{ "Event": { "published": true, "date": "2021-10-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-18", "timestamp": 1634601781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c7abe84e-cbbb-467b-9be1-ce67e646a051", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b136b9-2fe8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634543485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543485, "uuid": "d778a23a-91a3-4f2d-947c-5f7a8175ce15", "comment": "Malware payload (Mirai)", "value": "ed7f4604bcc244548080de1ed8d848ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543485, "uuid": "8819131d-f179-437b-b29e-cfccfc94e0c9", "comment": "Malware payload (Mirai)", "value": "014a297302cfe49bca34fe070689198875842228777f98dfaa6db999e2eb7937", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543485, "uuid": "957a7366-84dc-4f14-8d56-43843ee2fb74", "comment": "Malware payload (Mirai)", "value": "d1039e23c5e320036f57241ff32eec38dca515c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543485, "uuid": "c952ea20-5f39-4146-87bd-03dfe640d397", "comment": "Malware payload (Mirai)", "value": "eccb730f9f4f2548c522b95983dceae62855964e14a552f8cc1c203d03c2e1d2065eee1af68ca699685b7fc21dddb791", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543485, "uuid": "52d12fb1-59e6-40e2-ad40-59def96f3897", "value": "T14623F14D470500DAE15CC4F64711BBE2BAF28FA86442BD22685CD563EF83F987663AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543485, "uuid": "4895ea5d-cb19-4aa9-8a6a-72122c5db454", "value": "768:zXLqTJnftkSmV1G+DbnpCgFauZL5J1KNwW2OK8Ne4pWtYz65Iw6SnxYJgGlzDpbS:z7qdGHG+DbFFam71AE8fWCzW6yaVJup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543485, "uuid": "04f1b927-1290-4fe5-aa99-0c514de5cff1", "value": 46136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543485, "uuid": "4376f5c0-e0f3-4ff3-9953-3ffb9255b2c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543485, "uuid": "f191a61a-b00d-4176-a318-07bcf76a2c7c", "value": "ed7f4604bcc244548080de1ed8d848ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be441bab-3059-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634592254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592254, "uuid": "8f276417-fac8-428c-bb8b-f5767a8e1b0e", "comment": "Malware payload", "value": "3e545d11c01dcd525008387a6556d154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592254, "uuid": "6e260245-c3e0-4862-ab2d-78a2fb9d7711", "comment": "Malware payload", "value": "0166717b404b753bd02d798b428242405e6f6120ce71fbd7b0dd33b3f8de34af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592254, "uuid": "ed0c4990-19ea-4874-90e2-94a6c48b4bd5", "comment": "Malware payload", "value": "18aac4dbe441d79aa8513300c5c1a819efab1d53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592254, "uuid": "f037308f-da21-4632-86e1-3671f0643758", "comment": "Malware payload", "value": "7e91b0ba1b8e7e2eebe1dbc3be7825c48a60a3da7c588857158003310b1e1b4c474eb86477c2b0698af339ab06636807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592254, "uuid": "09adb659-98af-490d-8174-5e11a3021c33", "value": "T10605F886E9B3614DE392B2780B0D65910A421C77DB139AFF5FBDB91A31F26D18687303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592254, "uuid": "d5c59589-78b0-40c1-9194-e40fc178751b", "value": "4aa82b91dfdd0eea976043de209425e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592254, "uuid": "c052d6e9-3b5d-4912-9d35-ec99e2544a6c", "value": "24576:G4mQPST6ih8bs5kfv0zxNLRNZVvDJOXkmyzhNFFuhk:G4mESGfbsmujHZVU+zhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592254, "uuid": "d50bf830-6be2-4636-8265-874eff19c26f", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592254, "uuid": "d97b085d-5c9c-4160-9be8-323a7ce5917f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592254, "uuid": "20a50c50-7692-49a3-9f27-db23252cddf5", "value": "Sapphire Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f322c0-2fe7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634543204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543204, "uuid": "15574535-c39f-40bc-b741-d6d2afb75055", "comment": "Malware payload (Mirai)", "value": "fb769799851c6c14cdc97e37a8f72e9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543204, "uuid": "901ee453-f946-436d-b314-4055e9f13ee7", "comment": "Malware payload (Mirai)", "value": "01d1a362d0bfadc0c879e553d5b014aef27de86fc6b21c76d17780840a4c7967", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543204, "uuid": "2519f911-f9d5-4ffe-a2eb-07421f1fe396", "comment": "Malware payload (Mirai)", "value": "3b74551cfaf4dce5756a6f4d4d42fdb0199bcf9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543204, "uuid": "44cfb32e-627c-49f3-aea4-03b51eab3d11", "comment": "Malware payload (Mirai)", "value": "c0f1a8a0e67cd6e26cbbed1ab77b500937bb23c32d79d321ee4d9879384f57e63906d18a5b3a45ed1a8adc09c3a1fdec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543204, "uuid": "702287f3-345c-4bb0-8e6e-4255f15c8a59", "value": "T17B23F1CED5A69893C8FB5BBA558E16F37980B0D871D46BDC93644E88DB1B12F800F068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543204, "uuid": "706ec37a-7301-448b-8635-52880fa0ba51", "value": "768:5znqKaiUxf0myocB15HcUx6yaFFy5SG2AYZkt2+80up0HiMzDR7knT0eDviL3Whu:5bqDNcB15HX6/vGSxJZo80upgiMzD1kM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543204, "uuid": "16b7177f-36c5-41fc-afd7-e7431a405cfe", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543204, "uuid": "29037997-1cb5-4897-bb07-6b0700aaa418", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543204, "uuid": "a942bce6-ab71-494c-9fdd-9d720f086ac0", "value": "fb769799851c6c14cdc97e37a8f72e9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a662e316-3002-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1634554848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554848, "uuid": "8ec4a607-32d0-48ea-87ee-6ba4caa7e72b", "comment": "Malware payload (CryptBot)", "value": "3e375a3e6648d4698a2a1c07cbee04f6", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554848, "uuid": "ec87abe3-8718-4fc6-9123-56ad729f8fd7", "comment": "Malware payload (CryptBot)", "value": "0226c24778351c0e523f42b629f085bc3c1016100970b2a76d7c7fe122f69e33", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554848, "uuid": "4a91f71b-708e-48c7-867f-92d0ce31174d", "comment": "Malware payload (CryptBot)", "value": "9bca8cddf2002efe155627571feb7a75874b948c", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554848, "uuid": "62bbec37-c092-427c-afa1-19b7be0a67ad", "comment": "Malware payload (CryptBot)", "value": "a8fb2b5467efeb0a14ad32e1b47b5f937824bf4623b4afba103732e47a1814688992558266ad0809bee349b1d07b9aa3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554848, "uuid": "e7f62e12-a0fb-4552-9914-5b7e11214666", "value": "T1F374BE10A7B0C037F5B356F849BA92B8B52E7AA06B3594CF12D416EE46346E5EC7070F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554848, "uuid": "01d8f94c-a0ee-4a59-91d2-2deb2c08a104", "value": "b2b1ce057c4a3ad8c1ee685e46521866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554848, "uuid": "5781301f-bddf-4956-a616-df60a67952db", "value": "6144:MFLdy9Yvb94JUdC/l5rKUR4sJTH7zR6UW9Ac8ZJ1TLy:gXDGwC/llKU7JH7zR6U7/J1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634554848, "uuid": "f47659f6-6ba4-4cfa-96e0-fc978e9eb32c", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634554848, "uuid": "5935e26c-00e6-4cb1-81df-223c29226718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554848, "uuid": "ed150a30-d318-48a0-a279-de83f4f82fad", "value": "3e375a3e6648d4698a2a1c07cbee04f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316f833c-3013-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561953, "uuid": "5056af5d-0645-48ec-946a-68c5baac0cba", "comment": "Malware payload", "value": "23312b19728b126c109c398a6378be9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561953, "uuid": "cda88153-5539-4e3d-9d28-8a38c3e4b8d2", "comment": "Malware payload", "value": "027f7d07a53bd9d2c6cd901a9a800dd1f5ed0063f5a16761aa6f3b6ac7328ff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561953, "uuid": "0079f434-f78f-4967-9f46-4c017db113fd", "comment": "Malware payload", "value": "9e333e3aff70736e4f9a0a889b9edb8c22c57149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561953, "uuid": "ab47a8f8-23c7-490e-a8b7-a07b4352f91c", "comment": "Malware payload", "value": "d40dbd10a8f8617670bf5a4074f12ceda832ffd03c944293556a1b8cd199d97cdad96ef7c532d7030a41afd49396682e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561953, "uuid": "cb386717-8ce9-498b-b7c3-43d426fe2bfc", "value": "T1B1D4E10067A1C034F7F653F84A799E69AA3E7A616B2590CF52D523EE46246E0FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561953, "uuid": "36a1e312-308b-4dd0-bf6f-7c3fa275be96", "value": "b2b1ce057c4a3ad8c1ee685e46521866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561953, "uuid": "aee70542-0137-43e8-9ec9-c122ee52b5eb", "value": "12288:+rBfOz9+QANwhnl7S2Pb3ReNKiqpIFdGQjNVNW42PmOEvMlxH/w:+4B+TNwZ5hrcCYdGQJWPyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561953, "uuid": "d34ad1ae-80a0-4ddf-9391-f856b267cb06", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561953, "uuid": "4e18ba30-a281-44d9-822c-472e5c2fd6b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561953, "uuid": "f58ba1b1-1e0f-4b64-8ec7-808340b4a1bb", "value": "23312b19728b126c109c398a6378be9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2ef24a-300e-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1634559988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559988, "uuid": "a911c0f5-bd9f-4bdb-8cf3-2c8370841432", "comment": "Malware payload (GCleaner)", "value": "2de8d046d57fa60509800b164868a881", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559988, "uuid": "7bc596b5-f59c-48f1-83b8-858d28ca23b1", "comment": "Malware payload (GCleaner)", "value": "02883fa63667972547fe36023646554c3d2895b41c5a8683ab5b2292f5d2d464", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559988, "uuid": "8f7d033e-5b2f-43cf-8cfb-9c0e9d2c6626", "comment": "Malware payload (GCleaner)", "value": "905be498f9490445da60c9ee457de1e8411ce074", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559988, "uuid": "f8357289-db07-4208-809f-5fba93c3fcb0", "comment": "Malware payload (GCleaner)", "value": "339e659c11802f2b79626219f0b99416a117131048464149ba106cd4a0b7f9acdf8c58d0bfa8c5b5c29e0978d9b6e336", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559988, "uuid": "60348a6b-419a-4463-8c7b-ea909752fc66", "value": "T123A4AE00A661C038F6B762F58EB99278A52E7FE06B2450CB52D527FE97345E0ED3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559988, "uuid": "93e6dfc5-3cec-493e-945d-44581442b92b", "value": "d29112deebad1bc2847e7571006fa346", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559988, "uuid": "0dede775-2a6c-4aab-abbc-498a98280305", "value": "12288:b9i0a/2iNj0gXXj2+ZQo8zbNHrf0PBbGMpv:bG2iNjZXjhQzrf0P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634559988, "uuid": "e1a7b4d6-1e10-4cd8-95b6-056b13e49e95", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634559988, "uuid": "f5399a88-3e6a-4bc1-8cb4-cec053a7bd9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559988, "uuid": "15feed72-0579-4b53-9d5f-372a6256b2ee", "value": "2de8d046d57fa60509800b164868a881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8131bb67-3045-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634583562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634583562, "uuid": "e605be61-66ac-4e47-9988-e048b03b919a", "comment": "Malware payload (SilentBuilder)", "value": "231f1db25ec8409c0176035e2d556fa3", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634583562, "uuid": "082c9eeb-2e48-45f8-be02-4cdf476aee20", "comment": "Malware payload (SilentBuilder)", "value": "02f5d877cfbb012dd9960caa91c820e02b4cd9cb12f8483a38279967fe088d29", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634583562, "uuid": "a2863c69-fbfd-483d-9f44-2e22b8575988", "comment": "Malware payload (SilentBuilder)", "value": "59670b7a11983292bfd152dd95a00f3afd5d41f4", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634583562, "uuid": "4b6273dd-96d7-4437-8820-0e627ae8ec04", "comment": "Malware payload (SilentBuilder)", "value": "86b7da1e14ca7a21723e37d24484a628573386fa3c45d5707fbba5b29e23863c4cb8a865eeeb8cbc14b1c8d2b0ac0db3", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634583562, "uuid": "3dfc00d4-b5d8-4d0f-a326-f7d91a163a31", "value": "T1DB44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634583562, "uuid": "44a99a6d-b1f0-4882-9050-6afd68e4b454", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7q:U9jFrjmkD7IvLDK3vLvfn1+2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634583562, "uuid": "5537c3d5-1609-418e-b5e5-15311beafe5d", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634583562, "uuid": "76cff36d-b2fb-4d51-b6fb-d30585d795d2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634583562, "uuid": "4ff7db57-e9c3-4cfe-9e6d-5cd587a2d2eb", "value": "231f1db25ec8409c0176035e2d556fa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6072ef30-3009-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634557737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557737, "uuid": "8cd789a3-eae7-4129-bba5-66ef5790fb72", "comment": "Malware payload (Loki)", "value": "d55204cd0ff7e8de80265243cad2c19a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557737, "uuid": "9f7f476c-47b3-4100-9515-83548b5f9b15", "comment": "Malware payload (Loki)", "value": "0338d9ae864f7851875a5127d21e2d9aa92ee69b37b8708464e170afad8b42a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557737, "uuid": "a8ebd23f-a2f6-451c-86f7-d3cca37cba08", "comment": "Malware payload (Loki)", "value": "da36be65dde519899cb2ab870945c7dc0ba9cead", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557737, "uuid": "6cd67258-7441-46e4-9381-08546082503b", "comment": "Malware payload (Loki)", "value": "9fd7bcc6473355440f1c26d02533a879955608c3a20ef133d4823ccb381f7505219703ba445fb1f4b2ba28889cef7804", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557737, "uuid": "6fa398bb-4148-45eb-835a-2d3bb0ad2eb4", "value": "T1ABB49F2039FA016AF273AF762ED1B699AF6EBFB26503940D1051734B0632A41DDF153B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557737, "uuid": "996820c4-3ce4-43bf-b89e-a20d8d0921a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557737, "uuid": "67cf35dd-32a1-4a5b-ae17-032b0b90d620", "value": "6144:JSk6MFohvg636UqrlS0K1DiabKI4XeEgmcFjT07I21hbkEPupphEXkseW+OJz92Y:8ThvgUD0K1DiaE7gLn0VkEPwQUt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634557737, "uuid": "e9a3ae13-de57-47fd-a700-8589987c4803", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634557737, "uuid": "14539383-ef1a-4a53-af9f-1ed9e455f12f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557737, "uuid": "80dcffd2-720e-466b-b858-3f388778e6c7", "value": "d55204cd0ff7e8de80265243cad2c19a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bb9c09-301f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634567386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567386, "uuid": "da5e42f3-3926-4458-82a2-3f35172db660", "comment": "Malware payload", "value": "28421e8c9eabbc79f50a3dee1ddfdef8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567386, "uuid": "2519c541-3638-499a-9025-104c84801a42", "comment": "Malware payload", "value": "040109a7f5b4bedc23f8bec55cf5a5e8d5d755e9502622fd4d72451f15515854", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567386, "uuid": "d70887c5-f21f-4944-ba5b-f2d688ff4bc4", "comment": "Malware payload", "value": "b51a5c76e332b09bf024a49e8d5731494d99bc9b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567386, "uuid": "0a2dfb6e-b79b-416a-9678-ac52ea5e820c", "comment": "Malware payload", "value": "8b59e909177356721c4da7c3f0c30a0eb7b126d9ba49f219b8eaebebea0044c98aa239f80d28d384751d37538227f171", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567386, "uuid": "5282cac1-f606-4e04-b4b3-50014ce37bd6", "value": "T1EED58F23F2928437D1732A389C5BA36999397F102E78984B7BE83D4C5F366807D252D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567386, "uuid": "d38dbff4-0470-4da7-b809-7df56d5d8c37", "value": "24576:wv0e5OYm19h1D7rrnW5AkBjPizr6MfxQRINutPPRelJVZ9XUAh4kmDYnzDEAnVaE:wvPOYmPvzr6uaIMtPPyJVT93GTPc27A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634567386, "uuid": "4e7a7794-c984-4515-affd-d56225175384", "value": 2966016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634567386, "uuid": "2e11a849-ce30-41e1-b1f8-800cebf1dd8a", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567386, "uuid": "ef114dc1-f7f3-4608-9e6e-63c935764eb4", "value": "_iufwojbohrbvjhrylidwacohpjrvabthhxwzpulb.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab39836-2fc6-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528924, "uuid": "c2395505-e882-41e8-b044-05c0ed12f346", "comment": "Malware payload (Gafgyt)", "value": "0d6c58c06b6f4b7797d1ec0140e91f07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528924, "uuid": "63db7461-596c-4dd5-9433-7431da66c04b", "comment": "Malware payload (Gafgyt)", "value": "04b9afe5fa0d48bdbd7b675a7672454be5a49574dc1961544367a1696d64b06c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528924, "uuid": "e55fce5b-8e4e-4b14-9f07-8a73c9e08a69", "comment": "Malware payload (Gafgyt)", "value": "23f7071b6abedaa4d226d114557f216df0029819", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528924, "uuid": "6ba2bfbf-6a9c-433e-ad56-bf211f4b602e", "comment": "Malware payload (Gafgyt)", "value": "2970a164942bb4cfb7556a6b4bf052740f2d2745b6ef88a305398d2cd30c6003eacc879558d47e3246e4f375112d0931", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528924, "uuid": "15822524-6039-4acd-80b5-ef3fcc8275f8", "value": "T132C30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528924, "uuid": "1ee9e396-59c2-4d27-9ae7-56427a135c17", "value": "3072:H63VpNeuWDGeQf8sRCst3DxkS2YmyVUQuiXfQd6W:OSuWQEcCst3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528924, "uuid": "5356f0c3-b8fc-4e98-8b27-3894dbde5f0d", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528924, "uuid": "cc62babf-5f0a-4486-ab16-474dd7785e3d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528924, "uuid": "e4f38688-a64f-42b6-88be-88692f2bafb2", "value": "0d6c58c06b6f4b7797d1ec0140e91f07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83b349f-2fe6-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634542932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542932, "uuid": "16a5b2ef-8fa5-4329-b3e1-62b2c6579405", "comment": "Malware payload (Formbook)", "value": "57be051a2a20b292fc8cb67c4f31c4f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542932, "uuid": "89701b02-c833-40e2-9baf-3d4b56783606", "comment": "Malware payload (Formbook)", "value": "04ed65784009bd39c546c4a6473a44799d0444d40ff9796c2921a70db6ec2a72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542932, "uuid": "660a4a2e-cbde-4069-b4ee-8407911404db", "comment": "Malware payload (Formbook)", "value": "74c7c3e521bc681f0e18a90cd31cee1f37641598", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542932, "uuid": "f29a8b47-170b-4070-be51-8a928917e1f5", "comment": "Malware payload (Formbook)", "value": "a091623e21015600420b8484d93c323fced887a69ca76eb62c344b7ccff547ae65acbec849ecd43cca5e64db1ab53fb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542932, "uuid": "9ac3e9c0-0417-4858-854f-9032f74502e1", "value": "T163C468512320412ACA6907B3A296563036F84C603D75F63E1EC4FEE9DBB6EF199C8177", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542932, "uuid": "0fbfacfa-12f3-4527-b424-924877202746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542932, "uuid": "d2306550-c0d9-4cf8-a929-d1a855687b72", "value": "6144:cKheIEpyb/eDE6j87TZ48zMKf6ZyNN68M07+AGlqtIMdcJDhepYYX:nEpySIzCKf6ZyNx7/OqtIMyJDheuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542932, "uuid": "22b9c910-9b45-4ad4-81d2-5a2f5179b06c", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542932, "uuid": "9912ba0a-9c0e-45ac-bef3-73918a037857", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542932, "uuid": "b0905d23-9666-4656-b7e6-420d9ab650bc", "value": "57be051a2a20b292fc8cb67c4f31c4f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920a26c5-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561256, "uuid": "d50a2343-28e3-42b8-b801-1a1be0da2a0a", "comment": "Malware payload", "value": "5a96c39f8895554a263dbf342f637eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561256, "uuid": "51c37216-dcc9-438c-9e7b-65b6879c87ae", "comment": "Malware payload", "value": "069cf47ec8964fdae9009421489242faf2be3078b2f986874a3d4f0c67fda0a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561256, "uuid": "e2c30ac6-9007-42b0-a397-11c28fbc6635", "comment": "Malware payload", "value": "54c9c62bf7202d43243aa7f8a931c860ea61ec00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561256, "uuid": "f8c5e7ce-e735-4a88-b4bd-ea4d2fce7c71", "comment": "Malware payload", "value": "cb29ae4f2f26923592a839c60275ab72976e7ebe866de2f98b27721105ec9edb02de947a09d7dd8577397602e941654b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561256, "uuid": "faf7dd10-b43d-43f0-946a-28ae03d99097", "value": "T192A4F10A72689F12C5F857B68434A5535777EC2B4210E18E6DD03ECB3E7AF868139B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561256, "uuid": "3ac32b6e-8ff5-4b7f-9ce4-1fd0f3397097", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561256, "uuid": "12a0fd32-c54c-4c6a-a154-52a30a9f65db", "value": "12288:yLg78TGm4kteSykHM7eyl9QJi/yPnhI0bOIH8nN8Vh8pHAvN8jqxQX+l07CJIv2A:XktUsM7eyEiknSi5SGh8pHiN8jqxQX+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561256, "uuid": "f6bd95ad-0991-4b2f-bf12-17648423615a", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561256, "uuid": "f334bc5e-2336-4fa0-a897-d5b742ef9bd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561256, "uuid": "0566493c-2393-414f-adff-d62d094abc37", "value": "UOtBQlxt6rYmlyY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91449bfe-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561255, "uuid": "4f1cea89-fd14-4a64-a46d-2392e1bd6566", "comment": "Malware payload", "value": "1a30a956fd6191b26df50297bad52b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561255, "uuid": "ca5d455f-1cd3-44e4-b156-18fd5984e275", "comment": "Malware payload", "value": "073b910f31ca74a6e345f8f9f4c22bf5409f9d428cbf0b566e096004510f7e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561255, "uuid": "d1807d5a-957e-4fbe-b533-4155e95ecc98", "comment": "Malware payload", "value": "3c4739db57329d3c59fb598d9431aca727a752e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561255, "uuid": "b41c84b9-90ef-497e-abda-0ff21adc658b", "comment": "Malware payload", "value": "60251c0ae38bc601be881482396a2b01bd8a980a5bb274d0eb80237f4114ecbdb640834f4715d8ddf4826343f3cace87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561255, "uuid": "48852247-e0a4-4e7c-9012-1c45d6e1d9ec", "value": "T10394E10272694F22C9B557F940385193077A2C27C161F29A5ED57CC73ABDF8281AEF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561255, "uuid": "466fa543-6d0f-4848-ab6a-85b3057730ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561255, "uuid": "281adfaa-9fef-4b1f-bb09-8e9c5391eddc", "value": "6144:rUiL/GNYkBHZcvMS+PeeF3zbJqBlsvGGkGurT3Bciu/seqTl1yWPmaP6oHa1m:rPDG6kBlzPRqBlsQrTii2GJQSpPTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561255, "uuid": "28a39fe8-1730-4e63-87ed-60014679505d", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561255, "uuid": "48e46505-5fee-45e2-bb45-518b50b38a8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561255, "uuid": "ef4f536b-d5af-462e-a6d9-1eb1cbe2d79e", "value": "Sales Invoice 3732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674e553c-3047-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634584377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584377, "uuid": "6ad116a0-1ae6-4525-b53e-ce9518a7c687", "comment": "Malware payload (RemcosRAT)", "value": "b059b572153661934aa9881a49b6dc7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584377, "uuid": "21854005-66d5-4e08-9b5f-24f9a901faed", "comment": "Malware payload (RemcosRAT)", "value": "08120955ca4cdc89e7c6ab767ed3a302e2e07755d2fd3e792b2677003130982a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584377, "uuid": "bcf1d9dd-1fbc-4c61-9169-93fd62f11fa9", "comment": "Malware payload (RemcosRAT)", "value": "1608657eec7ea2e31153056d731fecd96f0577cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584377, "uuid": "4814dc56-6de1-441b-9cb7-7c2b1e2cb0b7", "comment": "Malware payload (RemcosRAT)", "value": "5e367d2668572d0c102dd7b04bc394633fb2a6b5f4e7dd514527cab695fcfb49fff8d800e3453d43d2694ed8eb1f9c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584377, "uuid": "6b6cd078-1eb9-4bc3-994e-df1fdeb897b3", "value": "T141F40229767C9E21F2A8467AC8B8C24B433E9C176451C15A1FD07CDF7AA8BCE4549BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584377, "uuid": "8b2f2857-b686-497d-8320-469e1c9b4365", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584377, "uuid": "7cc60f84-c3e5-4969-b29e-f24362b4add6", "value": "12288:oGeRG2fKXPuCEGZA7rbp6i8UpT2e2INuVvE6Fq7XAwVDyou7fLtsXveBYXQDNXw:yfUXEGZozOINuiD7XAWDyou7fLtsXvyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634584377, "uuid": "67a28da0-c605-4025-ad58-db33c07c8e0c", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634584377, "uuid": "36459483-06e0-48f2-a86c-d5b7b60d2f95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584377, "uuid": "0c85760d-9831-41ef-8626-811414050ca2", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aafe4bc-303e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634580410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580410, "uuid": "bba39c75-e382-404c-a7c7-f1d78183504b", "comment": "Malware payload", "value": "d432fe3a966aac2f90a49f7206b85a6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580410, "uuid": "b1d79343-724e-409f-b2d5-b695578ed52b", "comment": "Malware payload", "value": "0919bf3790ecfeb628ce2a4f278a96d10dbb0a00c3bf41784cbf5cab3240a726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580410, "uuid": "7632ff9e-ec33-4023-9377-a6b36aebe2ff", "comment": "Malware payload", "value": "71c3300dedff967c5a45cc24a1d058f6ea937220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580410, "uuid": "72b46422-5293-4e4e-8f5e-ab5a66af18d8", "comment": "Malware payload", "value": "e0d5a69f641432b582c654e3313ec2a18926d1c0436d94bc4a174cc3c7ae006bbce3d1b29f98bcc548ec5ac706264c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580410, "uuid": "04fd9d63-69d8-42c3-8a9a-b69294a7c4bf", "value": "T1BF42CF5027E41FF3D8A665B68018F170B82FAEF5AF02C76EBD2E57E5A7426807420589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580410, "uuid": "ec53847c-7732-4a08-bf3d-63774ad65645", "value": "384:/XCUxFnb31KBcLAuM/Azp8QFI/Ma0T3eEGHQ12:/PFKEAEFQ50Gk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580410, "uuid": "6f98eec0-bfa4-4c39-a636-77509df6112e", "value": 12960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580410, "uuid": "712678c5-08ea-4afe-ba1a-0a3db8ee943d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580410, "uuid": "bb6c88bc-dfca-48f1-967a-e9f89581f02e", "value": "d432fe3a966aac2f90a49f7206b85a6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2356f8d9-304a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634585552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585552, "uuid": "5bef58bd-c466-4968-b24e-1fa58b9de5ba", "comment": "Malware payload (Mirai)", "value": "8efbd6fba4ae26851e76e1460539badf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585552, "uuid": "4448e059-e314-42cd-b845-069730aeef0f", "comment": "Malware payload (Mirai)", "value": "09c0e739b8b05512537974015688fbfe198f796f6f11dd2c1ab56f8285ee2975", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585552, "uuid": "1152a6c0-2392-4036-987e-0d25731402e5", "comment": "Malware payload (Mirai)", "value": "7c0fbc62a948f5620fd71e8b03dd0d14974288b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585552, "uuid": "e2119769-2061-4d7b-8d7e-72351a2f5351", "comment": "Malware payload (Mirai)", "value": "a81abce0e67b07525ca13c806500fc0f7be628ecc334d15092ae08e07c228e58f7f327ca05cc5d3d30725d80988323d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585552, "uuid": "b7da4199-5771-40c0-b543-7ec7744d550a", "value": "T1C5932886B8419A11C6C60677FE2F118E331257ECE2DDB3138D245B707BCB91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585552, "uuid": "c0e47b52-758c-4dfa-8057-8f3dd0ee1741", "value": "1536:XhnOErV41q/vadqMSahuZGaz75zVMm6hii/at+rbNMKiq+Vu8KRY95cYG:vrCJdqKu5hMbIWaM+Vu8KRY9y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634585552, "uuid": "78dc65bb-3289-410f-a987-330e60ce1305", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634585552, "uuid": "c36a4158-dce9-42b9-83ca-b06cbb722602", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585552, "uuid": "66c79f3f-a304-4f18-8434-eebb2e975941", "value": "8efbd6fba4ae26851e76e1460539badf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb77929b-2ff5-11ec-843c-42010a9c0014", "comment": "Malware payload (HawkEye)", "timestamp": 1634549380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549380, "uuid": "6310a92f-e689-4ce4-b778-ec95089b9f00", "comment": "Malware payload (HawkEye)", "value": "c453335b8c0417bd1c7e7e84278bac71", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549380, "uuid": "524a5849-5776-48e2-8edd-10a52af0af1e", "comment": "Malware payload (HawkEye)", "value": "0a0e7c81912b02e6ec1c7fbb338f4ef200e23d441d57c692cc88fef616593f0d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549380, "uuid": "00736eeb-8db0-4e88-b586-e520d5ed2732", "comment": "Malware payload (HawkEye)", "value": "57160596f02d06791805a2324aaec47a2cab9b26", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549380, "uuid": "697b531d-bbac-4fd6-94f1-42940e7872d6", "comment": "Malware payload (HawkEye)", "value": "f6dc8306483493fd248484d23ee101373cf2ef9700d6bc7060c75765fa99de62ed8bc9e093bdb8f20c353e49c4b4b2fb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549380, "uuid": "d4734460-c802-4813-bb87-2e1655101257", "value": "T14105D09C365071DFC967C972DAA86CB4EB6064B7470BD217A01326EDAA1D99BCF100F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549380, "uuid": "883caca3-8323-4a07-8b63-e28774c0ef20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549380, "uuid": "57dc9923-2e54-4533-814b-631b1ff197b8", "value": "12288:FwLm88jyKO+ihkMqxus73XBez9wPDWmiHe/bM+77TBl+67WsjYlu2DLrLXaU:FwLoVOS8YiwP63He/brTBlDzeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549380, "uuid": "a438f02e-4267-47d7-8a56-90fd5bc4640d", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549380, "uuid": "2c6d0336-5b3e-438a-b6a9-3b19da2ae5a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549380, "uuid": "92f4ba43-f719-4d41-8f52-f853ec4eeb35", "value": "DHL_AWB 51887788299___pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096d82ee-3050-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634588085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588085, "uuid": "9465a921-2d5f-429c-a9fa-12181ee7dc61", "comment": "Malware payload (NanoCore)", "value": "f35901ef2cfb37a099b8b4e0e1c79043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588085, "uuid": "f080b9fc-eac0-4568-a860-747905433912", "comment": "Malware payload (NanoCore)", "value": "0a42fedc4dd1108d4ae76f0f8426c0c06819b71601daeefcf51b4dddf8098d22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588085, "uuid": "06724ed7-958e-497f-aec9-9fe86b5f2c51", "comment": "Malware payload (NanoCore)", "value": "9501ef1e0fa3c0c7f3bd9414ab58b6fae8a7b46e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588085, "uuid": "44a56ed7-4d5a-49dc-ada9-b04bb0241b9e", "comment": "Malware payload (NanoCore)", "value": "d4969bdfebc0f2fa5ef168133813604966b8db94e1d7b095d038ac9a2bda90901a477eab4a7eddcc9f5ea874d8d0c935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588085, "uuid": "1742b52f-c63f-492f-8341-829870327720", "value": "T128351203B6D288B2D9731A315B357B24AD3E7D311E25CA1EA7E0496DEB35181A134FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588085, "uuid": "fb3ec1f2-eb0e-45d9-a2d1-0d7316f13f16", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588085, "uuid": "59c53054-5679-4f8d-ba50-c1b208963fe4", "value": "24576:rAOcZEheiBWm/hWiPCSPugJqoa6TPY5I7nT1RMwazIebh:tMUWmpPhJqT6c5IzTXM7/bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634588085, "uuid": "a7dbe016-1152-4318-a079-d0a1f423b43f", "value": 1136579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634588085, "uuid": "1cbcaabe-6674-4222-9750-8a10d1908798", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588085, "uuid": "c98e379d-4e17-41a6-9246-1fbf55255309", "value": "f35901ef2cfb37a099b8b4e0e1c79043.