "f3179435952657f1faf7e1944c9cac16", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804834, "uuid": "5343036f-797d-479e-ac80-d75bc84cfde5", "comment": "Malware payload (Loki)", "value": "fde978a638a84d840ef913accaba2bbe4f7359c5feeaa8c6909c35a42de5b01d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804834, "uuid": "e6a14393-9729-4d2c-92a1-6cf4efbcfcc6", "comment": "Malware payload (Loki)", "value": "99e2b3f40c7051ed199bd2dc319b16e7fa1a9565", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629804834, "uuid": "1f6aee30-9982-48de-844b-416dd5f0e1fa", "comment": "Malware payload (Loki)", "value": "7bb254c4369d67191d6e8714b80b0191eac78901b710cd4ca8c41295266d32fd89e02a793c0b1c752bc4856412be05bc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804834, "uuid": "89cd84d4-c1b3-418d-a324-e7cfdf966394", "value": "T1C6B351ACD4AB02A48F85ABB85B2B9F8401CC729EF7858633327C573457D2E36512793D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804834, "uuid": "fdf1a3e0-873a-479f-a8d1-9adebaa9ef2a", "value": "384:ehvM0djWK0pw92YjBZG2oeiCOYXt/mTzfgZ+xSz0RrITkmDmuWfGcMC5LacGCC:ehvM0L0pw92cbG2retRRrITkmaiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629804834, "uuid": "23783448-a383-4841-b5c8-1ffd1b9ecec0", "value": 117303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629804834, "uuid": "36e5711d-eae2-4c33-99c0-929789061e51", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629804834, "uuid": "df2b9a12-d848-4510-bdc8-df01b304758b", "value": "PO-2021-000164.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760693e6-0507-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629829014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829014, "uuid": "26317d56-249e-4502-b9e8-0cc989c1a282", "comment": "Malware payload (Loki)", "value": "033a5cb0240d1f2f420dce8c9f73ee43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829014, "uuid": "68267464-2f2c-4af0-99f9-ff08f46ef020", "comment": "Malware payload (Loki)", "value": "fdee2a0fa80ff03bf2290ee1bca0c70c727dbdb360e1641f346371fa5a930785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829014, "uuid": "a2091e7d-65b4-4935-8a7e-41e4650768c3", "comment": "Malware payload (Loki)", "value": "7a25517cdb6311304b2607cc65a9899e789a0d78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629829014, "uuid": "2985b265-bf26-4069-a853-5409da0b6473", "comment": "Malware payload (Loki)", "value": "4ebdcb3802b3a1111db0a6be2d46782f0f1581551161184896de248d7072a384976a2476d8121ac8e3f950110ef75a57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829014, "uuid": "02dc7a21-2ad5-44ac-b379-4b762ec03ebc", "value": "T1E07438003B98756BF134D53B5B57823682B249CBE1D5D740CD14E3AEBA31374AA8DA8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829014, "uuid": "ea0ba415-00c6-44e2-bfac-18f5df2b6aaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829014, "uuid": "daa5ec45-83b3-4ded-9549-c234bae627c0", "value": "6144:n7/AVIrvgtaSKWyAcPHhG5B0SwbsV6zckoYTv:7ww2axWHYB4B0hwsz9xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629829014, "uuid": "9566b8ec-d6c4-403a-9eb9-180ecddc0b07", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629829014, "uuid": "0b1f6c14-decd-4b0c-bd18-c9b5a35564ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629829014, "uuid": "9f4cba53-c1b5-4e77-8be6-90674d8c57a1", "value": "033a5cb0240d1f2f420dce8c9f73ee43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5e9af2-0518-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629836190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836190, "uuid": "bc94a592-5722-4a68-93db-0aaceaedd1a5", "comment": "Malware payload (RaccoonStealer)", "value": "64b32dbde13f0303710643aaace909d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836190, "uuid": "f072a2c3-2937-4e32-b64d-58421032c421", "comment": "Malware payload (RaccoonStealer)", "value": "ff1ddb96f4984d4ed65016ca7814432d51a08fe090fae4907e85926469e880da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836190, "uuid": "1beae511-9f69-489e-af90-cc57c2b636c5", "comment": "Malware payload (RaccoonStealer)", "value": "edf82474074cfd3386e53335f5eb043088ee7c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629836190, "uuid": "3ba8dda3-319a-45da-b43e-30f6c7796c85", "comment": "Malware payload (RaccoonStealer)", "value": "2e5ca973470af0eace2e81dab09eb70af8fcc7a249174142ef120a7e447e204e1ad2e49db8725a430adf180821bc5dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836190, "uuid": "7b5f9458-19c8-406e-b501-836980391757", "value": "T171C4AF7675628077F17200B0AE6CA7A1167DBCB009328E9B73C9063D4FB55D2D722A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836190, "uuid": "37ec287b-9373-448a-acbb-5ccdd9916523", "value": "35279f0bcb93fbb246a2ff5f9995bdc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836190, "uuid": "876eb636-4534-4afe-b6a2-fb4a0f9521d6", "value": "12288:jh/yDN787IPelHo8BM2rMayvaD7Jz52548cRWipfx8BjaMQbG7nU:d28y2rMDaD7j2581kQijU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629836190, "uuid": "c41679d4-e875-40ca-9688-c17612a663a5", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629836190, "uuid": "5615f038-bc76-4475-bdb9-9b6ba79206ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629836190, "uuid": "9d50fe65-edef-4422-a678-986b92956b65", "value": "64B32DBDE13F0303710643AAACE909D6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697022b8-04a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629786473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786473, "uuid": "732c6269-67d4-4bff-884f-d0683e5e784f", "comment": "Malware