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973db2d1-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561265, "uuid": "102c2086-bc76-433c-8c4e-ec3962ff5723", "comment": "Malware payload", "value": "6ad372b0c8cd6b4526c32dc1f8cf48cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561265, "uuid": "d42f9006-bc17-415e-b5de-08bf74afbda0", "comment": "Malware payload", "value": "0ac817c46a946614a55ec0ef3ea49c7ffec21ac0224bed9c3758fa9aa99000bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561265, "uuid": "62817fe5-e659-4fc7-8fd1-a48ad3a5d0e7", "comment": "Malware payload", "value": "f8aa03fcba737ea8d6163d881366776bedda5a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561265, "uuid": "1c002e46-92ba-45b6-897d-cf638e8f3361", "comment": "Malware payload", "value": "aa5a73474e8774fca260b50dc662ac9c60bfe6a518d45addcd064055a5ea75e3aa46ce8060a0117ebfe1da517255c4e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561265, "uuid": "ba5cd6ad-e7d7-4127-ab50-8472e07fd150", "value": "T17994F11171758F21C9B597F9803892634372AD2780A5F28A1ED17DCF397DF42827AE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561265, "uuid": "dc4d5b2a-6c14-4b0d-bfa2-9414546cb40e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561265, "uuid": "196506aa-28aa-46b5-aa6b-458a35aac74e", "value": "12288:kx5GXoAMhP2WEJQ3gFhwlAj2k7/b67siT:kYqOBpfRB/67zT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561265, "uuid": "a67ae209-5f21-40c4-b673-9bd545bdd66d", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561265, "uuid": "c41aaff6-4b9d-4e78-a58e-d5ca5e1bf63c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561265, "uuid": "ddef7265-329d-4e1d-ad08-042cb23098bb", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b156dca9-3006-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634556584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556584, "uuid": "f63e48d6-f5a7-43a5-b95c-ecc6885b63d7", "comment": "Malware payload (GuLoader)", "value": "f9387f159f97d49649d1e6b34802dd3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556584, "uuid": "db0475c5-3e03-4379-8687-d79e2bfdf36f", "comment": "Malware payload (GuLoader)", "value": "0af20465dac642791831be79702b7c4cbf204f170b8441ab001a7519eb6dc45c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556584, "uuid": "b129546f-32e0-465d-9d5d-cd109c5354cc", "comment": "Malware payload (GuLoader)", "value": "b0f8090cb04a59d08e355553162a7fad645a3a4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556584, "uuid": "a344a1e8-3065-4090-bfc7-dd4ae4916c78", "comment": "Malware payload (GuLoader)", "value": "c2b0d756df566f5300ee324388eb22745961d9bd0b94c00e27ccc34abaa42ce52cf8a0c8e18bb9d10a1c725c5bad7377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556584, "uuid": "ea3c693c-8e9b-4ad3-87cb-4f939bc22559", "value": "T142D3C59E7EB0EC35C65C0FB22726066DD0916D72246B37CB22B11056B7FFA6D8A10F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556584, "uuid": "cdcf6886-d06a-4c9f-befb-403768d9ba2c", "value": "f4fe279a1dc5f9b95a0f7e23ccc3a334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556584, "uuid": "5fd82ab5-ff9e-4bee-88f4-572f30b3f695", "value": "1536:Y2lBo3b3rcKZQTQ08vL0xi+1PMg5nIFvkUQrsn78FseZ/MbzU5x+AMe:YIOszQXvYxvMzBrnIWeZ/Hb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556584, "uuid": "53d59140-a1b0-4b50-b6a7-d63edd2524cf", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556584, "uuid": "a9cca5b4-ea4f-4e24-bcb1-0317c6419d9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556584, "uuid": "8d56a90a-20c1-4fa2-a948-7f7c808e384f", "value": "Schenker Italiana S.p.A. CW305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19937d6d-3007-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1634556759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556759, "uuid": "08db6488-4d60-4bbd-9dbb-faa2020b33e3", "comment": "Malware payload (QuasarRAT)", "value": "1b465c6989637df1d5c511919c43e457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556759, "uuid": "6eada7fa-d856-4bf5-b7aa-562474e4a515", "comment": "Malware payload (QuasarRAT)", "value": "0b196e6b27ed15410bd946b1ccfd1de6b7af64a540cd0226b8eb9bd742d1b095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556759, "uuid": "3c608644-2ed2-47c1-895e-3fa5034f55e9", "comment": "Malware payload (QuasarRAT)", "value": "317f8bf5133176cd0f4125c6f2f0fdfc226754ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556759, "uuid": "f76a45ac-15c0-4bbe-9539-9117de096e4b", "comment": "Malware payload (QuasarRAT)", "value": "e8657616d454afe8ccef7ee8733bdfcdf70cdabe3a697c137ab3660ab7792b261721ea575e59033d3e075b6c8aa7ba16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556759, "uuid": "d5be1f54-7c66-4d49-acf3-23c6923ca807", "value": "T1ED15D09C765071DFC817CAB2ADA46D60EB60B4B7470B8213A09725ED9E0DA9BCF144F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556759, "uuid": "6933c7b1-7f8b-4ce6-a323-43a612a6393a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556759, "uuid": "1c06818a-e624-408d-8d3e-6239c0832d68", "value": "24576:nc6zD+4oOZ34MRxbnCiZXsqK+eHTesb/hyDVeb:5D+NOZoax7CSX/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556759, "uuid": "76647e14-cb05-4abb-9ef2-e876de42b911", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556759, "uuid": "88855b2a-7606-420e-8711-2b56dc9a83b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556759, "uuid": "2fb7deff-e982-45d8-8731-148c73dc6ae5", "value": "1b465c6989637df1d5c511919c43e457.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fc6b24-3005-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634556057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556057, "uuid": "5f845741-7aaf-4569-b8c3-fa3fdb691745", "comment": "Malware payload (GuLoader)", "value": "c8e589d26d5eef55a5640e592f5324b7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556057, "uuid": "0cb5867f-96e0-4b26-8f7b-5e93c091c92b", "comment": "Malware payload (GuLoader)", "value": "0b7c2cf498da4a512d08c182f7c46e585dfa2b9c5110462f060c673e4dd16597", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556057, "uuid": "283ae515-2962-4aaa-811c-8524ce85b272", "comment": "Malware payload (GuLoader)", "value": "c3c8a997fcd7d664403f9e16dee06f03f96c8034", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556057, "uuid": "ac0a7fd3-efa4-41b4-bbc6-a88062dbadd4", "comment": "Malware payload (GuLoader)", "value": "f33db4bbef66a113b2cc31fcf17dedc1266e67b684b8c334b68f5a4bceca7f4e9d44a94b347055f613d77677a77f75c9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556057, "uuid": "3adb4231-88d0-49fd-95e2-11939d3295c1", "value": "T15C74D1A6941D06DBCFF24672F8C19B2D1B7D6E54212EA520E1C073253D3786FA16A38F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556057, "uuid": "15cbb263-991c-4e56-b216-d44e406806d5", "value": "6144:6WoyhihkaxI+x5IQNTp4PJVzbyOvT5cY3KfeAV992T8J1gb:ayhBa3nOvCgTj35AV992IJ1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556057, "uuid": "b20f8b1e-c7cb-4a8e-bb3d-5bbf353e20b5", "value": 351432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556057, "uuid": "7da0856f-29dd-4f86-a00b-9e439425eefc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556057, "uuid": "eb9780fa-ecf9-4d04-9ec3-ad00c3bde3a9", "value": "Invoice & Packing list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f323b8b5-2fef-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634546816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546816, "uuid": "9eb779ba-6c14-434f-a6bb-c1f9acb2756d", "comment": "Malware payload (Formbook)", "value": "b8278e92923b15789354b41cc89b638f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546816, "uuid": "b67511dc-197f-42b5-a7f1-be760964f11c", "comment": "Malware payload (Formbook)", "value": "0bb2dadcdeaff57f676d59b05cf9a787669403dceabe43fd008995b2a0a8b9dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546816, "uuid": "c70184d2-dd05-41f6-987f-056daa5d6018", "comment": "Malware payload (Formbook)", "value": "9e4dc8a87d8ca82c8220ff05abed303e899b3822", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546816, "uuid": "98d02532-18e0-423c-8d2e-cfd43c92cd63", "comment": "Malware payload (Formbook)", "value": "ab98e29f54d450643b2f3b405606c8726eabf6c7710004a358b37d79fcabe7fc75cb163b9dd63fe627778f612e60be9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546816, "uuid": "92f4e156-2f3d-48de-8a89-e7a598a7ecf6", "value": "T12044127B35E24B77E5C2977458B69212C3FA95240202698B4F614FFB6EF50CB8D0B18E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546816, "uuid": "2e2b6e92-bed1-4c9f-80a8-4d17521e0982", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546816, "uuid": "db270924-25ed-4608-8dcb-25d87a656bf3", "value": "6144:wBlL/ctqWfthdLZMNnOasGazR/Ejfk7gfPDZJElCI/hNEt1A:CetqWfdV+LDaF8DgWDZUCI/EzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546816, "uuid": "9eed3959-6ce9-477c-8954-fe3e06d08197", "value": 255949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546816, "uuid": "8eea7b3e-c139-4f88-9f7f-8b1b924aa02c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546816, "uuid": "1009a151-bc23-461c-8b2a-cf057fa0a2f8", "value": "b8278e92923b15789354b41cc89b638f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac948741-2faa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634517062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517062, "uuid": "1c7fe28c-cd19-4ed8-b2fd-bd8e4c89453f", "comment": "Malware payload (Mirai)", "value": "b940b4ce625d6138b487d404cc471376", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517062, "uuid": "95cfc540-52b6-428d-aedb-d46268ceddf7", "comment": "Malware payload (Mirai)", "value": "0c84d6a630f3ddfbf85155a248b87f68196779da3861eebe8bb88ee85d3a03ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517062, "uuid": "e7d921b2-89e8-4c32-9a0c-8ba302577d0e", "comment": "Malware payload (Mirai)", "value": "8e345a17ef58dacb8b8a1f07a5b83751f75c1d22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517062, "uuid": "3c4ca9be-aec4-4d70-ac91-5ff455f28084", "comment": "Malware payload (Mirai)", "value": "5f23d88fe7d5e290eb5013e2e43bddbc31f48a0d2ef307aff2154d6a530e18f768f526bf39e4d9025b567ba0627be17c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517062, "uuid": "4dcbd6b1-59c0-46ac-ac15-3d651caa0f1f", "value": "T15BD34C46EA808E13C4D5177ABAEF41493322E754E3DB730699185FB43F867AF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517062, "uuid": "086e9d8f-1cd3-47c0-a9ba-cca79ecd5f30", "value": "3072:uw9Lg2RRhpRM54yaRF230tuiC/gH5CEuqSH3l2M/9CIkYj:d9LgaRhpRMqzG+uiC/gZC5H3kM/9iYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634517062, "uuid": "923e77bf-6dcf-4092-8603-b40cf1c00345", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634517062, "uuid": "06f7e16e-0e63-4aab-9f98-93fb65a84bb4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517062, "uuid": "d3c2b95f-f516-4e23-838d-640aceb05996", "value": "b940b4ce625d6138b487d404cc471376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84b4a08-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634542046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542046, "uuid": "def7c1a9-260c-4dc0-8126-b0c44f413330", "comment": "Malware payload (Loki)", "value": "cb95d42e2f568176976a7787d22752ce", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542046, "uuid": "ba5a775b-d680-4885-b898-5f952bb596a4", "comment": "Malware payload (Loki)", "value": "0ce3cd5b1ff275423806fd49fff4fd7f1e4affb6d7aeb0eb5a72f8e895f68890", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542046, "uuid": "bbea5369-5ddc-4b8c-9bbe-334d800966f4", "comment": "Malware payload (Loki)", "value": "f454a05cebeffa68562cc78e53a9d8e4e26afb65", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542046, "uuid": "c0b4dc7c-da49-4ab3-bbff-7d6c6519e62f", "comment": "Malware payload (Loki)", "value": "0e3bc36e44078816b9398486bbe7c8066c5f4d5d29df3a5715bd692ae89ff92fa668e746d5d185689c5c30e58871f54a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542046, "uuid": "281bd928-9fb9-4d48-afde-8f4699b27262", "value": "T1FD74D161E1550366C4833F7B4211D4F7FE86EDA8C624228693E8FC6C9E339DEC64A1E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542046, "uuid": "f4448385-43cc-4c14-a91f-3579184b7292", "value": "6144:DP/bmIViBGODyMTQ6Gj8rmgEqQLVVdJ6zrfKplsCHjp1ssiiHun:T6IVi1GUjEqmI6pqUun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542046, "uuid": "ca182c1e-dd1d-46df-b1a0-d8ca2c7c6131", "value": 340696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542046, "uuid": "45df5086-f600-4081-ad7c-7d90a7bc2d70", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542046, "uuid": "d34d98fc-4256-4e52-a35c-ea29160a832e", "value": "PO-21JI0081.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c51caa-301b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634565607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565607, "uuid": "86189f5d-8e1c-4965-957e-d3254abf9e8e", "comment": "Malware payload (Mirai)", "value": "02ace60c09ed4375bcf985a93d8fa09f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565607, "uuid": "3a5cb9bd-dc1a-4680-838b-ae18e12d96f3", "comment": "Malware payload (Mirai)", "value": "0d10d39af1056d552cf6ee0078f27a43ba94df90679b0ccbf793cba3cd49e1f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565607, "uuid": "38327e30-647c-4db9-ad48-55d79eead481", "comment": "Malware payload (Mirai)", "value": "4a2ed257937107bf1baec6d960ccdfb269a7c68e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565607, "uuid": "606069fe-94de-4967-8fb4-d191f1c2e173", "comment": "Malware payload (Mirai)", "value": "60f9e86fd2afb91c323dae480d104f462b3b47772b15ac6e7a78431761c35806e54e26177e3fb722f4cddefc413657a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565607, "uuid": "24c7ea1e-3bc2-438e-bed7-27463e9b9285", "value": "T1A07319827C81AA26C7D017BBFA6F108E33156BA8D1DA73438C155F5577CA80F0DA7B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565607, "uuid": "7812109e-041f-43d8-ac36-4d9ecf7e1cfb", "value": "1536:ufzomOUDUrqVC+Oe97OBo/qMH/HMBLpJeZWaeJIM:ufzomOUUBLTwnsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565607, "uuid": "b02ea7a0-405a-49ab-9dd4-ad405f7d515b", "value": 80280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565607, "uuid": "e10a920d-fbaa-4f14-876e-df4d8d9ff2f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565607, "uuid": "13c8fb73-1456-4f91-98f1-05c426e39393", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ff98b7-3010-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634560640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560640, "uuid": "50e508cf-5fa7-47f3-bdd9-e69172cdd92e", "comment": "Malware payload (Formbook)", "value": "70a1b0e287cfb57fdafc401193a4476b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560640, "uuid": "6f4a7d64-f3dc-402e-a450-9b2fd2ca21c0", "comment": "Malware payload (Formbook)", "value": "0dfb17fc59cf0a026c3185341c73ba25d6cb5ef0d886ce8dd00db39c1740c2f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560640, "uuid": "4f1da6e8-d704-4ccc-a0b4-10699863a34b", "comment": "Malware payload (Formbook)", "value": "b552e549510bc446c458b734ebf68c6103abc1e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560640, "uuid": "fa7b1797-b308-48ab-a2b2-94aeecc5ae0a", "comment": "Malware payload (Formbook)", "value": "cef35370fed3b134164958a0eb2df336fd1186511657b3a351a682f73378e71b1131da461e897ffb72d9f912da4e11ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560640, "uuid": "5a05c8b1-97c9-4c20-ad7e-d2da6365cb8c", "value": "T1FEB49F82A9589F44E3CD427DB065CB00C1ACBE9571AACE1C7DBCF765A9345C0A38DE36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560640, "uuid": "65a1167d-391e-40e2-b1b6-2eaab6742804", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560640, "uuid": "1ad06bc0-4943-42fb-b793-02ab1783bfa6", "value": "6144:2i5IN9bX6qUhFFGzaX/yuWUJeLC5MiTMXp6LNXlTEGtxhezzK3iU8dEH:2i5ID6qUbFhyAXocLNNVtuXEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560640, "uuid": "845f1b2c-d9de-41da-a1fa-5433ca0d0952", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560640, "uuid": "b9793c50-ebdd-45e6-ad58-0eccc068c842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560640, "uuid": "85994146-ac39-4a9f-83a7-26a706155eec", "value": "70a1b0e287cfb57fdafc401193a4476b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6237efb6-3002-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634554733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554733, "uuid": "66522fcb-321c-4041-a293-7708cdcdad43", "comment": "Malware payload (RedLineStealer)", "value": "3ba6bfe514b016c1fea460a386cecf90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554733, "uuid": "082e1c33-a23b-4c36-90a3-cefc69fb7247", "comment": "Malware payload (RedLineStealer)", "value": "0e92489b73bb3fbd644629abee74d571b62201f4faf50a15a23875cb9c3bb88c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554733, "uuid": "8da3c7e6-82a0-40d0-859c-82040b38b5bb", "comment": "Malware payload (RedLineStealer)", "value": "96203d71d593a40f0ade8a180367f65e871beaa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554733, "uuid": "a55bc633-728d-4e30-8821-c62a7ceb85b5", "comment": "Malware payload (RedLineStealer)", "value": "0efe20016fdfc9f9f82d95340a39880813dc21a967ab0fb83a271a3c685886054e6eeaa4bdd73a0464f37e39c9abfca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554733, "uuid": "5207478f-43fa-4847-96da-e203858e95df", "value": "T17985CF33E7935433C13F2678BD7653A8682ABE102D2C788627E51F6C1F356813B6529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554733, "uuid": "6c0a4f93-9358-4bd3-9e10-0a73d1f61d35", "value": "ea56b45adb819773013639ab85e39bf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554733, "uuid": "9bb27294-35ed-4ce7-a797-b4ad43a8568d", "value": "24576:YMV0Fz6x+oZ7J633fKPgYwKQmRLc52GDfuncAG/iUbX3xnvio2G4:Y1YGnKg30wpD2nsiUDxzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634554733, "uuid": "0d232679-a7e1-4909-a8c5-d483595c464c", "value": 1809408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634554733, "uuid": "85a08fc8-7138-4944-9d88-5095d5816fb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554733, "uuid": "064553f1-8a0e-4c0e-bf43-ae66637623c2", "value": "3ba6bfe514b016c1fea460a386cecf90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480a5bbe-2fd8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634536650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536650, "uuid": "545b123a-947b-4ddc-86b0-01f44638f482", "comment": "Malware payload (Formbook)", "value": "c3f2050787e70cc38227bb4489e46865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536650, "uuid": "0dc40716-d27b-479a-a06f-9c622271f9a7", "comment": "Malware payload (Formbook)", "value": "10012b6185457cc008e74c63602e39ccc862866cfecb5f2ab04b1aa9e9edde9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536650, "uuid": "812ca28b-6bff-4200-8599-241dc44981c8", "comment": "Malware payload (Formbook)", "value": "a6c0c399c51172400274049a0c938b9f7ad7411a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536650, "uuid": "e1956d83-b049-4094-b16e-d158482032f4", "comment": "Malware payload (Formbook)", "value": "7341c632201d8f256a6328bdb4288a00feba60fe5b267e9597acf6fe0b45fe79da5c9b1bf27ba5a105ad931041f8da60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536650, "uuid": "1f284964-6b33-40b0-968c-eb8fe18872fe", "value": "T14C44122213F164BFE69F26721ABB4795D773471C1310AB4B8718CEFBA67108F4A2E461", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536650, "uuid": "f8605bfd-2c2e-4f11-8f34-5d3a9a70104a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536650, "uuid": "aa48962e-6776-4b74-a012-a2d1344e289b", "value": "6144:wBlL/cunaDKUurO6gvBUnINSsHOhcUFXjE:CeunaDirO62C1s8TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634536650, "uuid": "4886f68f-33da-417b-8cb4-ad22154d96f2", "value": 254310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634536650, "uuid": "b8becd2f-89d6-4f56-b9a2-3fc32d44e323", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536650, "uuid": "276090a5-494c-44c8-8232-a12dcdf65559", "value": "soa_02010021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc90ffd1-2ff5-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634549409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549409, "uuid": "b43fc2fc-20c3-4247-9024-e537296ea9e0", "comment": "Malware payload (Loki)", "value": "67067ae71b3eff8b950c4bdf86dab185", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549409, "uuid": "4b592fb4-2b2b-42c9-b674-65ca2d27ab47", "comment": "Malware payload (Loki)", "value": "106d36eacdd600ad58b9b371cbe889cd3adcb278bcc836c1746f83e6cfc67f85", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549409, "uuid": "50fa3ca9-41e7-44ff-9e9a-c91c1e5fc508", "comment": "Malware payload (Loki)", "value": "4b7766f49d64a6338a1f7400992e650205493eb9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549409, "uuid": "93b3c5f6-dcf1-4d20-a76d-2687fcf24d69", "comment": "Malware payload (Loki)", "value": "100c7cab381d84afab71f88f92324ead23d750c3138d5eba8d058a215b059dbb95b95ed03e42472411369dfc763ddcad", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549409, "uuid": "0509969a-d9b8-4a47-879a-01f39299c28c", "value": "T11B7401017784C46BD72C03B464F2E3A927B4D8322E55CB6F6EC930EB6AB37456E90613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549409, "uuid": "26656d14-2c91-4cb7-addb-a99e4f1b0a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549409, "uuid": "3bee01e2-810f-419f-befa-072e46f71560", "value": "6144:O8WHibuYrITw2KBWfeL227/MP6FhXizBoRP45YB:0+rITwpA0rMUvpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549409, "uuid": "523f54cf-47ee-47c4-aefd-e3f960d242fb", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549409, "uuid": "24833286-3e52-4c77-948b-76a6fe2d6c6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549409, "uuid": "efc9654a-9ef0-4a15-94b2-429ef8e5106f", "value": "DHL KR DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fbbb81-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561043, "uuid": "13e46a8e-a002-43f7-9cbe-314252989777", "comment": "Malware payload", "value": "6b09106a8d4839ebb9555bba8aeff0c2", "object_relation": "md5", "Tag": [ { "name": "Atera", "colour": "#6EA25F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561043, "uuid": "fa89eab8-ef23-4c61-aace-28afee47ee8d", "comment": "Malware payload", "value": "107dd74c22fc6dbb829ac57dd99bf621887cccbbd8af6c88adbe08e1e15a3755", "object_relation": "sha256", "Tag": [ { "name": "Atera", "colour": "#6EA25F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561043, "uuid": "cd21851d-0e73-40f7-b9c2-969916ec2895", "comment": "Malware payload", "value": "953ee746472e54e3a5fb3174975305afa51dc01b", "object_relation": "sha1", "Tag": [ { "name": "Atera", "colour": "#6EA25F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561043, "uuid": "c1e6de82-6757-4798-98f7-f0ac2451a971", "comment": "Malware payload", "value": "440f850368d7039e4f2ef7a787f47263dec265db1adf38703cd62238570f18aac7078ae468977295b375e2b18393fdde", "object_relation": "sha3-384", "Tag": [ { "name": "Atera", "colour": "#6EA25F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561043, "uuid": "4a8b717c-3715-4784-9d29-515d33044f76", "value": "T13BF3026756098059C50EC1D0FE8E154F5ED357FD4E28B9AA302E8F90FFAC3896C9068E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561043, "uuid": "1139dd71-86cf-4f78-8c0b-1ddd21d8ba5c", "value": "3072:OSE0uqcmjI1oVQEJSgILy3RvMiEgdDlPzibs7RoK1vP17QqTeuxAnCEZk:5uHSI1oV1JS7Lq5EK55x1vP1qdC4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561043, "uuid": "99f9012a-be50-49bc-afbc-2b09859bb506", "value": 170613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561043, "uuid": "c0893fd5-8692-4786-9ed1-d15b5af068e0", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561043, "uuid": "7e3cbf0d-446e-4175-9ba9-cd05d1502d16", "value": "Dike.jpg.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d243ee-3023-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569050, "uuid": "a3e91019-afc8-4f1a-913c-35d5a0ace4c6", "comment": "Malware payload (Mirai)", "value": "b1f3231a98fea6c56552895d3efd8a89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569050, "uuid": "888ac062-5fdb-477d-bea2-f69c11c2e7bc", "comment": "Malware payload (Mirai)", "value": "10e9c69af2fc60c3443f9034c2728d3c5c43aeccbaa95e18b940af53b7b2b723", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569050, "uuid": "edbac554-8a99-40f7-aeab-52807cb3ddaf", "comment": "Malware payload (Mirai)", "value": "e10110ab8e7ad8e826f281e69147c38b5817d7a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569050, "uuid": "54f67ed8-5e0e-4c22-b3de-769b2a2f37c4", "comment": "Malware payload (Mirai)", "value": "cd8a3b854ac3e255c255c876401b2fb9ff431f275a05a50d6b7c4692c9329abc5ff42acec448388dd91c8a0a7dc7c87f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569050, "uuid": "cf1545ea-ca84-4d9a-8c95-7cbb079fd2d0", "value": "T1CC43F741B8929A2AC1E0637AF6AE158E3320B3E9D2CF7217CD215F147BC551F0CA7E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569050, "uuid": "5b6fff99-c063-4081-90bc-0d9cc0fcc75a", "value": "1536:kRRej1mXWcb1VlQAVrSsXsQ+QdN0ZrKq9RoCk8:kRRy1mXWcb1bQAVMo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569050, "uuid": "d7dbde62-96f0-4feb-a874-f06dbe852712", "value": 60132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569050, "uuid": "2b343aa0-577f-4050-a4f4-08d9a88c6acf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569050, "uuid": "bf5b8195-053d-4dbe-a44e-0095ad556d3b", "value": "b1f3231a98fea6c56552895d3efd8a89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f87d742-304b-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1634586163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586163, "uuid": "2360d5e3-8c44-4d1a-a104-f7864addeaa8", "comment": "Malware payload (njrat)", "value": "5148319e32fa247453f35aa2ea0af0a2", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586163, "uuid": "071c295b-77be-413e-9908-1965dbac53bc", "comment": "Malware payload (njrat)", "value": "11850e5727c8a31ca7192fc9546050442376f7b77359f7d4e971f1f823105504", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586163, "uuid": "aff97ee7-6df2-43e7-b71e-a1e1892a577c", "comment": "Malware payload (njrat)", "value": "69afc36ee0cf368fb248af04df99c8aa8faba731", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586163, "uuid": "3de82cc4-e25e-4295-9b55-8cae0b6086f2", "comment": "Malware payload (njrat)", "value": "0d196ba60298e19c1c3051ef35e1071903e0a03b9f610733824ce2f2a3ddf301a8c10116c3201d2f6aa76c465b868799", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586163, "uuid": "d7dc0044-fa80-47d5-ae8f-01eea01dbd60", "value": "T193515789F8CF41B50F109F0540A3E66E59AB4C63ED40694CF0AF6299AB3CBDC4992773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586163, "uuid": "07782e22-ecdb-4cf5-9831-ae291932fd1d", "value": "48:7T75L7/2CfqV1qY0mq/qTJGCqVvdqTj/UO//CZ7:7JhyaYASdGXtEf/U8+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586163, "uuid": "4d2b5c4f-3297-4b22-ad3e-3a4d1f2d4609", "value": 2518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586163, "uuid": "82f1a78b-7af3-429e-86e9-62c55468ce6f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586163, "uuid": "d8d7b905-88b5-4461-aba0-16e1a4336784", "value": "Receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b145253-304f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634587793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587793, "uuid": "b972b0fc-50ba-4d6d-82ef-70740aa1c2a4", "comment": "Malware payload", "value": "75970d264d08b42ae47cfd3df6c9a3f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587793, "uuid": "c46da815-03ee-4668-8d49-648e5dc74605", "comment": "Malware payload", "value": "11fdbe2236bf19e33ed519b4f2759e3573da8560096ca1b5d9c090f8fec70575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587793, "uuid": "2deced9c-1a32-407c-91a4-93f9591d2468", "comment": "Malware payload", "value": "9d16eca58d60472bc1af071189b2a14699fc73c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587793, "uuid": "49e93298-d9af-41d1-966c-f2f510c2edf2", "comment": "Malware payload", "value": "c9dbbd55decb844aa67651fce8f0901fec4fb0f7e6eeeef40ce632d3e1a2cff018ddc3514ae747f911a2364e52494434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587793, "uuid": "b6d86838-915d-4829-bf0a-4c218c751567", "value": "T1A9F5332B48A07D96EE5B91F51C576A3625E84A20CEF2C06B51B81743034FC9BCF4BEB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587793, "uuid": "28ede4cc-2f46-43d3-9da1-0060f4a5cf78", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587793, "uuid": "e96c6004-b4ad-4683-b5f0-97bfd1261d18", "value": "98304:BAde8/9zaRNHU3Uok1Dc/Oxfx7Xw5NczM5OfNpZYEu:BwFVI0EFcWx05NcQNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587793, "uuid": "66c1bf92-d2da-415b-a04e-99dbd9d6d4b5", "value": 3512832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587793, "uuid": "5bb76153-5134-4510-a1f6-eb2d7cab8f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587793, "uuid": "965d94eb-3d45-492a-a02c-ad675b9706ae", "value": "75970d264d08b42ae47cfd3df6c9a3f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d444ec10-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634561367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561367, "uuid": "c8ebd286-6cd7-45b2-9fea-f1c3aa94d858", "comment": "Malware payload (RemcosRAT)", "value": "6e8b61223a73c3c6f33f628369bcbffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561367, "uuid": "b11b52f8-de5f-45fa-978b-595072b9bf5a", "comment": "Malware payload (RemcosRAT)", "value": "127a16f1a19d0ebdacb1177a2365f26aa1abe1cef25518460a2220cc282eea02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561367, "uuid": "bcf958f0-8979-4cc3-951d-91c2de9f3935", "comment": "Malware payload (RemcosRAT)", "value": "f26a2823cf0682c92883d46bae925e70c9c0fe86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561367, "uuid": "dbeb6c0e-c7cc-474d-b99f-6b0c8bd1d84b", "comment": "Malware payload (RemcosRAT)", "value": "edd18a786b33f641c057a236e979fbfc6a9214cc49a2570e9661ea56e44499951c5d8ff25e43d010bf146d62fc74559d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561367, "uuid": "6c00f590-6c09-4f4e-b8d4-1a81b36c7234", "value": "T10125E0D2B78084B2D477163584379B637D37B52C8E684A0E7BA0BE1E7D313426923E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561367, "uuid": "f28e011b-1c34-420b-8604-9e60d64beda5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561367, "uuid": "8ebb673d-e845-4117-8f26-122cbf851d7b", "value": "24576:5AOcZ9ZkFia/L0juLapf/LvxUsAiuju9IJ36l:zf4aTuBd/tUsAirua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561367, "uuid": "a7c994f6-0db1-4a17-8bda-a371781d808d", "value": 1051739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561367, "uuid": "ff7b3673-2e48-43df-ac8a-d56e6f4faccf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561367, "uuid": "9397fab2-9a87-4445-89c9-e9ff5216d44d", "value": "6e8b61223a73c3c6f33f628369bcbffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951940e2-300a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634558255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558255, "uuid": "436fc3d3-a73a-441e-a323-4e4281dab05a", "comment": "Malware payload (SnakeKeylogger)", "value": "e09367e4c8c23541902285438711ec86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558255, "uuid": "b5873aff-4f14-456b-b527-4441a9734f8a", "comment": "Malware payload (SnakeKeylogger)", "value": "12eac304f48075b2a3d7263a4b8182ddc676e1ccd04a16162770a1ca78671311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558255, "uuid": "f38b24cc-acf2-4501-a9ff-06452f8adf76", "comment": "Malware payload (SnakeKeylogger)", "value": "a865889a7805c1a7b3f8600ecee600ec42a67674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558255, "uuid": "9779ca80-094f-49de-a271-ab19deb65642", "comment": "Malware payload (SnakeKeylogger)", "value": "da31088d18931ab194f5a606c08fb5c2aff4cbf93aefda545ffd394c45ad4f4442cfb92570d717002c549334b2c3ee77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558255, "uuid": "ef895e75-40fc-4eea-89ad-b6e71587621a", "value": "T12773C7013E046689C4920C7A01B25AD1A3784DDF8EDACE3779E5B73E7873664AE0793D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558255, "uuid": "e3299cc3-3a71-4afc-816a-993290a9d391", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558255, "uuid": "12e72449-974c-4394-b028-544143a55e94", "value": "768:4I9o/4IULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0ca:4zgIULFMAAiu6JL6oNsgFAyox0ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558255, "uuid": "f517cd06-afd4-483b-bb8c-d80330743955", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558255, "uuid": "11c24f90-ecbb-4dda-aedb-3fff5803833e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558255, "uuid": "6d6e96b8-f219-4893-acb0-e21b3e8d6d06", "value": "e09367e4c8c23541902285438711ec86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7c1e7d-3007-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634557116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557116, "uuid": "e3c207f7-1e01-4171-bf75-9ad848db90f6", "comment": "Malware payload (SnakeKeylogger)", "value": "3bcbe33f84954f3491e096ba5bceb094", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557116, "uuid": "32d3f26c-efbb-44d2-96e2-c11762eac6f7", "comment": "Malware payload (SnakeKeylogger)", "value": "13699f1597f146e229eb8edabadf3068f3a3a2673f821b046759fc41ba94d637", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557116, "uuid": "f5422bcb-dc77-462d-8dce-7605a6f5fcd1", "comment": "Malware payload (SnakeKeylogger)", "value": "63a7e032140ccdca9e86c636d9f763a8ffd4d1c3", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557116, "uuid": "b9511e49-e884-479f-aa34-b32cf97e0591", "comment": "Malware payload (SnakeKeylogger)", "value": "3f9356fee57985cc24c4356ffa5191d8fa3a6f88f8c3e65465a680e29c67759193a90fa582b328ac86ddbb4fe5e65e66", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557116, "uuid": "e4e1d3c0-fdbc-4038-aefe-f508b4e130b4", "value": "T145A30255366B667FE2CB8D38441A770BEB911546E8067CA60D9DB14FB85C8E30303E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557116, "uuid": "3f9aa6ab-0557-41e5-a386-6e2d3f192d51", "value": "3072:JXOKZu86S3Roy9uFwZlsaFPOHYonHBxqPZQ5:JeYuS/IwZltFPgYonHBxqPZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634557116, "uuid": "84137f49-af3e-4a06-b2e7-8ca10367771a", "value": 105276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634557116, "uuid": "8797df49-40e3-44ad-9875-c4e36c85f11b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557116, "uuid": "fe116543-4616-424c-a4d3-8fb57f4e94ca", "value": "New_771008123115.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a459f53-2fbe-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634525407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525407, "uuid": "85b26503-fbef-40f5-ae56-3441d124205a", "comment": "Malware payload (Mirai)", "value": "72e8fde6e24fb3f6dd6725fd2c098d13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525407, "uuid": "205f0ad3-8233-4339-bf14-955756e41ec2", "comment": "Malware payload (Mirai)", "value": "14093426e5b1d94c0d2f899c2e454c5d458574bdd8164a205d4da1b623a1937d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525407, "uuid": "3882b005-ecba-4c39-bf28-e2254d6af757", "comment": "Malware payload (Mirai)", "value": "7d0b76e738b552e5f6190e602bc8cefe20820e27", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525407, "uuid": "5ffc820f-7ac9-469c-8d7b-c855c1b92357", "comment": "Malware payload (Mirai)", "value": "06773b78688f7aeaf4c4449b30cf0bbd3f478509e90d744a344001a0d490eb882478ade7e6937a85a4d6f6cd6f495aba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525407, "uuid": "04e3c76a-af14-4a07-a053-9d5677ead6bf", "value": "T169332A91B8829A12C5D4537BFA6E41CC331563A8D1EF33079D266F547BCA82F0EBB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525407, "uuid": "131815ad-ba8a-414c-be3e-6da727ead0db", "value": "768:4jMcmv+McSbE2mxmm4Ba4ymBiC8saAbwzRgBCEtKLmYMvYPfjA/hcQ3D8JRRMPND:1cpzSbx98sTKLjMIfU52fhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634525407, "uuid": "1e1e059e-19ef-4376-8be9-bc665068ffce", "value": 50312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634525407, "uuid": "dacad585-8669-4003-9c85-8642a9f9abe0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525407, "uuid": "85610c94-4abf-4abb-b929-4033306d5af2", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbb244b-2fda-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634537549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537549, "uuid": "41f3ba13-249f-4cdc-8cad-bf2220082ebc", "comment": "Malware payload (AveMariaRAT)", "value": "f1b4d6be53bb3a8e83cb818331d0fe88", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537549, "uuid": "3ea47adb-22e4-4c65-ad88-a91654a21449", "comment": "Malware payload (AveMariaRAT)", "value": "1460a17dc07d6849127eed198ac789235349dfa3b6f6430e5fa566e3511e5b64", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537549, "uuid": "3972c8b6-4005-4c16-a6b8-40edbd376fe4", "comment": "Malware payload (AveMariaRAT)", "value": "e3f58c7f0574eeaeb37f5eccea1380e3051f92db", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537549, "uuid": "5ac822f1-6845-4a27-b603-7038dd6f5efe", "comment": "Malware payload (AveMariaRAT)", "value": "3ddb1ee8531cb0df6d1cba05bcb40ac157cfa3924c7c44c76f6661c54d725a5ab4e6d17fae04494aba159fa390df1836", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537549, "uuid": "eb73958c-83e7-4d21-bfbb-633a479d468a", "value": "T162D48E89FA8095E0CC2D93742977CD355727BDBE69B4940D25CA3A772FB7AA30032583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537549, "uuid": "8a1ccf04-8078-497a-a493-6b17291a2050", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537549, "uuid": "ef279166-b98e-4330-8e06-10b1c89cb5a3", "value": "12288:bUsg4Fnyr06KVuj0thFuNppvppMkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkr:4qs06jjqVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634537549, "uuid": "d26eb770-00ad-4274-baf2-bae2a0911a95", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634537549, "uuid": "ea2512f3-99f7-4273-b045-2acbad8c0ab5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537549, "uuid": "8927f338-4785-4c2e-abec-568177c3280a", "value": "Keen-Pros-DOC310521-31052021124021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e3bcaa-3002-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634554582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554582, "uuid": "375415b8-650d-4ba3-8089-f18bbc4f74f4", "comment": "Malware payload (Formbook)", "value": "9bcd3b345d6eff5fbf800c35330a0bde", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554582, "uuid": "4339df31-b4d0-4234-a977-83cd86551eea", "comment": "Malware payload (Formbook)", "value": "154e8841faee60e1f21fca5eb5b8db213d12e0a4ff89cb411326a30348c5807d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554582, "uuid": "c954937c-dc27-4f29-b17a-a42ebdd7496d", "comment": "Malware payload (Formbook)", "value": "7e92e7af29e8cb16c927d7d0fa0255b69a44ce44", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554582, "uuid": "6e0e585b-b8e9-4786-b036-1c3603f8d7a2", "comment": "Malware payload (Formbook)", "value": "0be567a11b68971502d9e62856f04b2ff0a4a0b179b2f8481af542914f60657edcad88c35f08abbbd79bb9c6b57ece43", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554582, "uuid": "40646d92-86d4-4066-a98a-35eeeeeec371", "value": "T15374D046D73BC736E1478DF9270A02F6E7B9CE351925C463294A37A444BB1F3A4AB12C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554582, "uuid": "c27fa69c-9e74-4128-8d7b-444c39ec6a63", "value": "6144:mDw70TTqIzolts597I0vccQSpXzOyrvJSFNRWPRZyhhXyddvdvvb5iXvci888D:v2VzGsU0kcQKOyLJSfRWPRmhXyj1voDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634554582, "uuid": "eca11cec-03a7-4463-b5ed-7d8af6d4a256", "value": 351368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634554582, "uuid": "bd773b35-dfab-4220-b107-f53fb23e0011", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554582, "uuid": "56e392d8-c21b-40cb-b316-92fe005c1ab7", "value": "PENDING QUOTATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f929d8b7-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568730, "uuid": "b46f8952-ae6b-44af-bdfe-f9bc833ddafb", "comment": "Malware payload (Mirai)", "value": "8e62345c32eed44acde2690633c36af2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568730, "uuid": "b2b49b6b-c78b-4046-8340-7229b2ab6231", "comment": "Malware payload (Mirai)", "value": "15cd97cee34a5e1c02a469e5369640813ca4eb2c18087587cbe744ae1ef8448e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568730, "uuid": "397befc7-2db0-4b71-9098-0e0e19d6a3d1", "comment": "Malware payload (Mirai)", "value": "2c29e39b809ae4f8857ea2ddded5c9c43152e20a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568730, "uuid": "e022daf7-b113-4f6c-b41e-6457d24c4544", "comment": "Malware payload (Mirai)", "value": "1aa66cfebf3d007a84dec3bb24154dcd59ef525b3552c20feacdc64b57d98d5b46b8faa4b9c3430fa82c542c81985db3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568730, "uuid": "3c4c83a2-f266-48e1-b239-33c5092cdcfa", "value": "T11EA3944ABF215FB7E89FEC3745E92706288D611720A93B79B934D904F21B31F19E7860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568730, "uuid": "aed8784b-b034-432e-aa3f-4f4aac7779c0", "value": "1536:a2fsCDpMtQagM6PkH406j5Tb06wnDQhPqf/Jc+n7bdEgvchRp/:a2UCDpMtQagM6PHj5P0tfJEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568730, "uuid": "b5b69755-e9a6-41b3-b994-e08ba0ebf8dc", "value": 101676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568730, "uuid": "1cf99e1c-79e2-43f5-9a7a-b5503a354aa1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568730, "uuid": "381308af-73e9-48e4-bda6-cd43f4040255", "value": "8e62345c32eed44acde2690633c36af2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f20abd-3054-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634590203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590203, "uuid": "8a5d4828-4886-47e7-bce0-9d5ca2c6b92f", "comment": "Malware payload (Mirai)", "value": "a670b364e60741ca44d3205ca26bc6ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590203, "uuid": "8b44bfc2-2075-407a-b0cd-a1e41359309e", "comment": "Malware payload (Mirai)", "value": "15d06013e965d7c52a1bb7c245d169b2865579da8d821147a078db6741d6bb8c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590203, "uuid": "59a5923e-252d-4a39-89ff-cc65223f110a", "comment": "Malware payload (Mirai)", "value": "5258169188d673898c5262cb3822ad010f2295a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590203, "uuid": "3e6833c3-e9bc-4af3-9895-4d0576be7e92", "comment": "Malware payload (Mirai)", "value": "9a542707668003346db3635cba027ae79ae36a662675e9371e0dba9944035ac202aa938aad91d322a5828aeaeb01e4a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590203, "uuid": "fb633ec8-38a5-4c8d-bc8b-913e8a2d4bf8", "value": "T13ED34C46EA808E13C4D5177ABAEF41493322E754E3DB730699185FB43F867AF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590203, "uuid": "c0f1d489-fa08-4a70-9a49-9f6bc0c123e2", "value": "3072:uw9Lg2RRhpRM54yaRF230tuiC/gH5CEuqcH3l2M/9CIkYj:d9LgaRhpRMqzG+uiC/gZCvH3kM/9iYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590203, "uuid": "22250e01-ed18-45fa-bddc-7edc0d16cac4", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590203, "uuid": "6402da4c-252a-4af1-8282-f1e26f767020", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590203, "uuid": "b5f11a38-32e0-47ab-b6c6-db45e9a0b7fc", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed90264-300a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634558244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558244, "uuid": "13df65da-e6ae-4ffd-8beb-a57bd796c765", "comment": "Malware payload", "value": "1caae598f7385ec3a7480a7dfb9e059a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558244, "uuid": "b71cd5e2-6792-4b1b-b2e2-dfdc313024e1", "comment": "Malware payload", "value": "15dbec53eec39a12947a6e575d5b722aeff28a0d5ae5529c20d5995f8a02c8d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558244, "uuid": "d3d97251-b435-455e-b6d4-2e8abf70dde3", "comment": "Malware payload", "value": "236545e3b19703c942caee2d380b8f475b34b29f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558244, "uuid": "14b46bf7-23dd-4e1d-8047-13bc578daf5b", "comment": "Malware payload", "value": "53fd362e07aacb57c4a3728dc336c95c24078314f0f0c8d30ad20b8f8b557d33b4017b86ff66e12a4ebd6b50274524f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558244, "uuid": "c902ff86-9836-48a2-a408-eaadafa81dff", "value": "T1BB06336F1F126DD2E38A33F98121FA4D8789D9748656CE86FF0D9FC0205621FC2A7961", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558244, "uuid": "4c3a84b7-ff3c-4587-8001-9e60fbdec7e9", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558244, "uuid": "9982d983-d8ae-4af4-b978-e9fa87e19699", "value": "98304:ABQPJ7Id7A6gp7b0wWxCqmLDux+9y+g5Ld43zM7xLGhGJ:ABQPJ7+7ATp7b1WxrmXu+yI3zM7RGIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558244, "uuid": "70fc9733-b695-43a4-9416-ad26d29329fe", "value": 3759104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558244, "uuid": "e7b61406-34c0-41f6-8d88-5b3bfc5ccc8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558244, "uuid": "1e13c828-7a16-42db-ab88-7444003cb3d1", "value": "1caae598f7385ec3a7480a7dfb9e059a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c648e3e4-3062-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634596133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596133, "uuid": "57a03758-4147-4546-a561-b2b666e2b451", "comment": "Malware payload (SilentBuilder)", "value": "07c4563b9667fad6b5c9497ced7a3514", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596133, "uuid": "fd89f6d0-7dc7-442a-8c1e-34bfca29ccc3", "comment": "Malware payload (SilentBuilder)", "value": "164c532643266053fc972cc46fe620a62789d3ac7d14a108d20d5e37ed8c3799", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596133, "uuid": "8b12cf8b-0159-43f1-9f68-9c3003447324", "comment": "Malware payload (SilentBuilder)", "value": "6fc2e8c5193138d7b9c2cd33f71517221ebf61c2", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596133, "uuid": "511c1dc1-1ea8-49bd-8e5e-6b0938ee7607", "comment": "Malware payload (SilentBuilder)", "value": "bb453a8caf64dbb5afb34163a9d79893545a746bd2d07b46fea57c0006af6a10eaea15e145c4f10f16add345f80b60bd", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596133, "uuid": "dd63e4f7-53a5-4e6c-b4de-caaf0bea95a8", "value": "T1E144E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596133, "uuid": "22379731-dacd-4caa-b971-4724049d420d", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7I:U9jFrjmkD7IvLDK3vLvfn1+2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634596133, "uuid": "b0d6b75d-a7ea-4acf-a95f-c8f32cc0092a", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634596133, "uuid": "de26817b-77d0-40ed-bd82-42852fd70383", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596133, "uuid": "ba87cf33-7bc8-493e-8688-835cb83226b4", "value": "07c4563b9667fad6b5c9497ced7a3514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3920aed0-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568408, "uuid": "9be05a25-bec6-4e14-bae5-6ef29c73df29", "comment": "Malware payload (Mirai)", "value": "6f8ced347aa51a44ffc554aab7d35938", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568408, "uuid": "8827f657-af45-4358-a1d0-51258e2ac3b9", "comment": "Malware payload (Mirai)", "value": "166a9c5bc4b8aa7feaa4aeda9faf3bf5958f0f106d4a9c7bd38baa2df49336a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568408, "uuid": "e0a5cdf8-81a8-477f-b63a-f891a94a036d", "comment": "Malware payload (Mirai)", "value": "3959d38d29cf0e2331802adf0706c42ce96d8868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568408, "uuid": "c76963e9-813b-462f-98c3-6c44ad9cbdf3", "comment": "Malware payload (Mirai)", "value": "7034201e40d58e08036321308f0895e4dc78e84a5478753fa947541de849373a746fc837d424ee5829b4fc21846404b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568408, "uuid": "6e7a3475-eb49-4053-9104-c000b61849b6", "value": "T19CA3941ABF610FF7E89FCC3749A96705288D541922A93B75B930C828F25B25F55E3CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568408, "uuid": "44308630-2795-4ec7-8151-664a62346438", "value": "1536:3KuyB2GzxUj/vhY56a2MUoyJZtPuGRod42+9G:3KuyQGzxUj/eyJdwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568408, "uuid": "06ad5395-af9f-4781-bcb7-b649faef9cf7", "value": 104976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568408, "uuid": "0f2a2a04-f932-4b93-8a30-916b50f7acc3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568408, "uuid": "28df5dc7-6030-4a60-8ee2-a823efc092f1", "value": "6f8ced347aa51a44ffc554aab7d35938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4867a2b-300f-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1634560508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560508, "uuid": "74cf9b34-5b46-4a6a-a7e2-42e6565a1694", "comment": "Malware payload (Tofsee)", "value": "f3baa4ed45dc9d0b254f70e6e4b0ac0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560508, "uuid": "1cd453f5-a1c1-43fe-a89d-06de6b65b1ee", "comment": "Malware payload (Tofsee)", "value": "16fdbb6f45f722fffffafa455e8c5dd268c895e6b050031f40ab557be5240332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560508, "uuid": "2781ca9e-cb1b-443f-b7ca-07f27e703952", "comment": "Malware payload (Tofsee)", "value": "b3aa03c4bebf4d65227f54f2cafd1e50daa8aebe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560508, "uuid": "cd6a9b1d-a789-454c-a64d-06419103f582", "comment": "Malware payload (Tofsee)", "value": "59835ab12f644168f886b345048c44eb5751e6b1b29b8263040455621a55391160d7138ce55483eee1df66f446e25ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560508, "uuid": "7951b39a-e66a-4c8c-9a39-fa325506cb25", "value": "T1ED747C00A690C034F7B352F98AB95378A52E7FA16B2450EB52D51AEE9735DF0ED3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560508, "uuid": "d9938faf-87e3-4143-a1d5-ead28c88d6d2", "value": "b4cda15a674ef12000829b9be50880b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560508, "uuid": "71a9b420-c20e-454a-97dd-642c820eeff0", "value": "6144:BPhtfImvvB2SRwvGklHadh1jCTz9Up+pcBywGFIutJ1H:BXIuvBPRw+klH+PjCn9UpJBlGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560508, "uuid": "7f383b30-d6c1-4688-b47d-f8a3a05933cb", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560508, "uuid": "a9bcdd62-995c-49bf-af67-30c4fa1ae5be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560508, "uuid": "c807c85f-0815-4278-a215-2e064af7e9e9", "value": "f3baa4ed45dc9d0b254f70e6e4b0ac0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3bfe2c-2fe3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634541548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541548, "uuid": "5359d9be-60f6-47b5-b891-be91abcdd011", "comment": "Malware payload (AgentTesla)", "value": "f7d56088be53b42a6235971cb3a917ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541548, "uuid": "2cfa0fcf-bf9e-4b24-9bef-5aed944580fa", "comment": "Malware payload (AgentTesla)", "value": "1726471eb3bca7943185517d3a5f2a26194041067f90758b8275855ce8bd4fe9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541548, "uuid": "d158c462-9d9b-485d-b970-7b67c64fbf75", "comment": "Malware payload (AgentTesla)", "value": "363c78c96e142cdeb452c232460a56abf2c9162d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541548, "uuid": "98dfc8bc-8709-4a5c-9b32-d23a770008d2", "comment": "Malware payload (AgentTesla)", "value": "252c162c84d8ded3a317ff21f485c079e1259f2d52c2c04bbde72d6f479847e171162a3ae5cec4139628a550710857af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541548, "uuid": "f7def3c4-1644-4391-9857-69504d6fcbe3", "value": "T147842320C839CA742A77F126E424D3E63F45F9DE57CB8E76A1C6852949C368277BF840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541548, "uuid": "78db84d8-c8f3-41ad-92d6-4b73fea4cc4c", "value": "6144:KYAzwLWQGJpbDW54MJF5Z0s4eA33dNd+iVcc0t+h0N2gfU/dPErjXEbaJNW7zmK/:Ki75usnA3NNtTY+KdfGEU6er5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634541548, "uuid": "ec975ee8-92d0-4013-8f94-8a306f3b0557", "value": 396872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634541548, "uuid": "408563b7-cf26-4b68-8ed4-4ad43fa91a9c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541548, "uuid": "43deae57-3920-4d20-a9b7-49c0635b2911", "value": "DOCU6309491220 Telex release.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd75d85-3002-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634554803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554803, "uuid": "9167613f-2cf1-4c7c-8592-da7e7647b596", "comment": "Malware payload (RedLineStealer)", "value": "9cd30cc49ed119e737cff4636a45385a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554803, "uuid": "084332a5-8449-4b64-b195-6cd8108b13a0", "comment": "Malware payload (RedLineStealer)", "value": "181c80a7ad3a6a0e4c3cba6a4427a06b59c8f363c86cb8b35c7bb89e81b0a49c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554803, "uuid": "1052b1d2-d6b8-4947-9dbe-73fffc4def72", "comment": "Malware payload (RedLineStealer)", "value": "5ffedf97a4939724c96f6cd64a67a72d3c7a7797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554803, "uuid": "e93c3502-442e-4bfa-bf22-7118e6349707", "comment": "Malware payload (RedLineStealer)", "value": "cc5befbf03c1fc5b8c42fd96fdcee2a63ec9f6ac83adc874b5c98274c01038040fdea1af7c9c3085a5de162485405772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554803, "uuid": "dfbed24a-9ed3-4e0b-ba5c-a2875b47dc2e", "value": "T10B85CF33E7935433C13F2678BD7653A8682ABE102D2C788627E51F6C1F356813B6529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554803, "uuid": "949d49cc-f2f7-4b64-aee7-a9af42ce3a02", "value": "ea56b45adb819773013639ab85e39bf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554803, "uuid": "9e6c7b33-690b-49bc-87c0-051046fbbae7", "value": "24576:YMV0Fz6x+oZ7J633fKPgYwKQpuLc52GDfuncAG/ie//3xnvioLGX:Y1YGnKg3AwpD2nsie3xzLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634554803, "uuid": "d4b0a88e-b19d-4125-b380-40b3888540b8", "value": 1809408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634554803, "uuid": "b3ea40f3-e0ae-4808-b490-3df9e92283e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554803, "uuid": "78dcd510-5547-48ca-bc1f-e107dc27246e", "value": "9cd30cc49ed119e737cff4636a45385a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e1f61d-3042-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582152, "uuid": "59614aff-acd0-46f6-a406-7654fe7a99b0", "comment": "Malware payload (Gafgyt)", "value": "aa81bf39d0af0948064e12e70b84e35e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582152, "uuid": "12fc1904-68be-4934-aa7d-8de428c75a17", "comment": "Malware payload (Gafgyt)", "value": "181e7391276f702c620cfb6c9d2032d28a01aa949ae5d929b2f1b9b1af5d0032", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582152, "uuid": "3e672fe4-c7c0-4864-b806-df75c75bc90a", "comment": "Malware payload (Gafgyt)", "value": "c02e6fb0f78ba9917991cfec02b15ce810c3a91e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582152, "uuid": "4ef396d3-3277-4509-a14e-01ad46b5eca5", "comment": "Malware payload (Gafgyt)", "value": "795bc0227c6665a5e241f52cc11960c5c60ac5d6e2b5f6ce9b4c5a1de4af531afa3264ed8559c52a3805b1323b85f008", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582152, "uuid": "92d91408-31ee-408b-95f8-0a899ba5382c", "value": "T106A30963F800DFB2F40AD67604D74B25B630FBE60E93266273573966AE361D52823F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582152, "uuid": "5e787567-6944-4ea0-9c87-d372868df2ff", "value": "3072:0l7Eh2ftDfcrx/niDPJyJohJ3gLjmK10PZHbf3Fj:0M8tDfcrxGyJoJ3gLjmK10PZHbf3Fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582152, "uuid": "d7e4acbf-1d99-44c5-aedd-f18b5872fd3d", "value": 101704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582152, "uuid": "b42b4e14-3f72-47cd-aa9b-e507a6cac39e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582152, "uuid": "ec3fc415-0493-41c8-9dae-5ee6a7f691f5", "value": "aa81bf39d0af0948064e12e70b84e35e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05339113-3023-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568751, "uuid": "5d5ca7b4-f46e-4eae-beb4-adcf1bf15721", "comment": "Malware payload (Mirai)", "value": "238ac56e0310192985a1d4b96f0cb19b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568751, "uuid": "d7511827-548a-4405-a4bd-c001dd37eee7", "comment": "Malware payload (Mirai)", "value": "18a925b9ee9908b4de8b629f0e5b16acb8ee60b4d90fb3efb728c8f678b5c304", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568751, "uuid": "7b81cc2d-1a41-48a9-ab65-2b6ecfcbf991", "comment": "Malware payload (Mirai)", "value": "13c19a0f281c60a33365683708c6c5c34e756e9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568751, "uuid": "5cab8fdc-af2d-4df7-ab51-1b862a0cbccf", "comment": "Malware payload (Mirai)", "value": "90dd6873f60bc3ee5adbc0e7a72191376c85ab9d221a1448252ad754bb1c83fcb71ca18d3ef495537b15bd69791bbe07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568751, "uuid": "5291c6ff-7f9d-4bc3-a53b-39918df17401", "value": "T16D73B70A7E329FACFBA9523447F78E11AA5833D527E1C585D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568751, "uuid": "f3db560f-ab22-4962-a35d-64a0d1b68fe5", "value": "1536:3IHb8FMv77EKQHlyXR1Fa6yBm3froxvdeEOPFal:Y78ivnEKMy7Fa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568751, "uuid": "aab58b32-c38a-4501-b363-d200055d6b1f", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568751, "uuid": "7bb933c6-75c9-47c7-a71e-ebf2ec4d4ecf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568751, "uuid": "ceb38b7b-abb5-4259-afa5-6f0ef0026577", "value": "238ac56e0310192985a1d4b96f0cb19b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fc5a72-301b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634565606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565606, "uuid": "7771ffab-dd12-492b-83ba-5ed8bbfe4f48", "comment": "Malware payload (Mirai)", "value": "9f729f03c9219fbdb8ecfa7b371d78cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565606, "uuid": "cfd3ae06-32b8-4eb4-9e67-044298a5c70b", "comment": "Malware payload (Mirai)", "value": "18cdd65a297946e208efd13ce840ed62d29c9247d600bde3ff49a7a4db1c5722", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565606, "uuid": "066fec1b-aa22-4f5c-9b58-60287aa3598d", "comment": "Malware payload (Mirai)", "value": "654f11aa2b4e8f3d2fd8ee8195eb2ce757b35d33", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565606, "uuid": "ebadf493-6c61-487a-883a-1eff0a4615bd", "comment": "Malware payload (Mirai)", "value": "4d7abd2c9a3509ae25a724d635dd2790f74b4f8a3b9dcc2fcdafb77c03a9a2135ce29068a684f9f4ee082e69a94a6029", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565606, "uuid": "3242e849-2e8d-4770-9651-b4a08ca309e8", "value": "T1A2733BC8A493E8F5DC1406782176BB735E73F13AB139ED9BD3E99567A801B02D00A36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565606, "uuid": "8f35182e-915b-4bed-9f4e-814afb7f0b35", "value": "1536:jwOgQ8JS4OZm3/W97kJ2f4ol+QLk+ltLugvSWy/ReAwJt8A73elf:s39HJ2f4ol+QLk+ltLugvSWy/oAm8iu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565606, "uuid": "ca1d3d36-d27c-402d-9583-47ca8d3bdae2", "value": 74328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565606, "uuid": "5bf590fa-687c-4bae-853d-09428066bab4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565606, "uuid": "adaf0568-e40b-4ad2-8ca3-fe08b5bd9934", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9155bf0-2fc4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634528358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528358, "uuid": "13316c18-d56f-4bc8-a385-f5c2bc386783", "comment": "Malware payload (AgentTesla)", "value": "d4fbd30ce19b0d9632201fbfe9b9943d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528358, "uuid": "b6a3d457-0492-4e4c-811a-f3a669e63b74", "comment": "Malware payload (AgentTesla)", "value": "192af07a83d42e824b8afc672e276e9f7906fc40c36776cb309e3d7762851206", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528358, "uuid": "a410144d-9af4-42fb-92ba-51ebe8d975cc", "comment": "Malware payload (AgentTesla)", "value": "f0dbe35cf51b8b1c909ec0ea5a8c1228986f36ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528358, "uuid": "2b8679d7-ea29-46c4-8a62-dc263486f7a0", "comment": "Malware payload (AgentTesla)", "value": "8a35c20504178c1a1ce2168b02b8916539e8e906c6472a4186d352bca29ef29a39a8761214e8b44db3122d1dd0eeb843", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528358, "uuid": "43431b6d-e779-4b1d-b3cf-9f4c5a8b8040", "value": "T1DBA412596348C637CF1C0B7864E2F21C2778C9A2AD81E3475E8538FA69F37C55E12A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528358, "uuid": "bba9d61a-6c8c-4641-b73a-a61c8022c950", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528358, "uuid": "6c041d9b-8781-42ce-8ae5-2d272a39c88d", "value": "12288:MhCwNOxcI0TMiXQHlbJYQ0lqr3KO5Khohy3fqZLfW:Md8uBRQFb33+mhygDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528358, "uuid": "c77f5965-60dd-4899-85c7-8c6a1bcd6241", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528358, "uuid": "f4228a88-5a84-483c-957f-583bc9b06918", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528358, "uuid": "13ac7c03-bb42-4e29-a982-5a3fda97ef27", "value": "70654 SSEBACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5b1a85-2ff4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634548950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548950, "uuid": "1e952dcc-e7a4-4ee2-86f2-f6772d0497e7", "comment": "Malware payload (AgentTesla)", "value": "ab3b57e3277c7be38aaa393edb6af19c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548950, "uuid": "0f46db5f-005b-4d5b-88c9-e3a9487c5632", "comment": "Malware payload (AgentTesla)", "value": "192fd4e93cf9ef63a9268626e7fa1b6d9c1543ecf61a4fde4641d927bf35fdf6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548950, "uuid": "809d75c4-5622-469e-a8f5-284688a055f6", "comment": "Malware payload (AgentTesla)", "value": "317d5be75f2f6d391bf4cf842335bd088083856d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548950, "uuid": "dcc89f55-7ab3-4e4e-8091-9eb903d57970", "comment": "Malware payload (AgentTesla)", "value": "3365fca2f6abb4893aaad259aaf40fedd3b6c94b36ded2e44dbb03bef53bfd74a7798a0f703606a1f6cc37864f538e36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548950, "uuid": "0613e8ee-40de-4e84-b46d-1042cfe295c8", "value": "T10A94BD27A07CC4F6F88D3DF146295B259AB16E921639F047D24FBDEAE8B3293C2051C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548950, "uuid": "4c28fe10-d2dd-4a12-aeed-ba6629123adf", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548950, "uuid": "295c2ed9-2324-4dc4-9fd8-0208f055bc7e", "value": "6144:VBlL//a6PnZl8PF1rGOk4ETvNezLr3cvkEcr8CUo6:Dpzfz8eaaWokEa8CE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634548950, "uuid": "788517ec-6246-4507-8446-acd364f32979", "value": 448543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634548950, "uuid": "b7070994-41f9-4e9a-9069-40e70fb22674", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548950, "uuid": "3594aa71-9121-4a2f-bc9f-6aff4cefb94c", "value": "Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e8fc6f-3025-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634570005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570005, "uuid": "0eab91a0-c4c8-4e54-9b69-6e0454329366", "comment": "Malware payload", "value": "3e9ad03497178a5b4d170acc379fae62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570005, "uuid": "d5bfd7fb-eb14-4765-bd02-90dfbf051f7e", "comment": "Malware payload", "value": "1948c5272365fb2b85a5be84be1cfb3d1c157afa8e060cdd4d641cade1253af9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570005, "uuid": "1cc09647-daf6-4717-8f3a-2998bd75799f", "comment": "Malware payload", "value": "999442c8d485f7ee48f26a31f1d7a234faba59d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570005, "uuid": "5850e9f4-7f89-47e5-ac8b-c084443f49de", "comment": "Malware payload", "value": "540963ca2ae0e38da6b64bba2939f2f9b9a62dc0aeb144a6710eef5d1c6f3d7af61ebca8bc2f9f7142abf35cfa1c1218", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570005, "uuid": "a6f16cc2-6019-426b-ad0c-e30513afb776", "value": "T153A4C5391CD16233F673AAB5DBFA29CAAD153A4772522C0E654E03821B43F536DDA03D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570005, "uuid": "4398907e-e0e0-421c-8543-18edb65db8a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570005, "uuid": "f17e81af-3295-48da-a263-74081cddc753", "value": "12288:nfSkFMo1CNzEusLMkdOFh9/H0bSYssAR+11h8668TRh128rAA6h1/1rssrhY/X6y:nfSUeA6kdOFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634570005, "uuid": "a8078918-c89f-452b-950f-0468ed0d62d9", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634570005, "uuid": "c5f3ac39-65f1-43d6-ae60-382eef4725e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570005, "uuid": "0a2fac70-fe5a-440b-a023-20e3f3166b3a", "value": "3e9ad03497178a5b4d170acc379fae62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce13965-3062-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634595849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595849, "uuid": "211b90d0-f866-4a71-8228-a47f2b24a88d", "comment": "Malware payload (SilentBuilder)", "value": "5b35ef3799ced12c393e84dc6c45dac3", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595849, "uuid": "77de123f-df77-4f4f-b9f1-76ac7537ee05", "comment": "Malware payload (SilentBuilder)", "value": "197cbc6892da9c5ea382ac620241bd3812ec06f714d42698de1f7437b671db50", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595849, "uuid": "9ab5bb5b-20e7-491e-9ad0-6a67576f3a8e", "comment": "Malware payload (SilentBuilder)", "value": "b33157077f2d63ee290f1a42c8e941aca0d40c9e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595849, "uuid": "f9d08772-8e86-4f18-b86b-b85410ce7e81", "comment": "Malware payload (SilentBuilder)", "value": "bba0d0b44412c0116151843a66c6a174b00536302f6fefac1e173801bc25277f01981e4cc4990e0d2a643411583cef50", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595849, "uuid": "21718ee4-4c6b-4567-8730-e0b6e3d4197c", "value": "T13044E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595849, "uuid": "86ea560d-d30b-4398-ac68-a8f19610fd93", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7C:U9jFrjmkD7IvLDK3vLvfn1+2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595849, "uuid": "926272b0-f64e-4cdf-bd37-e8b3a79ef56b", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595849, "uuid": "4a68f27d-f0b3-41b9-bc46-5ba854393d28", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595849, "uuid": "ee0afc9f-8837-4df2-affc-4474facdd502", "value": "5b35ef3799ced12c393e84dc6c45dac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12cab7e-3015-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634563134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563134, "uuid": "02c53eef-433d-472e-a739-3cac7a9b702b", "comment": "Malware payload", "value": "c63da0bed4738acccd7086966f131348", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563134, "uuid": "67e09f45-d241-4400-b308-03cc2ca810a4", "comment": "Malware payload", "value": "19c726ad76e738e554d23ec823aa4a7ed8d6455faf3025698f720b718382ca52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563134, "uuid": "c1f59b9e-75ff-41ba-8b02-97b6d290c59a", "comment": "Malware payload", "value": "9e0927664b5f7f5568627a799a13aee8eee4e76b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563134, "uuid": "9d59b64b-5e21-4918-bd6f-6e5384c69b10", "comment": "Malware payload", "value": "473b68b3c42e26fc14723d373964b030ff25c8c9c6394101f9c769d700bd4c3989fb84083b9cd003045877a4358eebb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563134, "uuid": "b4c1f2d3-652a-45d3-8cad-05a4008eaf47", "value": "T166D4E110A790C035F5B666F84A7A93B8B52F7A60AB2490CF53D517EE4B756E0EC30327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563134, "uuid": "dcd72e64-2a57-455f-b8f9-a231689cd86e", "value": "6f2a068c255b00f177d7f883be0dc61e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563134, "uuid": "07c88223-7c8a-4fc1-ba30-0ef4288a4ecd", "value": "12288:SPRw5D+tz4qUjntleSnSvZxlCcFtuLQieRx7ruAwNgxtl4gPOg:CySKqWrShvBFt9ie33wolEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634563134, "uuid": "06598256-3649-454e-9275-0bcfbae8fcdf", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634563134, "uuid": "caa29eef-3cc2-4620-ad75-9525da929e52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563134, "uuid": "98eae6ac-a735-49c9-8c8d-2a4801d8a818", "value": "c63da0bed4738acccd7086966f131348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66590037-3024-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569343, "uuid": "7d0b89d9-c3e7-4406-bb24-024bbf8972b3", "comment": "Malware payload (Mirai)", "value": "5a5e934d326d9f67cd018cd96aba3c93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569343, "uuid": "64885572-c5bf-4242-8a0a-a4fbf97a241d", "comment": "Malware payload (Mirai)", "value": "1a07813e802f24dbf7b3608ed2d81b707b15f40a8da00c3165d0ceb51ab77c90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569343, "uuid": "75550aff-d65f-4ac5-ad75-ca4da61f200b", "comment": "Malware payload (Mirai)", "value": "a4ff7b5510daea0a5bddb3feaf7cbcb974706983", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569343, "uuid": "a19491a6-6767-41d2-8063-0ec7c5c87c36", "comment": "Malware payload (Mirai)", "value": "3feda1238e4b2c3931130f0e103b33cdaad925c8526bd863a0abe47560ad6d7c68de9f20ba3fd6e5faa77370821abbdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569343, "uuid": "ad49f60f-b9b2-4cab-ba07-670113d991ae", "value": "T18B63F9827C81AA3AC7D017BBFAAF109E3350ABE8D1DA7253CC154B5176C650F0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569343, "uuid": "90f93b6f-84aa-4bab-88d5-a70420f4044e", "value": "1536:rvpMPHug5RlFyZS/l+UAuYkpzg0FS0ykFShYceZWYCNqxQM:rBMPHugc0lFSKcwcUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569343, "uuid": "b251c14b-0777-4f61-86e4-17022c19c593", "value": 70872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569343, "uuid": "c4c7d365-9175-4568-a345-025d9d4adc82", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569343, "uuid": "94909564-4028-409c-9c53-7a2d4215acfa", "value": "5a5e934d326d9f67cd018cd96aba3c93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb25523-300a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634558324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558324, "uuid": "d0185fe3-639d-4203-b99c-65a6428d8e75", "comment": "Malware payload (RedLineStealer)", "value": "7b714755e9e5876ec38176f2cc37142b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558324, "uuid": "27fa698c-ac8d-4135-a394-85f10d337a75", "comment": "Malware payload (RedLineStealer)", "value": "1a7f1e91a410058c2da9b149a553896346d450503d59209f034bb22847908390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558324, "uuid": "ff10782c-b9a9-4850-990a-5e23d9d070aa", "comment": "Malware payload (RedLineStealer)", "value": "6f074b3ee2db3ed8691828c95426656863326dfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558324, "uuid": "dcf17659-b827-4850-b6ab-326fca2cf612", "comment": "Malware payload (RedLineStealer)", "value": "0144714b076d5dce21efda966992fae2a99e307ae153eb20e29dd76f306c5b33f733300981411bd6b4d0f150672c302c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558324, "uuid": "739dc762-0461-4a85-980f-ad89dc154431", "value": "T19E85120648859F37F8B407700966F6926334ACB1D786A7F3E2E476C91FF21972828D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558324, "uuid": "3cae3352-77db-4dc3-bd3b-2455abcacae1", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558324, "uuid": "b5bce1c1-1ef6-4eaf-80c7-f8ab9d920ac6", "value": "49152:NQlhs/DNoZ5ofmxpm3AeV/GpYy3X0T/Wq:xJoTOIpm3AeRGp1Xod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558324, "uuid": "07912cb8-8e6a-4895-aec7-58bf36458852", "value": 1752064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558324, "uuid": "f81fa453-3189-4905-9f77-c30fb970e07c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558324, "uuid": "92337bfb-e43e-400a-95ee-1ccf0d105db0", "value": "7b714755e9e5876ec38176f2cc37142b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79d6e1a-302a-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634572164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572164, "uuid": "b5346ba8-871c-40a1-80ec-922dda127edf", "comment": "Malware payload (SilentBuilder)", "value": "6a2ccf2d22675d511af212c6bd1ed43e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572164, "uuid": "77c22590-fe48-4d8f-b589-385a450322bc", "comment": "Malware payload (SilentBuilder)", "value": "1ab4ce03a5614891fd47a1f7a04abe29c90a6e8e10109175f6f845973bbf370c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572164, "uuid": "e4897b8b-764b-4701-8d2a-16c57122c8bf", "comment": "Malware payload (SilentBuilder)", "value": "b642607e850d46d72dcbbeb48f0e5b7c237bc4f7", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572164, "uuid": "17457083-ff6e-435c-99f8-6297a8ac58ec", "comment": "Malware payload (SilentBuilder)", "value": "e55376532d4bab4c87cba2b9343fa9d621fc5a4be5aab12a31353e4a1a55e43b5c5c064c9d6dc6d6ea5f35e0762198c4", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572164, "uuid": "1bf0e0f0-4e98-48b5-9832-0546e7406fa9", "value": "T16A44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572164, "uuid": "df0f50b5-6b1e-444c-8471-08e83e7a42a6", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7i:U9jFrjmkD7IvLDK3vLvfn1+2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634572164, "uuid": "75a1913d-7b69-4823-847a-dccd09d28553", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634572164, "uuid": "32b9c857-018b-4a45-9fa1-3aa1ee68b299", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572164, "uuid": "abdbde45-9044-4faf-99a2-ee293b92c037", "value": "6a2ccf2d22675d511af212c6bd1ed43e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc2b935-3027-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634570830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570830, "uuid": "b9eb97d3-5bef-4201-987d-00d9d35134b6", "comment": "Malware payload (SilentBuilder)", "value": "69a741123d824a9b290ac9b210dcbd58", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570830, "uuid": "7c46fa8d-fdf7-426d-b995-e00c755daef8", "comment": "Malware payload (SilentBuilder)", "value": "1b9d6794f8df32779ea02105e8feff3a9308ac3a629a34097f65a915fe3a4184", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570830, "uuid": "ceaacda1-ef79-4676-9aad-eb8dcbcaf9f4", "comment": "Malware payload (SilentBuilder)", "value": "64a8f6650ba99b1133ebd8e209c6eb0351a72a71", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570830, "uuid": "4275a9a1-b0ec-470d-b0f0-c16d813d674b", "comment": "Malware payload (SilentBuilder)", "value": "15dbcf36fa981addd34e8927ec1681b72efafb9ecbfc4b2c45c894cf359d2127f28e45ee7098971b838e53072277389b", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570830, "uuid": "132cc3bd-3340-4142-860d-b7debda1a315", "value": "T1F844E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570830, "uuid": "49c9ae56-26b1-45e4-ad65-41edf06a19d1", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7o:U9jFrjmkD7IvLDK3vLvfn1+2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634570830, "uuid": "aada4198-08e6-4a51-a8d7-656988324ab1", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634570830, "uuid": "4ddf3093-2acf-49a3-b450-a3012ae7a31a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570830, "uuid": "7fd9d98b-9c45-4e8f-822d-0da70d263f6d", "value": "69a741123d824a9b290ac9b210dcbd58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2425da6c-3027-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634570520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570520, "uuid": "5db1e718-b1d9-4b08-942a-b98912a29139", "comment": "Malware payload (Mirai)", "value": "c6541a49b50b7b6b35702fa663df53e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570520, "uuid": "b21a94fe-4644-4d7e-8f0f-cb2f726cba0b", "comment": "Malware payload (Mirai)", "value": "1baf96f23efd4040ed827c5bd674daf5f2a6b79bd21e94adbac5b4493d523c0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570520, "uuid": "b2710911-b6db-4742-b7ac-a9c0289247e9", "comment": "Malware payload (Mirai)", "value": "7f68e05e30f7a4199cc5741e14a9393a31dc7313", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570520, "uuid": "d60fabcd-0285-44e4-af31-a77393434fe8", "comment": "Malware payload (Mirai)", "value": "a981cc715f329569f0573f80ae7d4826941975b5817c11cda41ac1a1e012f3dd84d1992a6af789584fb3fd2fcb132713", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570520, "uuid": "643536c9-943d-4ea0-ace3-f6c3c02fefc9", "value": "T105834C20A97D2E26C1D0B57F22FB8315B2E2270E26B4965D7C760F4FFF2464068572B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570520, "uuid": "91aaee8b-237e-4186-b6cf-3b49f9c9e7f9", "value": "1536:49eb2RVvTRssZva1/2ncGZcq7x3axNcFFhzki6vFf3fAfiqFtfFFp:ch+NcKvFHAffFtnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634570520, "uuid": "82a59e1a-2f88-40af-bbde-2cdf1f5a25d3", "value": 82764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634570520, "uuid": "48f33070-79df-4f6a-97bf-a32078e62a7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570520, "uuid": "62dac307-37cc-4dbb-9664-c1f0714905c5", "value": "c6541a49b50b7b6b35702fa663df53e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bf9c98-2ff6-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634549528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549528, "uuid": "a3d00913-9964-4c5d-8aff-10ef8feccd7f", "comment": "Malware payload (RemcosRAT)", "value": "c396a92cfb2646cde0b781fc5e65bc16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549528, "uuid": "5d9c4493-91a6-4afe-8bd3-1b43990ae582", "comment": "Malware payload (RemcosRAT)", "value": "1bcb5256d3c0ac49ce2b13c2638d2a795f6cdf77591d29cb01d0b3731615470b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549528, "uuid": "706e80bc-47b9-4606-b94c-c806808289e4", "comment": "Malware payload (RemcosRAT)", "value": "337984712bcb8e1ed775008a104013ec171da0e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549528, "uuid": "a7eed403-4b09-4515-9153-7122b9aefbcc", "comment": "Malware payload (RemcosRAT)", "value": "89289fb57a203b5e7e87a8dd5507a21d8d846dca8c988a936541b990be756fb2fdb94645294048803bffb74aa1fe057a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549528, "uuid": "0af20837-fa52-44a1-9d2c-82cb3c67c1d6", "value": "T1D815E12B26C557F0D1BA8B75A7B805E813F0A61FC312E7BA7D9502F4CE10A4A55236F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549528, "uuid": "f249291e-1ecd-403d-85fd-d36766a88815", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549528, "uuid": "05c47f51-3192-4c17-adfa-45d86d14e05e", "value": "12288:klsbGk4pRmXXukpDwQvPlSHWh9CjPCXhnAJMqUNtSD:kCGVRmEsS26m2JcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549528, "uuid": "d587b6d3-4e07-4b52-b629-815cec419024", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549528, "uuid": "c7ce6eb3-fe53-4ef3-83da-0c480ea56805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549528, "uuid": "78f2f871-4859-4f23-9aa1-15a22d5f5852", "value": "Enquiry MW886079 ( Flowstar.CO.UK ).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad5c452-3030-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634574451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574451, "uuid": "a7db8eb9-958d-462e-a6e6-63ce30efd60b", "comment": "Malware payload (AgentTesla)", "value": "ce00cefb977e8a50e8942a9ddb6eccee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574451, "uuid": "2d573ca3-c42c-4283-b132-284bb08690f9", "comment": "Malware payload (AgentTesla)", "value": "1be9f705235200cb51b70aadeb4252fae371b17c95d09b20ee79160833479ac2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574451, "uuid": "3f122e16-7c24-4e2d-a033-466f4a6a2918", "comment": "Malware payload (AgentTesla)", "value": "646e7fca81c38570a9a98cf547c030c7590941b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574451, "uuid": "e3d06f59-5342-40c8-a6f0-33321945e1c9", "comment": "Malware payload (AgentTesla)", "value": "6ca94ca1df3e7c0c5c88f5f4457bf9d0ce913d5839db7fd8e5e779d428961fd432447d5070795fa015ea0e8587370122", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574451, "uuid": "d761a109-76ba-43ea-b59c-6adfba9565f3", "value": "T12E94E11672698F21DAF527F80038A29307766D2781A0E2891ED57DCB3E7CF86857DE13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574451, "uuid": "3c432fd9-d3b0-481b-b12b-c379e8764632", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574451, "uuid": "a175dc23-f9cc-4496-9da7-076a7049796b", "value": "12288:eAPGAotUADRI5Dy+/rDIRhhuTFfZ904bBZpb:e6UUsRI5Dy5yD9Zpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634574451, "uuid": "f044438c-3ac0-4907-9d19-ee74bebe988d", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634574451, "uuid": "6124f5eb-cdf1-4f79-9f03-836998f3d610", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574451, "uuid": "9bbb51ca-8b7d-4cb8-a4cc-07d0be8fcd1d", "value": "opy BL and Debit Note.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01ab6ff-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568608, "uuid": "e3fa19a8-2fcb-4185-b165-58ae349f0939", "comment": "Malware payload (Mirai)", "value": "eeae6cc824a68994c4481dea8d05869f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568608, "uuid": "404f0be9-5b77-4c16-8243-c480727d6386", "comment": "Malware payload (Mirai)", "value": "1c9e25e134f48092a3682da001f65d04041e0165877629943a01f69a338a4a7d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568608, "uuid": "cbec85ec-beef-4b5f-bfde-3566b27d4f89", "comment": "Malware payload (Mirai)", "value": "7a73af4673133c9aaa3fa25ca47ea522d90cd92d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568608, "uuid": "20c8b42d-5d3c-4a22-8bc1-3c53fc5b1f36", "comment": "Malware payload (Mirai)", "value": "78538fdedf809cff8a9ea57295a07c5b6e4440a4a969ccca3607040a3e59cd96feb1ae5ddb34199a9a9e0275db6b6bda", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568608, "uuid": "8ec443e3-d556-4453-81a5-2943d7eeb1be", "value": "T164E2F1D1CAA19786D42A413FDEFC699B0C10C92E1182E79E7DC83076DEC7BDD6414B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568608, "uuid": "d35e6129-631d-4faf-a80d-860516d07054", "value": "768:jmgrVgL0xTaPZphy6aFtc5yIHno8DQllnbcuyD7UGQRjA:agh5Wxphy644Qllnouy8GyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568608, "uuid": "2adfa26b-5101-4612-97ab-538a58696ce5", "value": 33948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568608, "uuid": "563b13b9-034d-427c-8a5b-66993251396e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568608, "uuid": "2fb9d7dd-083a-4768-bcba-9a59d6ad867a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef04b99b-2ff5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634549386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549386, "uuid": "f7f71edd-36ed-4669-bf65-4fe4145123ef", "comment": "Malware payload (Formbook)", "value": "cbe10dc89d5f0d9ccfa928bae10becb5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549386, "uuid": "5215f730-a67a-4476-bef2-d149f32698f5", "comment": "Malware payload (Formbook)", "value": "1cb6deac4e20e2a13002d118fc863a0757409bab2f45a9390529f1e6ad5217fc", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549386, "uuid": "a1680399-fcf3-45ff-809a-75dc6519f57b", "comment": "Malware payload (Formbook)", "value": "71d2c7efad322f87ae12cce3ee72b0614d11e634", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549386, "uuid": "295e98ae-7ca1-432f-9a99-f88fcd418355", "comment": "Malware payload (Formbook)", "value": "60ab0f820758e4a0562caf98ddeffcefb1eb34e10f7b2f251c63253c53fa03d2ddd88e62e84a5b72c87c12f5752754c4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549386, "uuid": "313f597a-1eb7-4758-ba99-5ca2df62c3b6", "value": "T112F46C2C77D4203BE170617CFB2BE65D5927DDA00948C92239EFBB895B3DA0212A57C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549386, "uuid": "0668a7e3-1805-43f6-9c20-2bc7952d82be", "value": "c27a46121fdf0c7d592b2676dec19736", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549386, "uuid": "7f39f817-15b4-4402-8086-d64236a53907", "value": "12288:U2QfYldSyZTiq8WIPK2gMrKFuAV/LFLtF/ULvFfji6O6BxB:UrfByZKz5gegDFLtF/QFfji6O6BxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549386, "uuid": "bd8b20a3-97c4-47cb-85a0-7cfb493235c1", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549386, "uuid": "fa1a2104-26b6-4582-a604-9626d46dd2c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549386, "uuid": "30ceabcd-5251-41ea-9451-f4ad2cb00ca5", "value": "DHL Confirmation CBJ211011128996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfc94d6-2fef-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634546536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546536, "uuid": "4bf6c77e-2634-4574-a147-c1211e3db067", "comment": "Malware payload (Formbook)", "value": "c3f0505001277d2b23d8acc658800c35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546536, "uuid": "156ccb9e-b106-4cc2-a2c1-0d03f742bbf1", "comment": "Malware payload (Formbook)", "value": "1d3c91b0ec0e3b039a78c042eec94a3aebbe5da4d6e61cf7b7e54de22084d4a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546536, "uuid": "1edf6c60-2fbd-48b8-8045-c57a46895c31", "comment": "Malware payload (Formbook)", "value": "b7eb8afcf3f7eb35d71c2b1fec6c3b099a57ec9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546536, "uuid": "013f0e8c-a098-4408-9e26-0d48bcae2b2f", "comment": "Malware payload (Formbook)", "value": "91c22509051cebe1c7a2c038d542aea8c3ebf9ec2774d5102d8490c7409fad759a252452b7e135350b69d13624651b80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546536, "uuid": "404757e0-eafa-49ed-b53c-fdaf8d534297", "value": "T1C8D4BE3CEE0826B3D229C63DE49D0506F67444D737316E8716CA3649741FBCA39AA39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546536, "uuid": "7aa1be03-d13b-40d2-9dfe-721d246557f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546536, "uuid": "2b2dfea1-7a2c-4a65-ade0-dfdef1512462", "value": "12288:y4n3bUzN/aLflq8FJwY1z6eRuQtbbtLlOhsxeHH:N6CRSY1X99ppOyxen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546536, "uuid": "12a99457-9149-461d-a7e0-a0920bed9e9e", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546536, "uuid": "389b65bc-0710-4556-8896-1a43c90c71fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546536, "uuid": "049763d8-47ad-4be0-bfd1-da6695c5b8f6", "value": "c3f0505001277d2b23d8acc658800c35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911e781a-304e-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1634587454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587454, "uuid": "e7ccc235-9eb1-42fe-be47-6f09b2b54544", "comment": "Malware payload (njrat)", "value": "ee3daa79d7ac4570d146aceb38253293", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587454, "uuid": "afe7fff2-a1af-48e2-8672-c5e8bd320a6f", "comment": "Malware payload (njrat)", "value": "1e00836862dc8fc7fd742e9df49a8b0d141b391139bfb1c5a23f20413eb6d639", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587454, "uuid": "fd7f5529-06ab-4008-ab9a-5f783fb32bd4", "comment": "Malware payload (njrat)", "value": "40b16db43a5c60e9f6a0ec49ab984698a3d1129b", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587454, "uuid": "8e526dee-a9a0-4d81-9708-068adbcc483c", "comment": "Malware payload (njrat)", "value": "11d3b17986223ae0f1a663812d21d465ab633dad6d83dedf7c983257cf0f7a4231f80c69c85c42597348c9c41c6a6352", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587454, "uuid": "bd08552b-28bf-4c4f-ac0b-a0af4de28d55", "value": "T172513489E8CF41B50F119F0540A3E66E59AB4C63ED40694CF0AF6299AB3CBDC4992773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587454, "uuid": "98dba9c7-c3e7-4cae-990a-7009ee745844", "value": "48:7T75LDCfqV1qY0mq/qTJGCqVvdqTj/UO//CZ7:7JGyaYASdGXtEf/U8+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587454, "uuid": "f103ef17-dcf0-4525-b01a-ed9518d35e97", "value": 2497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587454, "uuid": "c2eb025c-a1aa-49d8-8f3f-2370ad489816", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587454, "uuid": "76dfe1d7-4267-463f-ab47-947618b0e1c3", "value": "Invoice #019972.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6c6a83-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634561270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561270, "uuid": "801e6033-9118-45ae-b6a4-537edb4f7b83", "comment": "Malware payload (AgentTesla)", "value": "dd664ec6d8c7ee931799bf5fea8de3a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561270, "uuid": "24b8f197-f60a-4ae1-86d8-e7040ff27b43", "comment": "Malware payload (AgentTesla)", "value": "1e6ec6f7a104787ec1f1c4da75a520ac98635afbda35e9be7735a3712efb2a6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561270, "uuid": "63b37f25-a0e1-4725-b66e-3a0534e73502", "comment": "Malware payload (AgentTesla)", "value": "7f00b0e16829429f2b71e7860f42a00286214aac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561270, "uuid": "72d8215a-7fba-4a92-a357-eb06000f6cfe", "comment": "Malware payload (AgentTesla)", "value": "cad9ebbdf60d930e298894410173ca514345bbb3a4591052c6b733ac74a3fd1360c25438084ca7141946d134c6b9f49e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561270, "uuid": "fcdacaa3-6ecc-4dfb-b3c3-0365a2f61009", "value": "T14B9412563784C97BD72907B1B4E1F3A42BB48CB16F05CB47AC8935EA2E767006ED0627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561270, "uuid": "42b07e93-d255-4b58-ab93-9341686bd254", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561270, "uuid": "b65f1831-8695-4e01-a14d-a6f4250eb822", "value": "6144:Dg3a0n4oIxntRZLBznOkDedEJ0CfL7F6X6SF9jyMDZ8sbS3GzwcY:z0nkx911LcX6SFJpqu5Ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561270, "uuid": "1e02114f-721e-4931-b79b-1c920a5d4560", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561270, "uuid": "cf647dcd-8ea6-4184-ba86-15a0ea338a2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561270, "uuid": "dd700608-bcc8-4625-a528-f6273af6e355", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56286544-3024-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569316, "uuid": "cb25a843-df50-40b4-b728-58e39cc0a039", "comment": "Malware payload (Mirai)", "value": "55f96416f4c63160fe3dc3bd70541001", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569316, "uuid": "21fa95d7-7b1a-4154-b305-8e1ab1f0b7b7", "comment": "Malware payload (Mirai)", "value": "1f2756414a35f151ec76c9af1b76df549938608345af0a21bb3f209edabbdabd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569316, "uuid": "e9181321-8693-4336-abb1-fed8e1a5a107", "comment": "Malware payload (Mirai)", "value": "76cbd1a86ef39f5d69f49202bd684d655385d7f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569316, "uuid": "52eb8c90-3684-474d-967c-2ec4d754e462", "comment": "Malware payload (Mirai)", "value": "b2fb214cfcea54e97d31ab687a05317b1605d114f677a79f37250cf02776914d4c0fc721fbe8f44d055bb967a42cbea6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569316, "uuid": "4ac0672b-e4fe-4e42-8fca-35442c0bd48f", "value": "T1C383F680F98B81F5C50B483050ABF53FCE31DAA95171A76EEF8D5F32DE67602921624D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569316, "uuid": "18c058b6-92f7-41b8-ad26-bfcf8daf372e", "value": "1536:cMF3ox7h2UGL6xdVLeMG+2Imu+HCYqYIs7i+S+1sKaW:cMmx12UGL6xdV6+2Imu+HCYqEi+1s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569316, "uuid": "7d28fe7a-8d6d-4f9c-bc1b-a758b0f19e25", "value": 82704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569316, "uuid": "a395b307-f062-4513-9631-8d5402baeb3c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569316, "uuid": "c20c7907-1442-42bc-953e-acd897b57471", "value": "55f96416f4c63160fe3dc3bd70541001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2308c8-3007-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634556975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556975, "uuid": "b8c4c351-48eb-458d-abdb-ecb9a2ef4b0d", "comment": "Malware payload (SnakeKeylogger)", "value": "5e4006f91dabad1c5e0ae08e2241775e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556975, "uuid": "70312a6f-1e3c-4b44-93f2-ba572e7275fc", "comment": "Malware payload (SnakeKeylogger)", "value": "1f3ebec39406d9a1db488ee7720e4d174dda862451540da480b834efd654699e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556975, "uuid": "5c641c60-ac07-4010-8c8e-057f9fee1024", "comment": "Malware payload (SnakeKeylogger)", "value": "73328586aa35340ade37e1b95522eef12e8314ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556975, "uuid": "8b528f1f-cf11-4bcb-ae71-3e4ff0cffe1c", "comment": "Malware payload (SnakeKeylogger)", "value": "30fbfa22225c62a0b071a0d1cb71b3c9da2b588d3033094c65a9d3888592c5e9ab4e605a80f302829ef54d86b154d9fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556975, "uuid": "92666188-275f-4b32-8c01-607cadd0b323", "value": "T1F673C7013E046689C4920C7901F259D1A3798DDF8E9ACE3779E1B73E7873664AE0793D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556975, "uuid": "5789fb66-a0f3-4ba2-b4ea-71d5c74fab25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556975, "uuid": "74d46675-c37a-4903-87f3-cffa5fd854e8", "value": "768:aYiJikJFIULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0cD:avFIULFMAAiu6JL6oNsgFAyox0cD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556975, "uuid": "c4f75c67-54ce-4dc7-b656-ab8b7d5886c6", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556975, "uuid": "a1b0888d-b050-45b5-a44a-7163294967f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556975, "uuid": "a8a69833-e9bd-46c2-a604-e9cca34ac977", "value": "5e4006f91dabad1c5e0ae08e2241775e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d2f31c-301f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634567059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567059, "uuid": "9297a6ff-c560-40fe-b80b-655333695b70", "comment": "Malware payload (Mirai)", "value": "fb1a19adc8fccb27120914697f61024d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567059, "uuid": "fddbb630-8637-42df-a601-8179c0c83f22", "comment": "Malware payload (Mirai)", "value": "200478f45ad65a8f9da66dc6713849221666acfba2875e3954ed2ac7306f6741", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567059, "uuid": "c5f43852-117e-4e7f-b66a-476586c73877", "comment": "Malware payload (Mirai)", "value": "b05eae21fc2bac69ab3a3a4d2197dd9b082f6801", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567059, "uuid": "324f3897-2f14-4f2c-836b-ba8d306f939f", "comment": "Malware payload (Mirai)", "value": "59a114bb6e8c5d2cc3b636f364a259b80ccec14e9c709fcc2cf2489bb8b4b0676f1231b7f11d89fb811a989d649a2b66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567059, "uuid": "899985c0-bdff-4f05-a80b-24150a6bf2ec", "value": "T177830845B8929A67C5D423BAF66E018D3B3163E8E2DF7217CC115F2437CA82F0D67A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567059, "uuid": "225babb3-1daa-43d3-8325-5b4cb32043a8", "value": "1536:R9xBsPyfXohUM35gORnyVcFuEjEB1ANlTGxnPJJkCd42+:R97sPyfXdk01yNGnJk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634567059, "uuid": "fc959e86-d5a0-45a0-9801-8ffdaed24e38", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634567059, "uuid": "18a875c0-8e56-43da-915a-dd4c92aac396", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567059, "uuid": "d60b3275-9908-47d5-bc87-898814f0bcf4", "value": "fb1a19adc8fccb27120914697f61024d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2bfa95-302d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634573465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634573465, "uuid": "3064902f-29e2-47de-898f-bd0f21e3eb2f", "comment": "Malware payload (AgentTesla)", "value": "5f546d983398118492848fbd6738e005", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634573465, "uuid": "ebb05c65-5970-4990-9174-c67b248fe045", "comment": "Malware payload (AgentTesla)", "value": "201e4f71a185f6b79203ad873cc5abbbeb85f1b11a23615403bcabcbb13932d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634573465, "uuid": "56157fdf-479e-4c52-8db6-2f97f58328a1", "comment": "Malware payload (AgentTesla)", "value": "77d3a30309ecd1095118d49cd343dd6d82be592b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634573465, "uuid": "95d50716-f32d-4d9c-a463-03a83d2da351", "comment": "Malware payload (AgentTesla)", "value": "d9683551fa93a11b99d490625b4d685a48bf057c684da1ed982d1767d11401c56db63d919f7d18f4c96b3ac1621522bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634573465, "uuid": "8b2b99f5-e42e-4362-a914-3d04d75e164d", "value": "T1DC94F152B2788F22D9B457F94438919307726D3340A0F28A5ED5BCCB3E79F824569F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634573465, "uuid": "7554e614-9992-4f7b-b251-b875d1b1378d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634573465, "uuid": "94120d2d-c108-4778-9238-8472f24fc82a", "value": "12288:cq09GqFXWFDWQqjUTvdDDBCA69AOtaLbCD0DA:cqisFiQqjUTiQL+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634573465, "uuid": "c3c1cb54-50ef-465c-b0d2-e1fd3141c775", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634573465, "uuid": "c4ba0eda-d9ec-4690-be7f-c3a328890b56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634573465, "uuid": "869e84a3-7872-4a22-95d7-5aab3e198e11", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321214a8-303e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634580422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580422, "uuid": "27da756e-0ba0-46ce-819f-79902955b7b2", "comment": "Malware payload", "value": "d618623fbe57aabec489dae8186d6ef6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580422, "uuid": "40da043e-f422-4705-9a73-82a53e794867", "comment": "Malware payload", "value": "205c9f62e617e1c619fe35d67be5af588f3d60e0a1f17aff17918de1ef285342", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580422, "uuid": "ea922e02-3535-4b87-b7fb-d7064fb1efc6", "comment": "Malware payload", "value": "067eef7848338c5d76db591e1efdca5bbef90d79", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580422, "uuid": "1944abef-d214-4ba0-85e8-d366c7f10228", "comment": "Malware payload", "value": "504d40d014b8638bf9c62b593364cf8fe9b8dfd6a5385be26718bad3eb2c9d3c7d6665449c0cd61f920de3a62f4fdd9e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580422, "uuid": "f87763d8-c02b-44fa-b72b-d589ff421bdf", "value": "T18AD58E23F2918437D1772A388D6BA7A8A839BE102D74984B3BE83D4C5F3579079253D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580422, "uuid": "a7a85863-0040-4f47-8e6b-21c71c6e26be", "value": "24576:2xRrI562OJnW5ApMpBBR3F/3bfoBq+84co41wFaDGgBTU+aVrfe5OYHEA:2xNE3F/3bfo4ecooTPaMOYHEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580422, "uuid": "8475aa2b-88e0-434f-bb0d-febe2a8dffc7", "value": 2840576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580422, "uuid": "415a26be-1e6c-4685-b5d8-604b81c434a9", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580422, "uuid": "50536d94-bc75-4b24-965f-7be5aa8cb15f", "value": "_xqbkcjkenkpucyawzuurjpqjtsebcwqaxzidrxea.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7da2b2c-3006-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634556649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556649, "uuid": "2c8abfec-6c56-47b5-9ba5-4ec85b239423", "comment": "Malware payload (AveMariaRAT)", "value": "dedf943ff806b843bfbf70f482043abb", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556649, "uuid": "d75b540a-b028-40b5-9bad-4e6eab361e87", "comment": "Malware payload (AveMariaRAT)", "value": "20c946eadf8195d4d6c9b6634f7f8cfa56cb8e8423a37517556a30ee0aadc053", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556649, "uuid": "9c38d5a1-a9c2-4274-8b56-61839d2b40e7", "comment": "Malware payload (AveMariaRAT)", "value": "c18cf743fb7e0547fbc6076e3afb87ef1abb177f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556649, "uuid": "f490b89a-1059-4e09-b471-b9dce6dd18ae", "comment": "Malware payload (AveMariaRAT)", "value": "ee9b0d1a7b6749568eb09f85da6cb45d79ba35f8409cff6a0534a538a824dc152eb2296dd8b9b9036f0be2dc555c05b9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556649, "uuid": "447c4fd3-64e8-4745-ac9e-ad232da2cf76", "value": "T16EB4AF211603C42AF2C432F245A396F97BBC7C137D94D99E26A9796B042D2C3AF0775E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556649, "uuid": "4776fd65-639d-4203-bae2-a3833c595f52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556649, "uuid": "e67ff3cb-b31a-481a-b92c-3a128ff4361a", "value": "6144:bYRc5m80dO+390vGOnjaOThdzF1t4K6MWfSU2BRMer:0RpBt0PnN+KhySBBRMer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556649, "uuid": "d75216c4-b196-4731-9bfb-ce5805bbc84c", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556649, "uuid": "9eebc807-0731-4ba2-962b-a6accfd0f96f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556649, "uuid": "d2206598-e680-4189-87da-c604b4325795", "value": "Kyodo International Corp - Products Lists.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa33322-305a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634592597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592597, "uuid": "851ea53c-c71e-482a-be8b-0a7b487969c9", "comment": "Malware payload", "value": "9fd8919e62792e6d93995b5f7abda850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592597, "uuid": "f9ba2f48-9a6d-4a6b-a562-d30e945ed4b2", "comment": "Malware payload", "value": "20e9c3ad420ffd76094590adced58f056d38e5d6afe3ee9e21e7b29ff5a80da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592597, "uuid": "526b839e-431b-4f47-98f2-e7c4b88e6bba", "comment": "Malware payload", "value": "c143d0ece3715bc4c484e201f4b9c5e7630e7fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592597, "uuid": "fa6f74f3-1716-4c51-9bc5-b3681758de9d", "comment": "Malware payload", "value": "9fb70ff25494544de645551afa0285bafdd1e89284d5c8feea978a5e329215c953917c3b54d0d617e382b7681fcc449e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592597, "uuid": "b971ffe0-e718-417d-8810-2a200a1c03b1", "value": "T11905AE287749EA58CF5CCEB78137426453E8C07772AFFB2A34C2AAD448C7512DB0A5D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592597, "uuid": "0d7fbb3a-db16-486a-ae7e-770cce11930d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592597, "uuid": "8bd96389-e85f-48fd-bb7d-a95a288c1a12", "value": "12288:hT9Ozbac2dip/s1rIrsc4hbmOwD71tJha6QSGjg/EhWcWLB9hqFezRmKP:hTQV8bmOKhtPUkMkb9hqsNPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592597, "uuid": "9cdbcf75-ad6e-437f-a5f9-cbd0d10b3621", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592597, "uuid": "8ba198e9-2a84-4d48-a04e-aa98deda2077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592597, "uuid": "944f38e0-bd70-4d63-85a9-419a00f8532b", "value": "SecuriteInfo.com.Variant.Cerbu.117505.10723.10196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b89a94-2fef-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1634546659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546659, "uuid": "f41fa8ca-23ee-493d-a2bb-a795ca31c73d", "comment": "Malware payload (Gozi)", "value": "4cf868569a638e63267f8b049d21b7f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "tiff", "colour": "#D98341", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546659, "uuid": "6cf66211-a0fd-4cf0-b1f2-377ce3de4e5f", "comment": "Malware payload (Gozi)", "value": "210943dc00e09514fe7d9a433596e78a21d7eb3bf3537b7e8327b985c8ad7d4d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "tiff", "colour": "#D98341", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546659, "uuid": "1b9feb03-d3af-4762-b470-90dd78924e55", "comment": "Malware payload (Gozi)", "value": "8af546a92d892a3dc6a97b6827907ee0ca503985", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "tiff", "colour": "#D98341", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546659, "uuid": "448e01a7-91d2-4d12-b8d7-d92c230c2c18", "comment": "Malware payload (Gozi)", "value": "1b984097cca1fbe1efb83132ecef4942de3feb8c99612f8d300b6443ab0ff5ac5fe1932ce2996c7c7b610153537eb4e2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "tiff", "colour": "#D98341", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546659, "uuid": "6e0a57b8-8ef2-4ebd-a302-dbbc91e29412", "value": "T1A3D49E2032A18032E177163584F5D1F05FADBC225D74AD8F72C52A7F0A7B6D29A29B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546659, "uuid": "d1c8bba2-ebff-4aa9-b32a-f533108b9cf7", "value": "5d7c21acb216092a102403a32ccc6d15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546659, "uuid": "d5622f2f-5df5-4c11-94d4-6cbd84b7bac8", "value": "12288:/8dajLSIFcqRfyo4Tg89UtoM+YD3h0QYDpnynKZ0febiL+eMq6FiIahzrg:Roqpyo4TgmUtoMapy60feKQiII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546659, "uuid": "c3c908af-57fa-47fb-b988-c34cfbee3b6d", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546659, "uuid": "f2bab30e-96fa-403c-b498-a66793852376", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546659, "uuid": "abad805e-472d-4779-bbc4-4bec519b4b6c", "value": "616d32105a9b7.tiff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c109c60-3009-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634557622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557622, "uuid": "eb7f03ef-2842-4cbc-82da-e760cefbfa3a", "comment": "Malware payload", "value": "06b323c60a0a02ac4529da5da9b006e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557622, "uuid": "88242011-9252-4496-9a02-8d125a4fc4a9", "comment": "Malware payload", "value": "219cc1dee56c58f8d8505fd6ac5bb484990155bdc613839599568dcf4a0f968e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557622, "uuid": "21274b3e-3199-4d6b-bb74-621786e0376a", "comment": "Malware payload", "value": "3fd90328692ff8c90820b400dd39c8c8200bb9a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557622, "uuid": "22ea7020-9e43-4713-b1c9-78e9db0d04f5", "comment": "Malware payload", "value": "0081ca05f6e78815351d104fe647c2a469a8af09236e49ed55ed1ad717a60a29f6c4fe11c3ac8acc6166fe52e00f8edb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557622, "uuid": "813ef4e6-a749-4042-9b4c-09dc176afe8e", "value": "T1D1A4F0167164DE27C8FD08F884385597177299278425F2CEADEDBCCF3AECB819129683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557622, "uuid": "a7bd216e-cde3-463a-9fb4-5dc193e439bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557622, "uuid": "c5cd8985-b19f-4123-8347-414315caf5de", "value": "12288:iK5LHfG4pMUTybfxLSw62ErlCM1NWP739YdN:ikp1ybYzrMWNWPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634557622, "uuid": "bc0054a3-6976-4b68-95bb-8727ebbcce44", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634557622, "uuid": "d0b6c339-28d5-47e7-81b5-b2ee51325a58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557622, "uuid": "231328ba-7b65-4d1c-beca-716fe4ecf0e6", "value": "70654 SSEBACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e3ab89-303e-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1634580699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580699, "uuid": "74f0775b-5407-4822-8f66-d1f0abd1badb", "comment": "Malware payload (AsyncRAT)", "value": "d734df12c427c2a3e97e60b95fcc44a2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580699, "uuid": "086ae010-f0bf-4a4a-aae4-76944c7e2bab", "comment": "Malware payload (AsyncRAT)", "value": "2202801c0f7dbc1eb86736e14e945e056dc6790019769e495058caf631bce17f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580699, "uuid": "01140226-69e5-49a4-8d75-702ed61d03a7", "comment": "Malware payload (AsyncRAT)", "value": "35a43c43df1a45d391c0a776d8053892bd3834e9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580699, "uuid": "b654a53a-843b-4c7e-80fa-5c31933ac517", "comment": "Malware payload (AsyncRAT)", "value": "28dd79616f902536df8255688f139db8ca5adc13dbc26e1549a853cf9ed82140f4216c4888eed331343be7c87b0b2b06", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580699, "uuid": "70f5dd26-1326-40e8-bcfd-fb6899dae481", "value": "T15C74CF02B5F8464FE6B75DF8F6A1920D5E33DE5A3335A3BA5048F744A2B33588706A21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580699, "uuid": "3908c80c-e5fc-45e2-8c65-a8c9d90666b6", "value": "6144:x9omBEO7d/2uX02tCTTAddLKrBd+vE9RUv0/ytyR3/iTp0:bPBNk8IPAOrBwvErUvOYp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580699, "uuid": "2a645367-0706-4b31-9b2a-b6528b198c8d", "value": 351608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580699, "uuid": "0dc118f8-0f35-427f-9007-e88ba3199e90", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580699, "uuid": "1c95e96c-a1f7-4cb4-9a8c-009dfbfb6ac2", "value": "Issuance with AI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91feceaf-3029-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634571564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571564, "uuid": "0fd29d67-fa8f-4e43-8af9-b66b04aa1a0b", "comment": "Malware payload (SilentBuilder)", "value": "5674fb21404b3397338d641f83a512fc", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571564, "uuid": "efe14a6c-3858-4bb2-9f49-427142627f3a", "comment": "Malware payload (SilentBuilder)", "value": "2269896a888b451212daf5c6b5bf958f6ec0d291e1f24e2a99cd4b565850cfd1", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571564, "uuid": "018d98a1-2857-41c1-ad9a-f45d70891565", "comment": "Malware payload (SilentBuilder)", "value": "ccc113549a3a38b3fa12e2790d45da763f8f1105", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571564, "uuid": "13af78bb-964c-4410-bf4f-fc0f5a0d4978", "comment": "Malware payload (SilentBuilder)", "value": "77a0d3205ab27f58f96d64bcd19905fbda1125a5cc9d341cb5a9f4b01921393664884c43ab574a2142d89ac62b4d96c9", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571564, "uuid": "bfb08c24-c036-4d36-80fd-23dcf8ed55fb", "value": "T1BF44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571564, "uuid": "84692e55-07f6-44ff-bdc2-a388ae79bb3e", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7K:U9jFrjmkD7IvLDK3vLvfn1+2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571564, "uuid": "dc0f3fb8-c4b2-420f-bc84-a89aa9a88980", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571564, "uuid": "1e932265-144a-4ce1-ac98-c0ed67c9c7ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571564, "uuid": "d535cb31-2f2a-4671-820e-07453a6552af", "value": "5674fb21404b3397338d641f83a512fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4943fb12-306c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634600218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634600218, "uuid": "b82e0cf2-6f5a-4fd4-85dd-de06862ef006", "comment": "Malware payload", "value": "edd9798569447f5264a467bc71e42964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634600218, "uuid": "5d17b88d-3d9c-4494-bca2-657d40a1f756", "comment": "Malware payload", "value": "229eb4820a74104923a8714a8e2b8a8fcb4b6c44f0559572b08a8ad542b8cdc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634600218, "uuid": "f34184ea-aef9-446d-a25f-18a9f39c3ba1", "comment": "Malware payload", "value": "a86b90dd0838031fdca08b95cd4c95e997397f4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634600218, "uuid": "688bf1b1-4c39-403e-ac66-d5d7b46aacf9", "comment": "Malware payload", "value": "a110c5c4d8d7e1021bdaeeada2ca95f3693a8c7fe935610b4b38031ceebe544e73491bf919d7953b9abf68eca5f15df5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634600218, "uuid": "3df6c196-e929-43e4-9e6f-e0f2f6a768ce", "value": "T1EB659E11F742A036ECE3107386FF4AFF8D28A621034894D7E3C45DA95A619E27B3765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634600218, "uuid": "83baf1f0-c8e8-44f1-8389-5d9e7d744f4e", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634600218, "uuid": "a4c2482a-9a0a-443d-a8ac-458c106232da", "value": "24576:cxpXPaR2J33o3S7P5zuHHOF2ahfehMHsGKzOYf8EEvX3CZ1zo:spy+VDa8rtPvX3CZlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634600218, "uuid": "e22fb8f8-b8db-49ce-ad61-428e1fc3dac2", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634600218, "uuid": "c55a8ec8-a0da-4575-98d0-15fb7830fbb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634600218, "uuid": "305bbaff-7320-4ff6-89c1-5ef22d82bfd9", "value": "edd9798569447f5264a467bc71e42964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35457397-2ff6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634549504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549504, "uuid": "27e48d47-8792-4e4d-81b2-744ea31d5875", "comment": "Malware payload (AgentTesla)", "value": "e5a35f8c565ddea415804d4b05244e28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549504, "uuid": "923af5c6-7ea9-4538-b5ec-379e9c0830a5", "comment": "Malware payload (AgentTesla)", "value": "22da4275847d5be9f1d21df99c3f51be09d31be7942940732d311b030c62eeb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549504, "uuid": "58fc30e0-7efb-401b-b401-c6176ad56b70", "comment": "Malware payload (AgentTesla)", "value": "47d030e20b324c3706d652b2a562a61547e14fbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549504, "uuid": "3e57402b-9155-47f1-ac71-f666d2241195", "comment": "Malware payload (AgentTesla)", "value": "1167d956f1d5ada1e8cb63adc6e65397cd01f45797977193e1ea77d534f97d6f41f1041b5cd712c5be7c3e8bf2e9c13c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549504, "uuid": "bc3c72ce-ffe1-4e85-8c19-e1dff06ae366", "value": "T17532C0EB787F2075C66146B849A511549EE692E0AC24B24F3921F8ECCE327E74EA0F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549504, "uuid": "dae4a49f-e0c8-47ea-926f-46d143e50cbe", "value": "192:J7XqHsuQHfikgYRFdut0NK4GU/F7YF9MLQe0uYn5OAa/GLs8xa/UWuUFzqikSHk:JM6r9At0AURYCYn5OF/GLsEa95qiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549504, "uuid": "f4142266-2bbb-4a48-8ff6-7dd3e81ee729", "value": 11292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549504, "uuid": "a402cd7c-8306-46c7-b45f-bdb5515fc724", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549504, "uuid": "83e4a9bd-431b-4ea6-b722-31d14bb734ad", "value": "1.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcd76d3-3043-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582506, "uuid": "fe45f61f-a07c-4af6-9619-feb4688dc5dd", "comment": "Malware payload (Gafgyt)", "value": "a0e74b92c1a4ca9165da41c5c199dba1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582506, "uuid": "f278c3e3-6552-4128-94d4-a4f74a59a551", "comment": "Malware payload (Gafgyt)", "value": "235f913964ad6e2cea297c6ce440320ca1f4a9e6840c509cc05f0676aca83067", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582506, "uuid": "78df7a81-a00a-4724-bf21-9a9852ac903b", "comment": "Malware payload (Gafgyt)", "value": "e32f827afcb3b28d2ca353d703be59cdb8064067", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582506, "uuid": "9de192c2-d2c9-4d43-9fda-c63e0563c55e", "comment": "Malware payload (Gafgyt)", "value": "ff56e62d6caef378378fb5358f67282d910d79a0b88cdb1245226b8f9a60daeb25420cca552adabf9758d5d3b9ffba15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582506, "uuid": "b83484e3-064a-44d1-a79e-1414031e6d61", "value": "T11FC3A72A7E12ABFFE168863107F35F70979521E227919386F26CDB181E7128D1C5FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582506, "uuid": "c31a1a5c-f875-4462-ae09-574007216b1f", "value": "1536:w7jx1TFaq+rgIyZ2rKqxS/IzB5NWelyL225h5dddddByChdwmeFfkq+QCyRnVgj:MbefzB5Nyy25hRyCHwmeRkq+QXnVgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582506, "uuid": "397fc66a-e727-4ccb-978e-fa37dbf1e2e8", "value": 126905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582506, "uuid": "c469fac6-f1e5-4a0d-9f55-b2bdc8564058", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582506, "uuid": "c007c827-7794-4bf7-ab40-97a2d7c63f2e", "value": "a0e74b92c1a4ca9165da41c5c199dba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ded902-2fe7-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634543198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543198, "uuid": "5817aab6-5da7-4e64-a4bb-8330a93f553b", "comment": "Malware payload (Gafgyt)", "value": "ab776e87be8302e8b6f31b0dd3cddc1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543198, "uuid": "53bdd294-2a52-496e-be93-75d76863edf2", "comment": "Malware payload (Gafgyt)", "value": "237462c7ab4238b9d86cc9c83d6a9fa35ae185ce6d4e2eee6a2647fcb670f85d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543198, "uuid": "928aa2d7-2dac-4599-ba7c-2d33aba39152", "comment": "Malware payload (Gafgyt)", "value": "0ddbb0d13bc75154f2a03fc67b769b95ce498972", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543198, "uuid": "c33bc5de-402c-4a7f-a058-d426496ad4c7", "comment": "Malware payload (Gafgyt)", "value": "014d34cc9bfde6b2b1693c35eb1777cbb744b5c8c8e260d412b9edadfe35a1027ae5dcdb74a6b88da3c6a7853c361d1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543198, "uuid": "64c669cc-4377-4e32-9bd1-ab0592ee8b2d", "value": "T1DC630215275756B68D65963086EA9382A48B36FC33CEB6528338091363C1F8F7FB8741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543198, "uuid": "d2e031c3-ba5d-44c5-bdbc-6d37ab63ff3b", "value": "1536:vfcZgjouD8IIpS9vikOLhRUvudFaPATd6ydtbQ7+JILk1vgTrO+cx/:vfcZgjX8IKs6kOLgWd0s5dtE7zLk1vQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543198, "uuid": "72630c29-5629-48fd-9d0a-37b2b12b7847", "value": 70904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543198, "uuid": "89254225-cd0e-4e9b-b91a-1bf5868f86be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543198, "uuid": "b1949a4e-91ed-4640-9394-79fd3bdca816", "value": "ab776e87be8302e8b6f31b0dd3cddc1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95132a01-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561261, "uuid": "b6cae540-4037-4016-aff4-b3f5344c6321", "comment": "Malware payload", "value": "61571d317c161ee1e880ff09e1be2980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561261, "uuid": "9525fe8a-5d4c-4634-b404-06bec09a355d", "comment": "Malware payload", "value": "263fbefb8fa3dbbe575f25b52afb34004e897e1f023f364cbc49dcf88e470526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561261, "uuid": "4ded6fdf-5437-442b-8df0-18166d8bd16b", "comment": "Malware payload", "value": "cdaf2dbf33132231d0f344daada005397eef365e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561261, "uuid": "06ae5b45-753c-48eb-b48a-362368414270", "comment": "Malware payload", "value": "e8557020e00ea9c857b4cda9e45a190997d865bda1923795875353ade2ab3afac4bee1ef8f3946fb02f754cbce2a49d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561261, "uuid": "37f23ad3-911d-47cd-9d3d-dd4d151777ea", "value": "T10784F205762A4F21C8A957F5403C625307722D2B8565E28B2ED5BCCB3D7AF43826DF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561261, "uuid": "12818b1b-8e1e-48e5-8610-db03d1a58690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561261, "uuid": "86c0f03b-9a11-4c16-8c08-1d9f93893788", "value": "6144:L81lWjG5sG/7wBLbdKaa3eYQ734YWlXXwa4YB65vReh8j82vDY:LslmG5s68VZaVqa4Q61RRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561261, "uuid": "2de2a78b-2fdb-4bb3-a6e4-f7232f88ac60", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561261, "uuid": "76882dc4-3939-4bb6-b5a5-c7c7a46a2374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561261, "uuid": "14d25f1b-9926-4116-923c-3e03c8cf555d", "value": "New Order Inquiry 072820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ad5d2b-2fc6-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528917, "uuid": "8e31ea78-880c-4a18-b118-4ba3eaa4f621", "comment": "Malware payload (Gafgyt)", "value": "1def708cfd8fef1ecdd9eef6683e06b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528917, "uuid": "e57d2ab6-941b-4e9d-828c-7eff5767aeda", "comment": "Malware payload (Gafgyt)", "value": "26ef80de8853e55d594e2193af07ccb0856663f7dc77abf0a20063cf9c6493fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528917, "uuid": "21362233-13ca-425e-8881-86668d4dda7c", "comment": "Malware payload (Gafgyt)", "value": "54d42906918cd37113b2824460a1bc9ecc1428c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528917, "uuid": "3cc64f20-f7ed-4d5c-a569-2ad86ef4b168", "comment": "Malware payload (Gafgyt)", "value": "5e6fd5537808a8cde2243273febf62d86b720b219df28e38b2fc6cb62c4cc9072791f18a012a9422030098af1d7ea16a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528917, "uuid": "747a7316-3d50-4668-8819-0440c00debee", "value": "T15FD31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528917, "uuid": "b352b5a2-cc23-4804-a478-4b929f0213a0", "value": "3072:Sdf+fvEqa9FazYA7IboRhxe391CErktmCQA9FX9aH:ifWEqa9FaNhxe3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528917, "uuid": "509ab51c-0dcb-4a6c-94d5-96ca0da465ef", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528917, "uuid": "f33e2981-68cb-48d5-b646-761f4a1947e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528917, "uuid": "1bd81fc5-84d6-48ff-a9ed-b357161ff1bd", "value": "1def708cfd8fef1ecdd9eef6683e06b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3a9fb8-3005-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634555903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555903, "uuid": "e1fbd8bd-321e-403b-9570-6bff1f867582", "comment": "Malware payload (RedLineStealer)", "value": "553ad4b599f7c452b22f00f59413ca44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555903, "uuid": "1df3cebd-8ac6-4158-b9a3-ee74bfbc2453", "comment": "Malware payload (RedLineStealer)", "value": "27030fccb25c0b89709819c0669ef0855b23195774833d63eac81d9ea22d8e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555903, "uuid": "620d9ebb-a61a-4b59-9a94-52600953d6b6", "comment": "Malware payload (RedLineStealer)", "value": "0df2cc72ad31f11f1918d8e41b6d9dd54d4b66ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555903, "uuid": "926cf7cf-0b2d-41f0-9b0d-b7af33f8b040", "comment": "Malware payload (RedLineStealer)", "value": "7aa0540d8e0c0fa6394df9fdeb92cb76814cd00bf552fd32cfdbcce43cf97c8322a92d254d62d99925c7f0d0522652c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555903, "uuid": "6979c8c2-0c5b-4be9-9ffa-8b9db86accce", "value": "T11B949E10A650C035F5F252F58DBA9368A52E7EA02B2450CF53D92AEE57F76E0EC30B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555903, "uuid": "0f4646a4-8c5d-49d8-87df-0734ff99af90", "value": "bd3694527adf0e2f58ae8cb4e18ad5ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555903, "uuid": "d1b354ef-1909-4809-a07c-5a0f16e8210b", "value": "12288:ilPYy+iH/C/Ou/yTNWE/7NlYAdV2capaLCSqL:iO6CO4yTNWYNYcapa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555903, "uuid": "e19730d6-6f91-44b7-bfa2-5106a606ee80", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555903, "uuid": "3de917aa-fc51-40cd-92cd-3d8396180697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555903, "uuid": "7dc7a135-82b8-4c62-a051-dc89fa9c964d", "value": "553ad4b599f7c452b22f00f59413ca44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107ba4a6-3002-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634554596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554596, "uuid": "095902b8-0c8e-4dc6-950d-d14765d375b9", "comment": "Malware payload (AgentTesla)", "value": "5e8eec1bdc70abb4e3be93a843eeec30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554596, "uuid": "41546063-a1ae-4872-98ab-38bac2ce12c9", "comment": "Malware payload (AgentTesla)", "value": "2728be4adab2d8fb44d7b076c1beace4142d2996d72b0f2af0f27d7aa9133505", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554596, "uuid": "ab83469f-643f-48bf-b98a-b1be481d8993", "comment": "Malware payload (AgentTesla)", "value": "54d7e644784ce87e47835f6d19db1da9d6425e40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554596, "uuid": "b80d0991-bec7-4858-b14b-5c255f4d1517", "comment": "Malware payload (AgentTesla)", "value": "fa47f708812b2ffce931c255b5e283850c0ebedbd16cbec56070c12e618e534654e93615f35cb8dc13b7eb57d9d55f54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554596, "uuid": "a03a9a70-27d7-4a5a-8a9d-895528fcdc25", "value": "T1D0A4124433D1EB5BCB590373A4DAA2A00378982A1F43CB6F8EE535DE2D757D80D60A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554596, "uuid": "04efb67e-3a66-4846-b643-309e17321475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554596, "uuid": "d9fb7ee6-f668-432c-bfb5-569420e6db8a", "value": "12288:WepTHjsJ1MNKeRWVmEG+j4qY1ZkrSLgy:TTDsYYeRWIJ1ZC/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634554596, "uuid": "080f8866-ba0b-4359-8d72-a31eb17a6aaf", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634554596, "uuid": "f1c0a473-49c1-4413-8b1d-f2542b8c0cd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554596, "uuid": "3b06fb7c-2c0b-4478-a0d6-50cbfeb8a024", "value": "Order_0182PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8027afc8-3059-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634592150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592150, "uuid": "42aeb070-2eae-4a15-a399-2922428a9be7", "comment": "Malware payload", "value": "f87c969abfd908cd8c9ed25bdc22b8a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592150, "uuid": "8e0d1b8c-c028-48eb-a57b-b34e004f3f5b", "comment": "Malware payload", "value": "28365dc51d6ab5062aef3bd75d28cb826e1e0a203bba46055f9bc33e7006b148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592150, "uuid": "dffdc9d9-71c5-4e03-a790-d36429a6db8e", "comment": "Malware payload", "value": "b0fd9827c762d83584e5c87a95cd2c9bcf16533f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592150, "uuid": "db757e64-0c0a-4b19-b20e-6083ade0287d", "comment": "Malware payload", "value": "db3081e5c866c76f6098b26ac92b4816330f5ec1f395c8823d922925bb05618c87645116b7732a052db99f74aa6ae763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592150, "uuid": "cd58dc9d-cc87-4a11-8c6d-4c131f6522a0", "value": "T1A74633953EF9A3A8DA798B7366ADF02F39428127D189C0C021974D535B3EE7093C395E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592150, "uuid": "ffdc9464-3a64-484c-8d4e-4da765a4a7c4", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592150, "uuid": "2675cb1c-be1e-44ea-92d9-d96542094f4c", "value": "98304:lS6C4idwGzMUX+na4QavbR/XW7MuQQeMY+UekJ7EJ0B4hKP70wpB:lS6Bi+UsasvtPW7Mu7fkJ774hKQwpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592150, "uuid": "c80f1260-3de8-430a-ba1a-e813e771e132", "value": 5611519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592150, "uuid": "c036c430-1eca-47ee-88f1-593678fafc77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592150, "uuid": "9432ae5c-8390-41a1-b9fa-491826d728a7", "value": "wasabi_miner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91cf9ad-2ff5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634549322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549322, "uuid": "734d205e-52e3-4d4a-9592-993126d137a0", "comment": "Malware payload (Formbook)", "value": "dcb47525f791f788f7b872f0172da169", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549322, "uuid": "2cdee348-6509-40d3-b808-6fca1f4388a1", "comment": "Malware payload (Formbook)", "value": "28481e2ae569e56e8fe6929a0c7c59add8850c3b49e8cf6d6873af03b16e884e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549322, "uuid": "c8aee5df-269d-49cf-9fee-219bd359369c", "comment": "Malware payload (Formbook)", "value": "8489dc409d6262ea0c883245009295fc603defb4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549322, "uuid": "c4030b84-c387-4904-8730-5f322c8f5f93", "comment": "Malware payload (Formbook)", "value": "8d3fa141b6ea8d83f3feb7054200673e8ddcf22fd43f9b416fb202dee42b3cb2c61325b0812bbe9e8799e1f18910835e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549322, "uuid": "782483a0-b7d9-4aff-b0aa-492514b45f77", "value": "T1928412053BC0CA57DB2D09B974F2B3A827B4A5366E41C3DB8E4630EE6E777416E40663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549322, "uuid": "22788602-f463-495a-bcc1-d094c5902b26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549322, "uuid": "ed41bb07-ec76-44d8-9f55-a73c95d5b0f3", "value": "6144:jQYHB9nsq1ugd0nWlpUYUc2CD+Zs23d1A1PGaUZ+x/OzMi4w:R/sqD0nzQD6Zh3dWPri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549322, "uuid": "e4d85d33-5680-4784-a29c-10fe97c6e275", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549322, "uuid": "d620a1cd-de3c-4132-a5a9-e0f53c1dc75a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549322, "uuid": "f0319bbe-b29a-4ad1-8686-e8f6193e0395", "value": "DHL AWB 00929928288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8aedbb9-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634561374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561374, "uuid": "9f9722f8-46e8-4847-be98-3f1764d2fc5a", "comment": "Malware payload (NanoCore)", "value": "4f3411e3c3b5fa0af2d78198932a7714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561374, "uuid": "f35350ee-c0ac-48ec-839d-a7307c731173", "comment": "Malware payload (NanoCore)", "value": "29bc7a7ec63bb64f38ebead4028fd2fd1cf46f9d9cc3ba85c7aca32182477abc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561374, "uuid": "00ad9165-13cf-439a-b419-fd1b9a6bbbb9", "comment": "Malware payload (NanoCore)", "value": "725c315f423b4403dc8f55b4690fb5381bbe7882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561374, "uuid": "0bc098df-af2a-4996-948c-e9cad3c90255", "comment": "Malware payload (NanoCore)", "value": "95e07ab5fc404df81abc3101a8f6997fd82443b869d28a10087865edfc29988771220a122765bbf1feb8925fa24bfe99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561374, "uuid": "61257855-22d7-4086-848e-6fffd878a388", "value": "T157351202B6C28872D4731C324A39AB156E7E79302E29CB1FB3D45D6DEE355C1A124BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561374, "uuid": "31e6b4c9-e98c-44fb-8bc6-4da5dc9fc488", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561374, "uuid": "693c0ccf-b92c-4a72-b578-dcb726ea2802", "value": "24576:rAOcZEhcPvfz53gPZfBjx1f/pU1hgova6TPY5I7nT1RMwazpM:tAifH/pUU96c5IzTXM72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561374, "uuid": "e725c6ee-aa56-479d-875d-a4f4bba11d30", "value": 1139948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561374, "uuid": "735901b7-f81f-47d5-9811-e7624f1a8d4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561374, "uuid": "85b7dab3-2f35-48b4-a09f-28531ded8f4c", "value": "4f3411e3c3b5fa0af2d78198932a7714.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d659606-3010-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634560631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560631, "uuid": "918339a8-0f93-4d66-bccf-d72b9f762967", "comment": "Malware payload", "value": "f3dae396030c684e5f5d3d1fb47dad38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560631, "uuid": "f3f2def5-36da-4390-bdbb-fc9668501636", "comment": "Malware payload", "value": "29df2cefbc041241f2c2c3782682951d252633926b3929a927648cd3b55dc64b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560631, "uuid": "2f4bba75-b8f8-4411-b9f8-643d5e665b32", "comment": "Malware payload", "value": "056a840ac2b2cd4b9b8a525c83e858d4ea5df7e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560631, "uuid": "aaa4e8aa-e755-467f-9359-ec6f93f80294", "comment": "Malware payload", "value": "856f04f9222766a845c921c6c135f25afd81964a39d807d01f58d002728c72901847ade8a75b8dbd4b8d54eae5780422", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560631, "uuid": "05e38f39-fa41-48fe-bc75-45ad47da1f9d", "value": "T16DD4E000B7A0C435F5B662F459B993ACB52B79A0AB2590CF52D137EA56387E0ED3031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560631, "uuid": "e61ed485-22de-44c3-9b66-c48581043003", "value": "6f2a068c255b00f177d7f883be0dc61e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560631, "uuid": "507d715b-5b21-4b80-9221-f8f37fb5f4e3", "value": "12288:BtMTk91PexW3mNOp/ibz1yx5zx8Wwmk3OOjd5ZvUu9un:bh3WJyvxsmchxUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560631, "uuid": "4886adaf-8cf8-4048-8a1a-d1db4969b46c", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560631, "uuid": "8d41f402-7c86-4926-a755-9e6ed100e968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560631, "uuid": "11300fb4-77e2-4b57-a82f-57ccaa1f3fc9", "value": "f3dae396030c684e5f5d3d1fb47dad38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9285e44-3054-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634590205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590205, "uuid": "add5f364-fcb7-42e8-bb0b-0d212ebd60ef", "comment": "Malware payload (Mirai)", "value": "652e6d3f9d9519e5ab12c343678b059d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590205, "uuid": "7b87c9f0-6024-45a9-a7be-b834e995f6dc", "comment": "Malware payload (Mirai)", "value": "2a0d7cd45567b7107bd6b0368ee812ebbaf4a3c01f473e38d9e81a80442e801a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590205, "uuid": "7f8f358e-e94a-4a05-bc8e-2fe33cd38a2e", "comment": "Malware payload (Mirai)", "value": "4951ae8ba198129cdba848bc388ebb12bd04fb0b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590205, "uuid": "5421ca78-74f2-4ab9-aa3e-29bfed6c474b", "comment": "Malware payload (Mirai)", "value": "fa16c4988bc3cc7325970ce67293851b93b57d106584e7573e10809e048f97a83461c17c91be236ea35a2288468bae22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590205, "uuid": "92f2aa0e-7dc4-4296-bc21-b08189a2341b", "value": "T11E334BC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590205, "uuid": "d19f09be-3037-453b-bca3-89d313182167", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNJ6OQ6xpwhNbr/2:xZebkP/Ad39UMJRlhNkL6bIbD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590205, "uuid": "74d3e4e4-e78f-49f6-afae-a687ffe39a9f", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590205, "uuid": "9cde3703-5573-480d-bd1a-21230f8f869e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590205, "uuid": "680c3b06-a6da-445d-8347-7872d14d1583", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908a0e08-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561253, "uuid": "54afb067-4e86-40dd-ae3d-020d97928d1e", "comment": "Malware payload", "value": "532d679eac1fc263120d86ab0d96d72f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561253, "uuid": "776d2f98-2dff-4ee5-a4e1-a1df673c0c3e", "comment": "Malware payload", "value": "2a32f47ac2280a2c32578f046037c66a4e22b5d3c1b85f6245770d7517022cb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561253, "uuid": "91007e11-863d-4003-8d74-e9ebddff1d4a", "comment": "Malware payload", "value": "0203419ef778fbc5e520e2f9a689ceba65f8292d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561253, "uuid": "3a12dfdf-16b7-463b-9fc2-65a0a737d763", "comment": "Malware payload", "value": "2b7dab094fe34cdbc77059314858e27bf554f856aba14d44bfa2ad10258fb501f15654683914978f2b91478fd4b6cbd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561253, "uuid": "291fa674-292d-413d-9ee8-2dcbc7236646", "value": "T191C4E052F2544B62D8B957B28038566307737D2B80A0E24E6CD87DCB2DB7782526EF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561253, "uuid": "e8c917e7-c82d-4238-b96e-8f2b49b0ce94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561253, "uuid": "6239fb3b-8729-4b33-a89c-afb824e1b627", "value": "12288:9vdG7/itTCuT4470YAjUUcN/jFf5Xi/JETIr5FbnVe:9xBoYAjDijhG2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561253, "uuid": "be0378e3-0b31-4324-8bde-73146a9099f3", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561253, "uuid": "0b53b7ea-6775-422d-8fae-0c574cf17741", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561253, "uuid": "91bc54c9-fd7d-4128-b8e1-ac51850b2f7e", "value": "Proof of payment.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddebffc-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634555692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555692, "uuid": "c6c44b4d-0f73-423b-a8ab-5f07179f2239", "comment": "Malware payload (AgentTesla)", "value": "4be25332520b26fccaf19093613142a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555692, "uuid": "66bc8ea4-171e-4d25-b3b4-b1dc07265f6c", "comment": "Malware payload (AgentTesla)", "value": "2abf2a8978d75c05076b1b55593d4c619ff6fcb92146340d72f76aa9e8bed47c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555692, "uuid": "adae6a40-fd9e-455d-adae-2bc6d0e880f3", "comment": "Malware payload (AgentTesla)", "value": "33c32233015f2621f62c060f2f343e19484bbbda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555692, "uuid": "707de3e9-1b53-4053-9fb0-a2edde302908", "comment": "Malware payload (AgentTesla)", "value": "38d634ca2d3262babc83bfffa333bc9530fa1c6575fdfa7da63866001220db2122ac01eb4c9a50910c2cec5a9bf1b636", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555692, "uuid": "19a18907-b3e4-40c0-85b6-b46bf6878c4d", "value": "T1CA9412527388C727DB29097074F2E3641B34D5B52F64DB8BAED230EF5AB7B859920603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555692, "uuid": "46d5d5bc-b4f3-4f42-b24f-d1ea472c1ba5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555692, "uuid": "53c58059-96d2-44ee-b57e-42b31f9acb6c", "value": "6144:I6B9nFw8IzrHqB7pRDT5KbepqrFNeUYEknDh2Hd/6stZiUaY:I0JFxIzrKtvMLLeFE0sHd/6mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555692, "uuid": "e2cc749f-e29f-4a19-9cf6-5ae16a745191", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555692, "uuid": "c745743e-eec7-4fd2-81b8-d64a903447fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555692, "uuid": "a1d31e99-aa90-4c8c-9d93-192967eb8f0e", "value": "4be25332520b26fccaf19093613142a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4080412-3018-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634564293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634564293, "uuid": "46aefec0-b240-43ff-9973-0a6c315eab74", "comment": "Malware payload", "value": "880f777281c6d20ac36dcf540d10df1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634564293, "uuid": "006e1b57-d186-4cce-9fdc-59223fdf952d", "comment": "Malware payload", "value": "2b21645c16dbd8d418855f10c33f8a35b840e8103de27271e66847fdd4c5d288", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634564293, "uuid": "02c87199-fc6e-4931-9297-7d3fbd9b307b", "comment": "Malware payload", "value": "d62ee7d08cbbb650828448cd94709975bd1bebba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634564293, "uuid": "d2360c68-1607-48d7-9cf0-721f42283c60", "comment": "Malware payload", "value": "ea781efd1802c80f26e01551630411e7bdae07a006cbef1e00118b96dba4ec82c93abea8647356855f7d4b7bfeb078d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634564293, "uuid": "d782b1e7-8ac7-4f20-a4bd-8f286d09c463", "value": "T175A4E00572698F32D8F953F944789693037279178060E28B2ED1BCCBFA79F43466AB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634564293, "uuid": "b773a797-1059-459a-bdef-75dd8e2732dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634564293, "uuid": "7c798208-b648-4211-ab0b-f335df1e737a", "value": "12288:tV8GktODKcru4dGnvnlS6+QL0rkVzZcc:tatODKcruqGdx+rAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634564293, "uuid": "d870caa1-b25d-400b-b357-0f48c176b12a", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634564293, "uuid": "2081c6b5-df23-4ace-858f-17c16823afaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634564293, "uuid": "99f5fdc2-3bf6-4193-a7a3-ad2c3f0d9919", "value": "880f777281c6d20ac36dcf540d10df1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a658d37-3005-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634556062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556062, "uuid": "3525e31c-dc55-493f-9c76-f74b7bb6c700", "comment": "Malware payload", "value": "737937a04d374de68c63c55c1e5dea47", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556062, "uuid": "0e0d5c06-bdac-444b-be07-629818c64e7b", "comment": "Malware payload", "value": "2b742310bf42266987002c58eab9ef10b380ce9662fe4e9e7dcae39f3cc376c5", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556062, "uuid": "7ac1a5ef-9027-4bdf-b534-09eae6333158", "comment": "Malware payload", "value": "d164f6c7acb3bb6ee840d02b673b4bfd7f471a23", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556062, "uuid": "e9e61c79-348f-465d-97d6-609806bdefb7", "comment": "Malware payload", "value": "d216d01df927e864a607f5800aa2414648d619f6956a5eaa84d94c940a2efbb9a3429e4f4b2d5eb7ed88f88e3bec9115", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556062, "uuid": "ba250567-c062-4462-81dc-04ffad0eb1b6", "value": "T18974D0CFFC53E799F272B1B1D259B52349A27EA21F6374D2A9C071004EB138550DAE8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556062, "uuid": "247ed9c2-34de-4c71-9296-8b904397858d", "value": "6144:nACEp3g6Og0/IUCsux3mzC1OWqCXmZ6fZzqByQWOFeg7eGNdGGb7:nACGw6XkIUm3mzwS4zqkQW2eGNdG+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556062, "uuid": "a5f9348a-8b0e-4e28-ade3-7e32ac169b8e", "value": 340840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556062, "uuid": "89e86b2a-51de-4ddf-ba99-29b025e5791e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556062, "uuid": "37c450f9-d473-4912-9f4c-19561624a3f9", "value": "Shipping Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e906b47a-2fef-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634546799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546799, "uuid": "1ef6dc66-e377-46ef-84df-d43aaa9168cf", "comment": "Malware payload (Formbook)", "value": "d5f480d1d4cf7902094668a09856c79a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546799, "uuid": "516437c4-077d-48ee-9574-f1a48ee99c0c", "comment": "Malware payload (Formbook)", "value": "2bba05f9769bd1ae9620ad64421955575bfbdb145e551bedcf55cad61a0819e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546799, "uuid": "1aa1c220-87bf-4c38-b569-4dc1e750e89d", "comment": "Malware payload (Formbook)", "value": "d2b34a5580ade8bf67f18a655089bdd5041806e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546799, "uuid": "d76c6717-1c9d-4bf7-8947-cf2dd66cb8d5", "comment": "Malware payload (Formbook)", "value": "71462f05a444aad6644c9eabafd78aad51d0d76a3070f7e687bf92d032a775f7a2acb1c83438d9f8851d0708e25efda3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546799, "uuid": "9b576e5f-f0b4-441d-94fa-c07ef35e4316", "value": "T12D44122A66D4D8F7C4DB253019731261C3F63C2063107A8B2BE99D7B77B1AE79C1264E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546799, "uuid": "febcc3cb-1e02-47f4-a719-3edb80b29bc8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546799, "uuid": "6898f1c5-859c-44f3-96eb-28da41cf6d1c", "value": "6144:wBlL/cHjOU/I7FKWrwIj06jElBuJRHr7jAF0Z5oBb+Mf9O:CeDOU/IpU6jYBuDXOtzf9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546799, "uuid": "71418bac-ac8f-4ccb-8db7-5de88dff8321", "value": 260937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546799, "uuid": "94140637-21f2-4d43-9e0e-b54271215fe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546799, "uuid": "60dd2036-ee1a-4d2b-81d1-40ac5ec7aa91", "value": "d5f480d1d4cf7902094668a09856c79a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6b9a46-301a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634565006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565006, "uuid": "bfdb822a-b4cb-4314-b31e-e96a63d5afd7", "comment": "Malware payload (Mirai)", "value": "add9ff9a5daba7a947d4a01ec4215d6e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565006, "uuid": "066d331f-ef64-4086-b98f-1c5e80087279", "comment": "Malware payload (Mirai)", "value": "2bba8ceafe518ead47cf06841b048dbc869df32930c35471a45d660bf8b586f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565006, "uuid": "de3d9df2-a525-4d79-9564-40add16ececa", "comment": "Malware payload (Mirai)", "value": "a4f85309a863a4b322b29e93670911ea98866232", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565006, "uuid": "42f4de77-624f-4c7c-97d8-ffe0e8db7572", "comment": "Malware payload (Mirai)", "value": "80d03494afded018027a3daf6750ece214cc7e7a1f0452c37abd82dde74cc31d9a6febc72f09638e8a922eda4d6c0f79", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565006, "uuid": "8fd4264b-33db-4d9e-8013-3fbdf6562807", "value": "T128335CC0A643EDF9EC1546712177EF324B77F43A212AF9D7D7959933E802902A22329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565006, "uuid": "25b20f39-3be1-4a02-885e-fdd7cb587ad4", "value": "1536:TtmBRegAleNNfDctqTR8m+Ug6FIOBOFGTiFa:weg8WNfDctqTR8dU3lBAoGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565006, "uuid": "95fc2346-c70f-4687-af0a-595ed9c7d086", "value": 52016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565006, "uuid": "61416dca-53e3-4be1-a96e-8d537681c767", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565006, "uuid": "36d01298-7f1e-4d73-b86e-48a6677e099d", "value": "x86.light", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac9d254-304c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634586772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586772, "uuid": "06cd1652-487e-4f8d-adca-5f321613b933", "comment": "Malware payload", "value": "ec9da92db55378cd85aa77fbcbaae3dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586772, "uuid": "91033ce5-c626-4e1f-8f53-f2ba8317dfcc", "comment": "Malware payload", "value": "2bbf6e108871ab4d3f8f7a1b21ed2a9d120e50550b0f20f761f1a8f40f3d3784", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586772, "uuid": "7edfd6ce-c945-437b-a577-fe6d8b808bef", "comment": "Malware payload", "value": "91de034b1139a9077aec0f595e91a11e42490ee1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586772, "uuid": "375d3d6a-494a-402a-b677-6c4ea73b7a1b", "comment": "Malware payload", "value": "64ff527fc3e9686ae73d5b45cacf89f34c75d3d2c7c5eb79c15dae2b65c2c0928af16c48f8f8c35ae93f7abd9e2a3cd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586772, "uuid": "1a4a0390-8476-4271-a2cf-34cbca66bb86", "value": "T1A1B34B15E7408B53C0D22B79FADB43553323DB54A7AB63065928BFF43F827AE4E22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586772, "uuid": "8d2e9ead-46fe-4038-8d05-c1eb2a007d91", "value": "3072:OvF2aUaji6Yyq13eq7D7LM/9OYp7mbw3f2Js:OvkaUa+6uuq7DHM/9Ow7mbw3OJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586772, "uuid": "13c3f722-3e92-4115-afaf-157df8e5257a", "value": 117674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586772, "uuid": "6f7f9bd8-0139-4853-98ad-c9f6aef06c87", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586772, "uuid": "554ffdca-4db9-47fb-bc44-2fcd4802175a", "value": "ec9da92db55378cd85aa77fbcbaae3dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17a94dd-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634542062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542062, "uuid": "daefcacb-e7e7-4cc0-9670-2700eee121c1", "comment": "Malware payload", "value": "bb78fb50dc924898bb29ec67922406f8", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542062, "uuid": "b66af7ed-77a7-4d2d-8183-2bb1967ef030", "comment": "Malware payload", "value": "2bd4dc56acc4efe34b0fd0889982b1ff5e292ae8e57259c7660983b1054080aa", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542062, "uuid": "ff94ceb1-4d82-48b2-bc93-c80b295ff193", "comment": "Malware payload", "value": "909a163a00f97a1004427e8907d5a042d1caad51", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542062, "uuid": "3a297701-73a0-43a0-a578-717f182c6c18", "comment": "Malware payload", "value": "9f49b94045e28f9b929be540b61efb4bd95a290222ef1854c49298f6e5a9bad92238da1a377268a63de87df3eaed671c", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542062, "uuid": "7351898d-0430-405c-8d2e-85377d7b2224", "value": "T16174BFD4BAD0CB6DFC97393425EC65CF68989E8E8B440D105875B753827623860BFECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542062, "uuid": "c62143fb-e85f-4342-89dc-4666d319bf2a", "value": "6144:he9ifHgU6lL1QhEeM0dEd0/5fYOzyk1RGp/rTRFivdZ5h9+8pnO5BtJqbXudPm8q:h7fAU2QS0dEC5hT1UBn4dZ5h9vhGBOjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542062, "uuid": "a82287c7-8392-4778-8793-8405c948eb2b", "value": 340760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542062, "uuid": "7006fce6-5791-4bb3-a4e4-8b12b5e5b571", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542062, "uuid": "74412191-5d42-4d0f-a3a3-b8c287871891", "value": "IT-20210510-0101-1117002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4814b5ef-2fea-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634544381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544381, "uuid": "91ff0815-1ade-44c4-a5c2-04ca21f31872", "comment": "Malware payload (Mirai)", "value": "92e9bafd2ed5f15c15a0459205d4ee21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544381, "uuid": "4565bf02-7710-4f56-a915-716ceb83f4f4", "comment": "Malware payload (Mirai)", "value": "2c134dd8c8c1c41f665e7292c5adcaba48fa71508b02aa097b18161d2279a274", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544381, "uuid": "297ae83f-4e02-4d40-ae3e-aaee40695544", "comment": "Malware payload (Mirai)", "value": "644f6f8e9168a30bb4dacf1493c480cf04a9dcd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544381, "uuid": "5179e9a2-9d9f-4ac1-b585-8d5a2de6e465", "comment": "Malware payload (Mirai)", "value": "70051559bd4ab4a0a798bf31ec0b86d67acd0f6970f2269822a358f8ee010fe2e73dda226aaba2c8a7c347b0b8b17e59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544381, "uuid": "80bc3f8f-6c5c-4bce-b8fa-6d6ab248cfdb", "value": "T1B4C2C03363485F72C5E09D3CFE75C50A25230ABDA1DF369567031AF8AB2038A697D58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544381, "uuid": "c14704b5-b233-449d-9568-e43de39c20e6", "value": "768:NYOx62Q1skemslg6gIijBpsBBV65OJ8gds3UozO:NYv2LkePlndfV64J8ggzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634544381, "uuid": "fa9e9a06-9ee1-4350-92f1-e7b7d873eda2", "value": 27124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634544381, "uuid": "8a0b8157-4302-4b66-8a69-ce804f1543d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544381, "uuid": "476dbe41-0c59-4913-9af2-ad895b1b8cb0", "value": "92e9bafd2ed5f15c15a0459205d4ee21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbf9d46-3023-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568762, "uuid": "93d1f966-7a7d-4676-b862-092cc631c6ea", "comment": "Malware payload (Mirai)", "value": "5e7c3312f07c749f867c0336c462e57f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568762, "uuid": "5d0fb72f-db19-477d-aa56-584f52a62a3f", "comment": "Malware payload (Mirai)", "value": "2cf64588816add421e3fd3f179ed15933bfc5dd5209cfdb21d8304be8a484074", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568762, "uuid": "7b2fddba-b7d7-474f-b69e-717af9e083a4", "comment": "Malware payload (Mirai)", "value": "a7f4c9be08b05e93199e6d0833d0511e6f668cec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568762, "uuid": "d7cd067a-e1c6-44c6-a14b-62c52297c344", "comment": "Malware payload (Mirai)", "value": "e71e28f80e07fbcafe798179df2a36fe136824ab7155433b343c5a15ca8de678c778bd0cee3090d44c32f92b430a7ec2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568762, "uuid": "590f6cd2-3c8f-4916-b420-2e462e85752e", "value": "T1F413E05DE1D878A5C71D1CFF0A8C0360D951B1D233AB8F4D9BA29C5ED87AD1EBE48061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568762, "uuid": "74b72d48-43ae-494f-966a-c7c2de1d49ed", "value": "768:Bka6Mg5IlhKC8Jyp2DvIEZZ2UGdw1bT7rJIL+jKeMrqOE05dJ1CKse0jhyA8WU:+a85IiC8RE6ZPogbTh4HHE0tQThyA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568762, "uuid": "f0837215-ab19-4022-8154-73c75f57f49d", "value": 44756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568762, "uuid": "79f148dd-6ef2-4315-8d59-bb6eae943bf0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568762, "uuid": "6d0b8322-d11c-4c0a-918e-f23cacb1c838", "value": "5e7c3312f07c749f867c0336c462e57f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8fb90e-3029-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634571583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571583, "uuid": "8168da00-a122-44ec-86a2-0f5c0047e587", "comment": "Malware payload (SilentBuilder)", "value": "23df831bee347c463f938e77c1eff12b", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571583, "uuid": "1c587a95-928c-465a-be49-aa2a8ca0edfc", "comment": "Malware payload (SilentBuilder)", "value": "2d380376f2e26a5552f44fb762bfc7a661815175b05d05b2269ab4bd944741c8", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571583, "uuid": "83855952-1e3b-4323-9ae8-c19aecd7aca6", "comment": "Malware payload (SilentBuilder)", "value": "eb439a2c27b3dff36627c10ed29de3be36bea595", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571583, "uuid": "b56ce8db-c676-40f4-b2c2-6703ba80122f", "comment": "Malware payload (SilentBuilder)", "value": "bfba1940148c5923e2a94d4d4207c8cb9f015774b788b9b499094143dd3ccf5ead6a63b7193027fc61f0ba1c165d2657", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571583, "uuid": "438ad002-d979-4c21-bc87-865d86c521e5", "value": "T17844E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571583, "uuid": "575240d9-8976-4ffe-83a9-41c42d1b7e86", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7i:U9jFrjmkD7IvLDK3vLvfn1+2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571583, "uuid": "4f4a3515-1d6e-4b10-a532-24e50cf3506a", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571583, "uuid": "5e40b3be-816e-45eb-bca8-c9af46cdb0cc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571583, "uuid": "3e22f9da-e0c5-4f37-adb8-446054b929b8", "value": "23df831bee347c463f938e77c1eff12b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f4c81c-3005-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634555869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555869, "uuid": "02266c96-fad1-41b3-8131-3b71ba5384c7", "comment": "Malware payload (SnakeKeylogger)", "value": "c35701db9ac9d8b75bb57b2758363804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555869, "uuid": "66daa2d3-d8a5-47fa-be3a-4dd1e6c04424", "comment": "Malware payload (SnakeKeylogger)", "value": "2d5fd822f5e87ccaac8fc9a90050383aed0e32abc3d54378357116771291af05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555869, "uuid": "2207225f-436e-4093-87bf-ae17b743e1d7", "comment": "Malware payload (SnakeKeylogger)", "value": "fdf6f6997c0dd7228a904d70a2cbe97151c3405b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555869, "uuid": "2fe697a9-9a8d-4587-8759-2e4bd211bdcd", "comment": "Malware payload (SnakeKeylogger)", "value": "139fdc0c075fba9a959758d83dd8891599252ca9f63d7d672420dbbedf5453055529b7a19ff7dd00f91ed916611de87b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555869, "uuid": "1e042c66-8cb3-498b-92fc-8fb3f733e96c", "value": "T13AD4B59C7F05AB7AEE1ED0308892C6B47B130F57A244A85A13DB3EC7B76F1511C79A84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555869, "uuid": "36d2ec15-993a-473b-b4ac-f2722462f77d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555869, "uuid": "d03a8178-f826-4f29-9dc8-12ff38ad9987", "value": "12288:av/AYnEyHWiaHzNwsQg/8wvUwLywNaSctMX:kYpmQ8whiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555869, "uuid": "1f6e68b7-6006-4fa4-8c76-f1a5cd2ac15b", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555869, "uuid": "11789c86-c8dc-4dd6-85ae-b2bca3c1e63b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555869, "uuid": "1e4324f1-9dcc-4516-9bb6-0341d995fae3", "value": "New_Requests_35003502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ceea58-2fe8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634543492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543492, "uuid": "e9f40cf4-bdc7-4b3c-bb05-341d3581fc67", "comment": "Malware payload (Mirai)", "value": "b49069effd1477537715ff1c7a646227", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543492, "uuid": "ecced7e6-0a20-445c-825e-7129b36f9c59", "comment": "Malware payload (Mirai)", "value": "2d749a23831d60ccbc97e838274723502f54f41e71504f1bb182f4420e9327f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543492, "uuid": "a3e96f3e-e96a-4a84-a4f7-ac1b6b493e9d", "comment": "Malware payload (Mirai)", "value": "74af5288f502da5ea1c60fa15a68aab9d8304600", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543492, "uuid": "a7f75b86-44b4-4b8d-8657-90f5fd052cbe", "comment": "Malware payload (Mirai)", "value": "e3fc724b79aa02e23eadee4e6b1cf140fa7f8e30f9ada1e156726a835de44958a9586b5a310900bb63e46ed70fd7191e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543492, "uuid": "6efad141-b3ad-478c-abec-4fa0c036dd86", "value": "T1C393AD23C9202D24C1054AB171F5EA369363951691CB3EFAE585CB6DB843DDEF226BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543492, "uuid": "c97e6fec-b0da-4b48-8e4e-79f1acfdf86d", "value": "1536:4PF+gLbgXwFCcKaSgedRyTd4+2XCAOi3DPYyCfIZJKAsagZYJYa+5hrj:KfbSlcd/syTd4SAnDPYy6AsuYL5hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543492, "uuid": "11e93d88-08e0-46b9-b941-269ef17aec0d", "value": 91508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543492, "uuid": "ca2aa73e-7bae-4921-96ec-4e372765ffc0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543492, "uuid": "c930ef00-a738-41e3-b4dc-eaff79b2b10f", "value": "b49069effd1477537715ff1c7a646227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e0568a-302b-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634572183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572183, "uuid": "9a40b081-d392-4594-93ea-e96e4c82e640", "comment": "Malware payload (SilentBuilder)", "value": "c3dba0ac237a5b602e9a42a4d41d190c", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572183, "uuid": "c7504d8e-5ab0-4bef-b2e3-43505e251aea", "comment": "Malware payload (SilentBuilder)", "value": "2dcb1115e9492bcf01c13f3210c3d1d6b7b3e550d613b090f10d1ea7b51fefd4", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572183, "uuid": "cdf1b0be-508a-450e-b35a-3e3053a88d39", "comment": "Malware payload (SilentBuilder)", "value": "633ccc0a8d8043595385da486f769c0e62fa21f2", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572183, "uuid": "7d2c12ee-df9f-4d93-b6d3-fdc973ae0d82", "comment": "Malware payload (SilentBuilder)", "value": "e0e3072f542317f88cbc10c2d1b194d5096bc6a76b730ef984306afe666eb6d888c3f00bff2c088b4f32af9a138a5ab5", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572183, "uuid": "c8e143e6-92a1-4459-bf3e-aaacf00fe879", "value": "T15544E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572183, "uuid": "bb320af7-bde8-46dd-9028-dbcde49b00f6", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7o:U9jFrjmkD7IvLDK3vLvfn1+2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634572183, "uuid": "d0b6a8e7-f691-411b-b8e6-ecbe8742ece4", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634572183, "uuid": "5c35d6ee-2a7c-4b44-8d0a-4cac31e1f59e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572183, "uuid": "d516bc76-5dcc-4d5c-802b-47acfb44367c", "value": "c3dba0ac237a5b602e9a42a4d41d190c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3593476-2faa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634517047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517047, "uuid": "97a1e2ff-e8a8-4e5d-99b3-2cf61725cf0d", "comment": "Malware payload (Mirai)", "value": "c1d384afc7aa5c639e1358d4294ae5e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517047, "uuid": "c322dcdd-8f18-43fc-8bb4-fe0866cdd9fb", "comment": "Malware payload (Mirai)", "value": "2e4962bde4e44890b7fb82dd74bee0a7f133564184af74594e5ae5b860523882", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517047, "uuid": "f829ee1c-0ba8-4399-b643-856b12b1e512", "comment": "Malware payload (Mirai)", "value": "fcbff8432cbc6b48eda6d6fb6c409596d09cfb25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517047, "uuid": "ca76d427-7012-4260-b0ab-b518e0b28db5", "comment": "Malware payload (Mirai)", "value": "4da687430b2e4d45545136c55fb699af6e1f7ac23da66272aedb690cfeaf62e5fdbec41c0533b3a661f80f9d46ddc61b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517047, "uuid": "05190f9f-696c-4888-a700-408d2119034a", "value": "T117334BC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517047, "uuid": "823d5c45-30ab-4264-a7ee-c4639012d8e7", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNa6OQ6xpwhNbr/+:xZebkP/Ad39UMJRlhNbL6bIbD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634517047, "uuid": "7e60d8fd-fc25-4491-9e75-37517006a9b7", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634517047, "uuid": "271a6004-0ffe-4b07-a236-b283dbc24e4b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517047, "uuid": "7d4e1883-86ea-48fb-a233-897e6cacbfc4", "value": "c1d384afc7aa5c639e1358d4294ae5e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426e6ce3-2fd4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634534923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534923, "uuid": "3e3bfe19-9eb0-4904-9333-a43ae8c6c668", "comment": "Malware payload", "value": "22fbdbddd05ab5346e7a7f5adb79cc2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534923, "uuid": "34b32b2c-298d-44fb-a70d-8e057d70b511", "comment": "Malware payload", "value": "2ea6afd8cd172d7a43de0e037d7250b9036de4b87e1f0c10ba04c286c8c58704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534923, "uuid": "815602e6-cd2f-4449-bf90-e444d9e16542", "comment": "Malware payload", "value": "d42ad7f2723f699cc7de6fa079fb5373d81802d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534923, "uuid": "5b7c74b5-5c79-4e0f-9b8d-fc7c2c626e0f", "comment": "Malware payload", "value": "22cd6032dcaec6c1cf377a3602688d1fc7b3657124313fd3b7a8c2e96c890a645293fdc68aba72faa071ef69617f0a97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534923, "uuid": "453587b8-31ce-4b43-8a89-07d5f5165769", "value": "T13046D030768BC52BD5A604B15A3CDB9F5168BFB60F6190D7A3E42E6E05B48C31732E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534923, "uuid": "cc1acdfa-d5b7-4585-9798-2e6e252d235e", "value": "0ab020de3096b6aafb4fadfac4d16825", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534923, "uuid": "6483629e-94a2-4875-85a9-67f525ede43e", "value": "98304:AH7CgqLPRPYv7cZuwYx72XPo0+X+6zVfdUgqr2/xCQM70GpdQwssWhLcm0kch/0:A+gqLKB2p5c1UP2zM701wsxLN9ch/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534923, "uuid": "6e193cba-bd46-4e60-a1c0-161981ca0257", "value": 5757840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534923, "uuid": "c29b99b8-cb6f-4800-88b0-2986b4687d50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534923, "uuid": "c665532c-836b-4234-9011-04f6301be7ac", "value": "22fbdbddd05ab5346e7a7f5adb79cc2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf99707-2fc2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634527101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634527101, "uuid": "393ccc21-8782-4f90-905e-a832031fbb70", "comment": "Malware payload (AgentTesla)", "value": "d48b9b70d7ab84df6a0126d852a69ef2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634527101, "uuid": "480d9175-d2cc-4aaa-93c3-e4d454c2742b", "comment": "Malware payload (AgentTesla)", "value": "304c9cfbe49035af82f072ce9bb95db5c95070b4368080113b2e4d4a21096e8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634527101, "uuid": "5db04e2e-75cb-4d0e-b1a5-fa9ac4b45eda", "comment": "Malware payload (AgentTesla)", "value": "87e1bc29d19cfc8b343f769a04c777ad844054fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634527101, "uuid": "bb4b4c67-b22a-4e9a-8ab3-3164f6a7cd7f", "comment": "Malware payload (AgentTesla)", "value": "1873d0800f3a0b96744364a9746b549d5982d450cfe30a82dabdabaf4bfda3654fcaa53bbc7fb4d5cb13bd7348ef6a5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634527101, "uuid": "504408b7-065d-4358-a8eb-b4f25c557784", "value": "T1549412053784C257DB6D05B8A0D1F3A13BF49A322E22DB8B4E8538DB4FBB7054E516A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634527101, "uuid": "3a243992-4a5d-4446-bd0a-f1cb2cf70f4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634527101, "uuid": "8dd7a7fc-0c20-44b7-8387-4973c49414a2", "value": "6144:h5TLNJV+oJbP2SLlyq0FQkh2ruU5Ag6Co3AXvXcj9Tpo2kY:LbBrepQ+2SUigLfX52B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634527101, "uuid": "487da8bc-009c-457c-800f-710479801e4f", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634527101, "uuid": "fcbe38fb-08c5-4f9f-9f15-e52c240208d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634527101, "uuid": "d3c6e519-a7fb-416e-900c-ab42b6296a87", "value": "SWIFT MT760_PDF 18-10-21_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20056a2f-3062-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634595854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595854, "uuid": "e99cc4f1-bf5d-463d-a989-fae8c372e4bd", "comment": "Malware payload (SilentBuilder)", "value": "57650de94df9b79079d8d8b2dd694355", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595854, "uuid": "e7a45563-c7e5-4b9b-8882-68ae98b92d8d", "comment": "Malware payload (SilentBuilder)", "value": "30593c6ae987b113da4af95a3f8d21976d3cee1fb8a22082215f0e1dd9d54b3c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595854, "uuid": "78511c1f-60f7-4478-ba6e-1768b41af9d7", "comment": "Malware payload (SilentBuilder)", "value": "ba37b9c721a0e372e2f5253cab8bfed187c4e5f9", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595854, "uuid": "5dc6204a-b6d0-4d07-9a4c-e5b2dac3ee7e", "comment": "Malware payload (SilentBuilder)", "value": "84e3c4515a350ad591cec91ca582e7b4ed58c2bc202560b5629bba899ac69c0673a8e6c15472d9b67f736ca39ac9e97e", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595854, "uuid": "9947a938-5903-4a58-8180-e31e9b761e49", "value": "T13044E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595854, "uuid": "42fe248a-242a-45c9-b5c0-533a080c10a2", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7i:U9jFrjmkD7IvLDK3vLvfn1+2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595854, "uuid": "6e395d19-4a90-4f39-a841-f1ac4c06648a", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595854, "uuid": "4a22a3ab-25fe-47e3-a49e-735933e65812", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595854, "uuid": "9fc655fb-b6e9-45c8-97cc-8a5013fd2c8c", "value": "57650de94df9b79079d8d8b2dd694355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04dbb516-301c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634565744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565744, "uuid": "2796ab11-37e2-4f1f-8958-050705e31cb1", "comment": "Malware payload", "value": "b7078ac2fca819769a2d21d8e3a3ea15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565744, "uuid": "79bb5e43-079d-41fa-9f7b-b52bd698bd07", "comment": "Malware payload", "value": "30acecd4b5f42d244b427d4fa49b8aab1b3d1f68cf3e7cea72d8365bbd059869", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565744, "uuid": "02a959f8-7702-4106-a685-49b7ee2d1b07", "comment": "Malware payload", "value": "7d8a22dcd8d562fd3ed2bd4759ef13fe14d0bcb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565744, "uuid": "4ffec50d-6e92-4e46-aa0a-0f0ccf157afe", "comment": "Malware payload", "value": "dcf4066c56f7a1d8f288100bde4feb5445e7187563414e888a4a4ee1a2de55bffd13fab37a8edf117b478045f67c4ad1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565744, "uuid": "07e2271f-390d-476c-bdf9-53bd34f5102f", "value": "T18204A443254C47E1C8A9D1BAB8B0C193FA9C66A600D9D0379B507D3F0BDCE489A67D9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565744, "uuid": "4635bd8b-f977-467b-a6d1-96ba42ed408e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565744, "uuid": "5938a2b5-f45d-4f80-bf68-8d6ebbd366f8", "value": "1536:eR7K2qVyaxOyMz3UVs3gDSF+JG5Y3n21mUP8ys1:A7K2WFu3KIHF+JSY32c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565744, "uuid": "bc6aa4fa-18ef-477e-be3c-bd08606215c3", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565744, "uuid": "c06f7b33-d16c-4cc9-883f-94e2e7e0501c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565744, "uuid": "88dd082a-ce09-44a1-a0c0-c58ace263346", "value": "b7078ac2fca819769a2d21d8e3a3ea15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f54ed88-2fd4-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634534891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534891, "uuid": "0b1f98cf-efdf-4d96-a321-c051567578d6", "comment": "Malware payload (DanaBot)", "value": "0bc248a04ad6aa5b6e931cd68688c4ec", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534891, "uuid": "98d5b710-9a77-450f-ab9a-d55f7d637f82", "comment": "Malware payload (DanaBot)", "value": "30becd9e3a09c743923d3bd6768f4466b63f5ab3579e0073f911be7655f815ba", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534891, "uuid": "7c1d47ca-6e25-4c40-b551-6183a302a270", "comment": "Malware payload (DanaBot)", "value": "62feb83a1ab33c87db4937def4927896a50441b9", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534891, "uuid": "81670daa-3959-41ec-95e0-ce97900bafd5", "comment": "Malware payload (DanaBot)", "value": "f51fe1e1ff8efda8d636fed1adc75a64fcc604f8b2d23611ea033841cbbaa46c66cf1f8d2f6c2f78737b80929b6bd45a", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534891, "uuid": "354a3bde-73f6-4061-ba9a-5fb701d2c754", "value": "T1F9450200A650C039F1F252F44ABA5279A92F7FE15B2460CB53D56AEE97386E0FD3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534891, "uuid": "6dcd10f7-56a3-4640-8e84-fb03e90cb3d7", "value": "33155a730e036f2480434cae8e547169", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534891, "uuid": "646a0749-272a-4d01-afc9-b1b0cdf0f6a6", "value": "24576:SOnEONmPf3a6mkPIYzf6DgkGoY2t7LdYwnF6K5cQz4lsETGG:NEONaikPIaBkQ2t/dYe6V7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534891, "uuid": "6e8ff39f-f4ad-4937-a7c9-0587fee608c8", "value": 1259008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534891, "uuid": "9cd57fef-feb2-4586-bdd2-4b2d7e06408a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534891, "uuid": "1b187844-0564-4b06-87d1-ce04a30a20a4", "value": "0bc248a04ad6aa5b6e931cd68688c4ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f9fdd5-3024-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569321, "uuid": "880f14af-9cf9-4403-a45d-8f405ada2a1e", "comment": "Malware payload (Mirai)", "value": "39b7b2d8aeb267fb26a1054e0e253e77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569321, "uuid": "93aa1522-c5e4-4fd7-b048-c7c1b4df60dd", "comment": "Malware payload (Mirai)", "value": "315ccbe5fb51b6cd627dfb183e8189189729bfce1fa951632bc90e97b2b136c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569321, "uuid": "52ad7ff0-419b-4213-bff2-df6d754e55b5", "comment": "Malware payload (Mirai)", "value": "8e28894a6d1f6dcfdff5e12d7333cd6727ec0051", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569321, "uuid": "de2a389d-df8a-4338-b6cd-d630061e143d", "comment": "Malware payload (Mirai)", "value": "3b4229b06e122cb9775cd902d3226c748203627983f4df13e7da5168b6d54b10f6383e98c62e34395e3b83cf3c5450c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569321, "uuid": "e9beb2b4-b4c7-4577-ae92-c453f5a0452c", "value": "T1C853E781BC41A629C7D11777FD9F559E3700A3C9E1E932138C240BA07A8F94B0D5BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569321, "uuid": "c3914581-dde6-4636-9372-b4c41ad88942", "value": "1536:GogI5uRJ7lshCKotdsVKQAdQy33eZtQqQotK:GogI5uRJCQs+my3w3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569321, "uuid": "9b795356-fe7b-452c-bcc8-ddb616b934a2", "value": 62900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569321, "uuid": "2b9ec99b-a7bb-4834-9a63-ed665b57badd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569321, "uuid": "ccf6e690-00e3-48d1-b504-5ab1094e8e63", "value": "39b7b2d8aeb267fb26a1054e0e253e77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f432052-3056-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634590806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590806, "uuid": "442947af-4739-4cbb-bc98-07a2d21d8c8c", "comment": "Malware payload", "value": "c04821768e60f8c8f119e5997dcf5562", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590806, "uuid": "ed18ccb3-f7b0-4f9d-8fba-18344bd6e838", "comment": "Malware payload", "value": "31b2d59650a205bb6d3b196ff37169cb72accd682048cc467d9552ff3d7da6ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590806, "uuid": "6b101378-a788-483b-ba67-9cef570761ea", "comment": "Malware payload", "value": "15a7978f78ca1414f485ccb3da16b86855d864a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590806, "uuid": "aa546cbd-db4f-4d30-a26f-db5a4e6c8649", "comment": "Malware payload", "value": "0e700cbda3b08b3126fa0b8c729cd062cda526a43c9ecfbdfcfb75ae06528e23e025717cf979ea15a7a65a2a03073b36", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590806, "uuid": "5f9b4b2b-dbdc-417e-a6b6-fc99ceca750e", "value": "T1DC23F13584C850B5E6AF1C72FB224E4D5A2A37D76E53E6414148024D3AF6053AFFAA87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590806, "uuid": "771b8399-61ea-4314-8ff6-2e4291aae946", "value": "1536:TdV2Uh5NDS1h1/hyrxT3B31/m+uNp44nR:Td7h5dSppUxF3k+SnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590806, "uuid": "8b782819-7972-4459-bc96-2021f78936d1", "value": 49816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590806, "uuid": "da2b7ee5-d2f2-4abb-bf98-945df3bdd2d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590806, "uuid": "2f362424-378f-4661-87d2-119f42d9c495", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36234d23-3017-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634563679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563679, "uuid": "c297ccd9-56e8-4ec6-9695-ea3087f65f42", "comment": "Malware payload", "value": "34ff816c9decd4151520a12452cde537", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563679, "uuid": "2f98bce3-de0a-4710-928c-bbb1b8b50091", "comment": "Malware payload", "value": "32016cf36c5e99a6c8fba8fd4ffad8b5f301cac55439ae73fec5db799ac341ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563679, "uuid": "dc078e21-13b2-4c1f-8435-0a0650d0291d", "comment": "Malware payload", "value": "0473d7711dd31d97f89b6df36db00592c9367bbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563679, "uuid": "61f86fd7-dc25-493d-a0ef-e2912f756a6d", "comment": "Malware payload", "value": "a55f1a7bdada68312903e861758ef9b8116a95b9d30c2df2f99cb08dd4ba5f627fd5676067e23cf89e7eeee03e3be8e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563679, "uuid": "7af71b84-7465-4702-a2a4-7f9836d9ac99", "value": "T153F37443254C4AE5C9A9D0B9B8B1C193BEDC66A200D9D0379A107D3F0BDDE489B63D9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563679, "uuid": "a82ea849-64ac-4a3f-ac6e-ca931e1eaa21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563679, "uuid": "2c935735-d14e-4054-9bc1-0a3464c6071b", "value": "1536:729PafQQOLwxOyMz3UVs3gDSMYuNbwlFqqEmIG8LmdN91t8:i9PafQQ5u3KIHewnx8KR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634563679, "uuid": "a14afe7a-d51e-40c3-8c3d-6922c01e9d67", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634563679, "uuid": "3c528530-9146-457b-8a7e-480be35308b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563679, "uuid": "9a1e5435-961f-4d99-a5d9-dfdaeb4f0c0c", "value": "34ff816c9decd4151520a12452cde537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7260734b-2fd6-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634535863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535863, "uuid": "e3f85815-e1ab-43d2-8cc5-cb0c638c943c", "comment": "Malware payload (GuLoader)", "value": "f23ac5455ac12bccf90806988eda99cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535863, "uuid": "6fc82ae9-fc59-4299-9130-be763256f481", "comment": "Malware payload (GuLoader)", "value": "3272d72e22b57ea23809728b920ee779ec6708963e826fc44fd81d131673cd7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535863, "uuid": "7b80b52e-8659-4126-8524-7b4fb832e646", "comment": "Malware payload (GuLoader)", "value": "d14c6054b36999f5c41419beb3e3da7c7d6cbc40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535863, "uuid": "7b94268d-410f-4b6e-9856-9d3f36c04189", "comment": "Malware payload (GuLoader)", "value": "dd82c3181324edf243f462d1e25422cf331bd6b4b6966ecc6c6605f21389d9999a54181c130967671acc3f5213e0d90c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535863, "uuid": "9be37a7e-cc44-431a-be69-4083289edcd6", "value": "T1C3A33AD3798C68B0EA00A9BC0B7F046B471E6C7355578A5760C82B1BD83FBD29D9076E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535863, "uuid": "690ad9c8-aaba-479d-aa18-0490c578eba7", "value": "3d3cd1bd8dcc611a5734bf41f4e1a6a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535863, "uuid": "4de34d72-21b3-468c-8ca2-b0e50818a5d7", "value": "1536:t8DqQfLkxffQGOJ5XQNwxbti6M9qtL/zDRI8FD:t8JkxAGWiXCLPO8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634535863, "uuid": "c960c593-7115-4c28-891a-233a08968c1d", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634535863, "uuid": "2e5125a4-572c-468b-8d84-ad5398420f16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535863, "uuid": "e073be62-f19a-4517-b070-4f59478a2edc", "value": "184285013-044310-sanlccjavap0003-7069_pdf (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7f86a0-3043-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582512, "uuid": "83217581-a188-4823-b072-2abd9feaf7d1", "comment": "Malware payload (Gafgyt)", "value": "42f0b21123e1ea38b3346b779b0ee7ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582512, "uuid": "5fcd0627-6656-4f66-a520-016fcc17bfac", "comment": "Malware payload (Gafgyt)", "value": "32f33c729c00fbf5740e26849f4b235a38e729617e1dd14fbe6fd8500b221c52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582512, "uuid": "f8608ee0-1cf6-42d8-ab26-a9be7e2b9d44", "comment": "Malware payload (Gafgyt)", "value": "02cd9992023fa35b3473e9d0e38d4f037fd29416", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582512, "uuid": "f85aeb39-393f-45c5-8966-1977c8d24022", "comment": "Malware payload (Gafgyt)", "value": "e05086dda97fb55d3f968ca50b0de98ee06ab9034429302bf3fb025533a198f2abe0227802b604c2d20c3ece109ec4e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582512, "uuid": "ba36d118-7454-459c-a6de-e5f391e6cdba", "value": "T1AB935C43A8654FB7C0825AB1256B5E300757E8D20F4F1B96713DAAF4474B9CEB80EFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582512, "uuid": "c5ef1b09-98fe-4fb5-9334-a81c8f8d7526", "value": "1536:w6fbaGiK2XBtUwfIelm1mCv5hhdddddv7E3hmAim/j10PILDLf3Ij:7fbF2swfimO5hnKimb10PIvLf3Ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582512, "uuid": "46b3de4b-8f78-417b-b1a6-f45a63a4ac79", "value": 89836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582512, "uuid": "48ee2b4b-2ced-4cc0-97be-d5086a258ca4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582512, "uuid": "64348c74-416c-41a9-915d-5514847e7930", "value": "42f0b21123e1ea38b3346b779b0ee7ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5817b4-2ff5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634549306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549306, "uuid": "04dc2659-a980-4423-86b1-a8346feb6951", "comment": "Malware payload (AgentTesla)", "value": "9aa7c9fe8f8e38438c612d37c8dca47a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549306, "uuid": "dea6f16e-4b3e-4b4e-8792-519ca8df36b2", "comment": "Malware payload (AgentTesla)", "value": "32f57bd7d63cf9614a606939a9f1ab7c873e0773dca5259030aa480879a18513", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549306, "uuid": "7ed025fd-175e-446d-a35e-ef69032a37be", "comment": "Malware payload (AgentTesla)", "value": "486451d8d4b9f4653cd2153a433362cfb58fa8d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549306, "uuid": "5123c447-2c7c-41ea-b30d-88b0db947ff3", "comment": "Malware payload (AgentTesla)", "value": "fff291ce96a32ef0ad8293b3e709d71cd7622ec15a238eed37913861ba612fe6a3a7b3cdb889bfc9e5058255ccbdb7da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549306, "uuid": "a5ce73cd-d76c-4e93-b57f-f907723538cf", "value": "T12C250A59F342AC5ED457853394E458E3E10428D3E509C326EBB3BAA7588D7818F4CBEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549306, "uuid": "a14ed383-e54c-4e10-80c3-6b163e495663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549306, "uuid": "ffe50f38-5365-4f14-9401-3b3e01265f53", "value": "12288:+R/iAtfBSkkkkkkkkkkkkkkx9L+kIkkvkkkkkkkk7ZLyzF3feqWu3m1CZHo1SUFn:+RqAtklIAvL3gnvq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549306, "uuid": "95d0b200-54bb-4b77-999c-294028367493", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549306, "uuid": "7d86c1a9-07c4-49c9-846b-081c7126671d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549306, "uuid": "53bde061-0195-491e-9afe-2ba065547c46", "value": "DHL shipments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714f3dcd-3048-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634584823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584823, "uuid": "fa410c23-aeaf-4ea9-be66-39f566d82370", "comment": "Malware payload (RemcosRAT)", "value": "2bd00003a9b9f5ba28316b1ab9fa43b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584823, "uuid": "38885daa-a6eb-438d-8fa8-25a08c64ca23", "comment": "Malware payload (RemcosRAT)", "value": "333b4d4d8ba6b00d0500af8555909fd28a9b166ca7ec753ee3bcd262359397e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584823, "uuid": "ceb6acc0-7dd5-4af1-a75f-2cc42e93c9aa", "comment": "Malware payload (RemcosRAT)", "value": "d042c63fae4cb5aea3b0356077a92f45f751a546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584823, "uuid": "32aead4f-7daf-421a-90e7-6649381dca78", "comment": "Malware payload (RemcosRAT)", "value": "3b12d2e38253cb66f52112bab908c85e117a5851a8f9498fa271839471c6bce75c07b80b5f59241b30c95b99f5a10434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584823, "uuid": "b61c4dd0-0954-4d21-8045-392b917006b2", "value": "T1B2F402253219CE27C0A663B5C9FEA12307B9BC175062E2497ED93ECF39357818815B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584823, "uuid": "d9ca0501-04b3-4aef-be49-05dc51ac46ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584823, "uuid": "19f9c453-7b03-4eff-ab34-78a663a4c01f", "value": "12288:YSGQ6/NInfYTy0I4DU1kTWI4buOeBEN6PXnwfqGUu9RpctEXZ6vEU9LT0:LZfYuzEUAWwfRXn5o+Rs+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634584823, "uuid": "8c72034d-79e0-4fbd-a290-bbf711fb11f4", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634584823, "uuid": "8400e455-9817-40fc-ae12-68fa127bafd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584823, "uuid": "16baab00-6c03-4f86-a323-9d9f33737402", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c13361b-3050-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634588143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588143, "uuid": "8cdf4406-86af-4507-bde8-1bc9d9e0db6a", "comment": "Malware payload", "value": "a187ff3ecbbf22cc98cf591c23c7a76d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588143, "uuid": "cf703934-c71f-4aa3-8f05-4ab17819a8f7", "comment": "Malware payload", "value": "335352170d17688824cb6e8759bc39cb1b56dccd8ca0dd5e6fb48e9722c32eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588143, "uuid": "aa387215-5fe5-4a36-a898-07e5dee23177", "comment": "Malware payload", "value": "9c162ac34e013979c1b643a9b92178d041d84dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588143, "uuid": "fa40902e-8825-4b47-baa3-82b35af03b21", "comment": "Malware payload", "value": "a9c6d7236b9cc77094b8eb7fcb3c3fa8baca5123e40af3951958ea46ff66a86807d44e34ddb08a036a654a2ca30405a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588143, "uuid": "5e068fbb-b236-451f-a27a-c2b45da267c1", "value": "T1F6450506A7B46F29E43DB7B96930544483F0B815E7A1DA1E7CF5B0F916B9F004BD2A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588143, "uuid": "7e5aa5ed-9d11-41a8-a9be-51e9f89755a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588143, "uuid": "f5e787a9-8fc7-4650-a556-87c79c98819e", "value": "12288:NaeRPiwoNdS5TEbDUjYKK1w9y6D4+u+uDUuKit7JWPSb3:DewEc6y06Dnu+uDUuKiDWPSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634588143, "uuid": "3cd5c7f3-dac0-4223-aade-b9a634b91d79", "value": 1220096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634588143, "uuid": "5d50e623-2124-4196-a278-692367b8169a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588143, "uuid": "653fca52-37e2-48d5-96ef-d32a37094a9e", "value": "a187ff3ecbbf22cc98cf591c23c7a76d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a7d841-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634555783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555783, "uuid": "423ce4ed-36c3-4be4-b25a-48801832512a", "comment": "Malware payload (RaccoonStealer)", "value": "353e1504e161afde5389d5f8945511e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555783, "uuid": "f15c1c9e-87a9-4927-b251-0c91634e63fe", "comment": "Malware payload (RaccoonStealer)", "value": "33d3b2f2022f7bc8f6d5563a962d41fbb984b212b9e09f0ddf5fe7e9a44a8d34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555783, "uuid": "a5462f93-badd-48e4-9d98-4b5f9d68b8a6", "comment": "Malware payload (RaccoonStealer)", "value": "ee28c5d8de68edc83a76880046834bb16eb8c9f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555783, "uuid": "f90b30d0-769b-482c-b244-28f2a5766387", "comment": "Malware payload (RaccoonStealer)", "value": "a1841d5093dc2b3944b548a0aa231fa475a3d34972d02c5d4448d3785cccb5dcf6270f3a9ef2c19bd91884027aa2d58c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555783, "uuid": "5c6f86bd-6648-4762-b54c-6050fbb3ee34", "value": "T124D4C000A650C039F6F661F599BA9268E52E3EE06B2450CB53DD2BEE87356F1ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555783, "uuid": "271be244-e7a7-432a-85b9-84a6f05a5a28", "value": "bd3694527adf0e2f58ae8cb4e18ad5ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555783, "uuid": "46904c73-7c47-40f5-88f5-c8fab3d1c09d", "value": "12288:n8EoaM4zOfUGd5WFO/fSqP3AvER4Z5CpijK0mrTL0j6UwnS7MK2:nMeyfUG2Oyqos65xji0j6UNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555783, "uuid": "8d36bedb-0e0f-491d-99b9-e48166f13845", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555783, "uuid": "c4941967-b979-426e-9329-6c55f4238096", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555783, "uuid": "10b02b74-b800-4e0f-b1ff-9e3a4cfb6ec5", "value": "353e1504e161afde5389d5f8945511e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc553e7-2ff6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634549490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549490, "uuid": "21b42e66-be20-4c62-b224-882f01e9af6a", "comment": "Malware payload (AgentTesla)", "value": "6dcc9d21ef2edc9fd781ff822bd084d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549490, "uuid": "11188208-14bc-41b6-87a1-8ed44a6e1175", "comment": "Malware payload (AgentTesla)", "value": "33f4029423a3f52c376e6335e41d1ac4fccc9eff56aa29942cda968def3834c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549490, "uuid": "95795419-5de8-481c-9e78-de0150b16707", "comment": "Malware payload (AgentTesla)", "value": "6f06878c124458c4c470c271f403a996cc695bf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549490, "uuid": "7cb7096e-89fd-42a2-93e6-129cb18992d1", "comment": "Malware payload (AgentTesla)", "value": "875bc6f00155c956b3b3f2085d379bab5cfb69e1a524c48e84013fde587debfb78cc40951862c6e93d5722a2e5a93963", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549490, "uuid": "bed2d562-6be1-47ca-8378-d7e7db32a9b5", "value": "T16532C0A45B569BDFC0DB9A394AC81C2C39EBDC063BA4161B84C61746490249FFDB334C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549490, "uuid": "bf082be8-732d-4943-afaa-571c1e5be81d", "value": "192:O7XqQJP7ZOfoeyuRr7+j98XccOTY/vsvRY0iEDKRMAd86M:OzJP7cqux+B6ccWevGtibRMiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549490, "uuid": "61247a23-54aa-475d-bf70-4d71384e068c", "value": 11372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549490, "uuid": "70f386e4-e4e8-44b3-951e-2380d5f2d5a4", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549490, "uuid": "674c4667-72f5-44ed-89ee-7e40c3fa1e40", "value": "M0120211002081457786750.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd10642-305a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634592384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592384, "uuid": "a03679cb-d447-407f-bfb7-996cadea5892", "comment": "Malware payload", "value": "bf315b74685804072b8f6321435deffa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592384, "uuid": "d5d546e6-8036-4d73-a546-ab3bc7507a9f", "comment": "Malware payload", "value": "353a0834304c317795ced72984aa94138923405cf9873c1908d2dafe4e68b079", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592384, "uuid": "6070c821-e541-4e02-8a3f-5e2119576a07", "comment": "Malware payload", "value": "77a37f4bc95b728c58800929f7ce42f7fa00c999", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592384, "uuid": "8bfc40fb-20c3-4de5-97e5-2c8698df31f2", "comment": "Malware payload", "value": "af8d0092c70368b2d1e6904eed8545d5e1b6d8c92b9be92a22e39544af5aaf9bd400f2edbf03169398b0eb62ccece20e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592384, "uuid": "79eeff32-bbe0-497a-ad73-cebcd3ec21b2", "value": "T12823F111E2F11D31D66F2DF5C681E36323A93ECB36A140BA178DFE612D79B209540EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592384, "uuid": "a6dd3ecc-81a1-4ed2-a8da-2b5b9a03fa23", "value": "768:ruxA0wZJBmeWc3epNUaexXab40awS/D1yS3IobhX0WILLFnCx4uVcqgw02NWXrat:rueJBAG0U2P2/hyS371MLJG4u+qgw06N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592384, "uuid": "db810382-1ff9-4756-b299-0f07f05064d0", "value": 45748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592384, "uuid": "01b45db5-427f-4a6e-9920-1cd49b533239", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592384, "uuid": "aaff7030-1559-4029-ba6c-920dbe360a70", "value": "bf315b74685804072b8f6321435deffa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d233cf5f-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634542036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542036, "uuid": "b4becc95-a397-47c2-9f26-1b4d0d460c84", "comment": "Malware payload (NanoCore)", "value": "8c085cdea9d7ebac321bb25bcaddc37d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542036, "uuid": "91a7633e-cbbd-4302-a9a7-5fc5d26a6f63", "comment": "Malware payload (NanoCore)", "value": "353e52c2871cb9c0c2b0ecff4fe89d530072f8a6b4b915618495c90a8661a27e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542036, "uuid": "909056b7-b3fe-4e66-a08a-aa2d597e0f99", "comment": "Malware payload (NanoCore)", "value": "7e6f81744d2671908b9a59a5484cb124ce223813", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542036, "uuid": "143b0928-cec6-4141-a350-cca9eaf5bc44", "comment": "Malware payload (NanoCore)", "value": "8e0fffef3c0cc662746037ab95ab540ed7b3583109420bfc67e85669899edc098e3917846c501b092a7e43292a9549b3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542036, "uuid": "baf6d081-6cb2-4416-ae39-ecb763082f65", "value": "T110F2A87DF1870A888F8697B8170B2F42154CB51DF3D985B236B8DB3866C1D7B962293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542036, "uuid": "620a2b46-0077-498e-bacc-cc0f4d1404d6", "value": "768:IDDHZCUhnTFo+Jgallia1rhsrs0CQzL3ajG/Eeml/487cYP:IDD5bnTFo+Jgallia1rhsrs0hzL3ajGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542036, "uuid": "dda8a007-a5cf-4291-a656-d6be9499908c", "value": 36025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542036, "uuid": "c5c9051a-9513-448f-a95c-7c2405bf81e4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542036, "uuid": "0315ab1e-5924-4c6b-993d-710dabd13721", "value": "Order Inquiry CEW PTE LTD.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d108c8d4-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634542034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542034, "uuid": "fe0494e8-cb47-49d4-a600-54ff253b542c", "comment": "Malware payload (SnakeKeylogger)", "value": "2fbd15a6d2007c2c438c181e952ef389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542034, "uuid": "834012ac-fdc8-4b31-a20f-5c0aeb835047", "comment": "Malware payload (SnakeKeylogger)", "value": "359aca28cbb86b8055202dd1fe9cc037e16d8863f979e0dd92f2e74056f467f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542034, "uuid": "7ecf97de-479b-4493-812a-a76ce3ea373d", "comment": "Malware payload (SnakeKeylogger)", "value": "fc0f939e922d18a13c67c7957dd84b486472a82e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542034, "uuid": "d2dea47f-9172-4089-9640-db45f91585ab", "comment": "Malware payload (SnakeKeylogger)", "value": "4b600c2c6f4aee662691bb94aba832847bc240cc0e533f894ef037f77f4b0b37305f450e57907304c9cf40c23387ecb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542034, "uuid": "c2b1cfd7-d74a-43cb-a33c-6508898b93e9", "value": "T1F56401123BC8C66BCB9D077960E2F3A51BB8D9612F65CB1BDD8934DB0E723414E406A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542034, "uuid": "f3bd70e0-e4e1-43d7-bbcd-28a0bbf25084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542034, "uuid": "8e9ba515-c78a-4ae3-ac28-6bdf548c646b", "value": "3072:XQO8S+DcOgCOgCOgmh2eScGKiFzOT2G+NgdVqeVZflzbPLSKR6nyTUgTjQlO+ZhD:AXBuFpGpdVxZ9vTYnDhOVKOfVyamY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542034, "uuid": "d72b00a6-a47b-4edd-b883-ecfe1a4c974f", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542034, "uuid": "c507dd2f-0c5d-4cd8-b09f-151ebc90e0b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542034, "uuid": "306cb3b2-b9c6-4351-9493-7c795c8d7b40", "value": "RFQ-HL51L05- PO#0010202020A&B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad33fa8-305a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634592651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592651, "uuid": "52cc703c-66f5-4228-82b7-e4d98c024ec1", "comment": "Malware payload", "value": "a5f52ebae87b7703bb45ef3eef3233fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592651, "uuid": "7a73b7ed-f4fe-45e7-ae42-6f332a82b822", "comment": "Malware payload", "value": "361dda70e666ef8037ab73c9e07c06c017170d07958742aac93c1086560853eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592651, "uuid": "41d371b1-29ab-4a97-9d3a-8038a3a807de", "comment": "Malware payload", "value": "399124ec5e31e037206b310b09c82f0c21a7296e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592651, "uuid": "12acf799-fbd5-4899-ad95-2802a4f2bc74", "comment": "Malware payload", "value": "386452cb772750d46a687de886b993d1329334c2a67b8f479e194f58129dace43c360653f72c564c8fbeec62fa5cf185", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592651, "uuid": "5a52ff0f-5c04-4a24-8a94-2c6e097d26fb", "value": "T16E3302B0D642CEF049B224F5A4BF13A5C25D17E8E42A30237CFB569AD5C321F5879A03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592651, "uuid": "1444bcd1-6974-4a7f-bda8-f0ef725256f8", "value": "1536:h5jkE2CXEG9lTOuL9tlP55SxYRN5Aj5AnZnf22W:ht7LXEG9lau3laLARW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592651, "uuid": "22a1eb36-b29c-4ed8-ab54-b59cd6a7208e", "value": 54612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592651, "uuid": "c7137fd8-9bc8-4232-be56-7ff3b7e589b3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592651, "uuid": "35c37397-444d-4c1c-a788-70cd3c8e156f", "value": "a5f52ebae87b7703bb45ef3eef3233fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b4a3e2-3004-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634555434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555434, "uuid": "b3a86d17-5ecc-430e-84b8-fbbf37a1dd0b", "comment": "Malware payload", "value": "6995056a8c82b1f3b03ca7dc9efde199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555434, "uuid": "fc32d1f7-80ca-4ef6-83a0-497b920b16f5", "comment": "Malware payload", "value": "37a2471e61ff87c5749a4406013e9851c86bf8e3354bb224ac081dc384d4d8ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555434, "uuid": "ddfa3b71-8194-4b08-a9da-15d3072c5ef7", "comment": "Malware payload", "value": "799e2331c38a0cef00394334e4f9b3d65e694393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555434, "uuid": "e4973c43-ff46-4a16-b295-c9d02d65a08f", "comment": "Malware payload", "value": "368c64a338e5b8765fa4a377a787510b34ebefb5538b486e946ea6e92f401c3495b3eaffe9a54e55540d2aecebd7fe85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555434, "uuid": "37d86921-1106-4583-87b4-12a88c266ba9", "value": "T1A3B4D000A660C039F5F366F48DBA5269A52E7FE1672490CF83E51AED97356E0ED3031B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555434, "uuid": "92cd7f90-2b9b-406c-a539-cff0c1b61246", "value": "12288:E8Ssxcar6P7XaDJuwYNk7Lf6HAY+7CrMLqDa6/:EX3IDJLYNk/fBYuqDa6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555434, "uuid": "9d2a4580-5e47-45b4-a8fc-7e530fc26e1c", "value": 506486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555434, "uuid": "647c4b4b-e29a-4966-abc7-9bffd5d793de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555434, "uuid": "cb2a6c7e-faaf-4bf0-89d5-dc973ab6013f", "value": "6995056a8c82b1f3b03ca7dc9efde199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646ea0ce-2fc4-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528108, "uuid": "e50ebdbc-344b-4719-807d-cc7f3980327b", "comment": "Malware payload (Gafgyt)", "value": "34ad4948b1239d8e9601ae88deed67fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528108, "uuid": "c65a5105-dba1-429f-964c-5b40545153f3", "comment": "Malware payload (Gafgyt)", "value": "37c7244a13115ffd0cc58000ece990e74474687a6d7b3b1caf23a23ee9436113", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528108, "uuid": "14acecbc-b4f7-4d06-b302-55ade2ca5fec", "comment": "Malware payload (Gafgyt)", "value": "b05155ecead07c28ec13f66171365427ff3973ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528108, "uuid": "a8e36a90-ed8d-4b23-a7fa-155a6b36a72c", "comment": "Malware payload (Gafgyt)", "value": "675913f661d54f82a376d57472217fad490788f353dae20d72386604702c4d8b2a45503e2df4ed55dd950ff10487d759", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528108, "uuid": "d3e9cfd3-2e41-4496-95cd-1318cd912031", "value": "T13DA35B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528108, "uuid": "95032faa-ccae-4811-80ae-dabebd234cec", "value": "3072:cWCjQrLpnr85EdT9Oa8vqbVr7O/CEgmqAgcVyZIcBI:cf5EdTbpr7OWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528108, "uuid": "c7968a8b-d846-4904-b5ca-f02ef3a0251f", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528108, "uuid": "a20b5a11-b7e1-4129-a3e5-3565064a191c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528108, "uuid": "55fb3cdd-4d1b-4b75-9486-02392f93322e", "value": "34ad4948b1239d8e9601ae88deed67fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505a181e-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634561146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561146, "uuid": "99bf980f-3b2f-4797-86a2-01b425924000", "comment": "Malware payload (AveMariaRAT)", "value": "95aabefa57e339745033c755da1e3a51", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561146, "uuid": "9cca57d3-7b5a-4e72-b04e-45a1481c8aac", "comment": "Malware payload (AveMariaRAT)", "value": "385aca8d45376ca052fc5da153a56ca36d4c3c676114179d79e4e681d2851ef6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561146, "uuid": "63de8617-a2bb-4396-82ce-3925c92a9f10", "comment": "Malware payload (AveMariaRAT)", "value": "09e4c4b75467a4af21be516c1fddd77142f3a480", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561146, "uuid": "3688e981-ef64-4e38-b446-51cbe29d29c2", "comment": "Malware payload (AveMariaRAT)", "value": "60d07d408096302b310a7cdf9149eabd7ceca685fc40ebcc1df495bc0f1da9f6ff05f5ecc331efb9576e0f3472a2c947", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561146, "uuid": "10f99a31-e0c5-40cd-b8f7-ea7f5016c29a", "value": "T16A74CF27F4CD69FDE00D84794D6AF72CB9226C24046F2C4B5E95F86846B854322F3ABD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561146, "uuid": "4b8c3d51-5607-468e-9206-333fad281024", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561146, "uuid": "e5438d50-2664-4734-a06b-1392ef79b965", "value": "6144:DBlL/6zQS0gKhqjAgv1DT12hnTXXtq8khU6RJRZprPCJ:VrgkqjA0T1MTXXY8khrdPCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561146, "uuid": "c53f9dd5-e4b9-45fb-ba60-7872185978eb", "value": 364900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561146, "uuid": "a3d7e1b5-6145-4e6a-88d1-5134542be37b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561146, "uuid": "58882d09-a66e-4f26-9c21-54e38f239a3e", "value": "transfer slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a916d74c-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561295, "uuid": "bb5e500c-cd50-4fa2-85b8-a581b1b71143", "comment": "Malware payload", "value": "ea3d8936b9c91080d8cb3589063c7bdb", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561295, "uuid": "e141af44-6e14-4910-9821-840977db7121", "comment": "Malware payload", "value": "39ce1c879cb6e0c569e293da26d73b95a10134fa4649275eaee0795fa4a05e20", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561295, "uuid": "520e9a08-98c3-44ff-8f07-5b25e1e21164", "comment": "Malware payload", "value": "28fcd663e433fcfd43c7b2e6b65ce6fadc67cbca", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561295, "uuid": "94e28711-5e1c-440e-807a-636653aa4e7f", "comment": "Malware payload", "value": "eb311c4f421148c5b99a66638efc277a2d9c3f1e226884e7f5778a33ee8d3998e8101fb2f0a4b4ff5631f6d6588cb12a", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561295, "uuid": "671ea38b-1cdc-4239-8e8d-cc7348d8ba9f", "value": "T1D584F10932758F22D9F5A3F64438626307B62D278560E24A4ED17DCF3D7AF838629B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561295, "uuid": "f4c7bc23-a517-4743-bc73-c58b6d7b88f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561295, "uuid": "d01c4727-2387-463a-af7c-994654f1cdff", "value": "6144:81xTiDGM97PVSg0bLKkDd7mkCs4NXQT3Wv0gq7eXRzlY:8HEGMtPcgWdak/4NXQT3stqahW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561295, "uuid": "f85836b1-ddd8-4aad-b1a4-c08557ae687c", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561295, "uuid": "8304148e-f468-4426-822b-2bac19c5b656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561295, "uuid": "e6238bca-7513-4de6-bed6-04d4eca904d6", "value": "Copia de pago 101821_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9522053d-3028-11ec-843c-42010a9c0014", "comment": "Malware payload (ZLoader)", "timestamp": 1634571140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571140, "uuid": "3e010802-b31c-417b-a280-8864e28d8495", "comment": "Malware payload (ZLoader)", "value": "2f5674540983bc9a2d8ceb2078fa01b6", "object_relation": "md5", "Tag": [ { "name": "123", "colour": "#00AA99", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571140, "uuid": "e29604b6-a43d-4447-a0bf-95feecf0108f", "comment": "Malware payload (ZLoader)", "value": "3a4ca58b0a2e72a264466a240c6636f62b8742ffbc96ce14e2225f0e57012e96", "object_relation": "sha256", "Tag": [ { "name": "123", "colour": "#00AA99", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571140, "uuid": "0270abad-5155-447b-89d6-fb74c5973036", "comment": "Malware payload (ZLoader)", "value": "cc4bba83f31c2d15ebd9432e3d832a4c3de8c516", "object_relation": "sha1", "Tag": [ { "name": "123", "colour": "#00AA99", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571140, "uuid": "74079c9b-ebe7-44fb-ba6b-ddc9aa0a1abd", "comment": "Malware payload (ZLoader)", "value": "30a7f3eab44c7280eee41eaf12d2a7f7ebf1a7c8702439ca59aafeed281dc6f7652bbbe59d4c1871f3f15112435cb8ea", "object_relation": "sha3-384", "Tag": [ { "name": "123", "colour": "#00AA99", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571140, "uuid": "639b6a85-4086-4c2b-b290-a1ea21e7ab40", "value": "T1BEE33A16A854C638F80100B55DACBB7E9C5AC50D7A238ABBC7C1C8D09FE96B0777E61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571140, "uuid": "2c09c3a9-80e7-41f5-badf-d8ec3c124f60", "value": "e8478bbcb7a4fed9fd3a17a0d9e29028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571140, "uuid": "aa563291-f95f-4ee9-b27f-dea5047424ee", "value": "3072:zad/Bacuyiy13Babz1w+99lfuFhUgrIH2xqUpw/VAfyV:OdD13B6zd99gUgrIHOqUpw9Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571140, "uuid": "5f8bb515-a056-4af1-8d38-14c9359e9141", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571140, "uuid": "0f7d2b54-7175-4065-b4ea-3bef6b9121ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571140, "uuid": "397f07f2-cb9d-4e8c-9d70-0ff6ed1f77fb", "value": "unpacked_zloader_21_10_4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a432ec5-301c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634565753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565753, "uuid": "75e84839-fe8b-4690-bfc4-9f7be1b43dda", "comment": "Malware payload", "value": "4ca6ef20b73800f2c9e596f430b70456", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565753, "uuid": "6e28bceb-3376-4dd1-ba56-b2e9c9b78b90", "comment": "Malware payload", "value": "3abe735f7c79a81f1c92e3a72eec0f4bae9adb73abbb430bd14c79ad7f53fbd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565753, "uuid": "75d468d7-0e94-4146-9756-5eac88021b4a", "comment": "Malware payload", "value