payload (TrickBot)", "value": "415ee51ad6951c26cf81f555a48fd5c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786473, "uuid": "309403f3-a875-4626-9b64-c1d04410a3a2", "comment": "Malware payload (TrickBot)", "value": "ff2e1604b5ab04fc43039d5f94d08073f756115b1018846a253c0ad93ed94f8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786473, "uuid": "c0407f6d-1553-4b84-befe-391ea315736b", "comment": "Malware payload (TrickBot)", "value": "452209ba57ce89c8aeb8a42a422f2d7a593d04b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629786473, "uuid": "d2203087-75c4-46a2-8193-d34e9af47ae5", "comment": "Malware payload (TrickBot)", "value": "b7d753c9564688ea01c96a9c206a4be55f7597894337c2cde5806265129d2dcefc4b0a4a5921bc37c9483d09b985b1f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786473, "uuid": "556a8bf6-318d-4874-9463-3be133c97a56", "value": "T196459D1136D4C076D27A35B1451AE7BA26E9A8315FF682CB6FD41E3D1F346C29A3830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786473, "uuid": "1aae652b-c552-480d-b2aa-ad6c72fa9461", "value": "05bc8af9bf5c786dfa8271d68f7b9019", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786473, "uuid": "fae7c458-8ad0-4125-93da-b865f322cf9e", "value": "12288:KtbEazZXGqs9onpRXBTlTGkxiLU6iRW9vLYHILxKdWeT09VuObClb4cCwOBCkjZl:KbEqXGo7BTlT0AdqYHILxCV/U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629786473, "uuid": "3f7c4080-ed2e-4b3d-89fd-b96420bc9038", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629786473, "uuid": "0ecf0b46-7e99-450d-a16f-d5dd9d49fd43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629786473, "uuid": "a5eae32b-ceec-4552-9122-8bd2ea91cc21", "value": "415ee51ad6951c26cf81f555a48fd5c6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7369b2-04c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629801701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801701, "uuid": "8b7f858c-3bb0-4300-aa0e-ef0acafdd2f6", "comment": "Malware payload (SnakeKeylogger)", "value": "a82554b84d33427b3653531ea43152a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801701, "uuid": "03eee862-7d56-4849-9c03-825977d6c54d", "comment": "Malware payload (SnakeKeylogger)", "value": "ff4a0adb2e9f8826a02580fcf722dc6bcae53bf98ac3b4beb0b26eb7323625bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801701, "uuid": "c9a47fdc-7371-4778-9177-4e26af358217", "comment": "Malware payload (SnakeKeylogger)", "value": "ca31b72b74a3f6d2c36ed8f972e916989a24b7f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629801701, "uuid": "50cc4c6d-30b2-4de1-b4ed-338a3d8104f7", "comment": "Malware payload (SnakeKeylogger)", "value": "25b8621c2515dfeda10c65e61dea9e2ebed41062f08daf05abc65e4a21806846d960f17bd5e8c767e43e00e45f778b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801701, "uuid": "9fa2ff0e-d67e-48af-bd9c-9ea0ed9b6a88", "value": "T156057B3063C9C294EC1A8EF0167CF7A402F275E7B6C5CD6A16DA720CCE5E9D12A0765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801701, "uuid": "a8104b52-5774-496d-819c-d4235084af6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801701, "uuid": "3f848db9-985a-4632-bf66-bcdf603e3ef0", "value": "12288:04csGI/c8tEYZZyx3rdNnQ3Jn32fcwgbYCHQ+AqnK4vM/lie+1PA5oMRO2EObbs:00ex7rQ3J3SgbFQOKKulV+KlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629801701, "uuid": "532db548-35cd-4c6a-98e6-bc25eabfdce6", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629801701, "uuid": "18ed2f11-dc2c-4a30-b599-96eb067e946e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629801701, "uuid": "2a6626f7-7037-49fa-be68-10f6766ae647", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DVA.genEldorado.30121.19014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6ea05e-04e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629813051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813051, "uuid": "ff0eca94-33ab-4f81-a19b-a45376faade6", "comment": "Malware payload (Formbook)", "value": "ee9dd3ac724b5f1d2ba98f49ffcdad85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813051, "uuid": "e6fc4363-d45d-438e-918d-16b296ef6e1e", "comment": "Malware payload (Formbook)", "value": "ffb1f0ac81c2b55e6c5bbcf695b12b85dbef6a72f9d32e6fbc16f611ada393f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813051, "uuid": "ef324597-ac1b-471a-a0c3-54abc96c31f8", "comment": "Malware payload (Formbook)", "value": "9b206e8552e13f8297266b12bf454d0ffb1c5ee5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629813051, "uuid": "864107cc-296e-4e79-939a-e3f177557f94", "comment": "Malware payload (Formbook)", "value": "6db32d63767430f9cd55f1deb0444c6e2ee9bf7e7601c74dadf7d00dc9ab551e51795288a6709d054575bf6394b12bba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813051, "uuid": "9a4648ae-27b9-4b70-9e3c-549db6f4bb92", "value": "T1EE15063D19B91637D1B5C365EBE58423F149986FB414AE6A6CDE03A7030BA8734C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813051, "uuid": "5d1aa26e-4eba-4727-98fd-c3cb621d8ee1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813051, "uuid": "a54e3ca3-fb67-4055-a686-e8edd4630602", "value": "12288:mo8dm2+Pv10wV0kaSHXNmHS+axGhgTBiJuy90SSCa:mKvmwVJl9m6GikJuy90D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629813051, "uuid": "d9523986-9988-477f-aaba-0ffd31106a6c", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629813051, "uuid": "53967ca5-e412-4077-af57-47980c64c708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629813051, "uuid": "b07e89a8-6f6b-481a-9aa7-9199a1a6edf7", "value": "Documents.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }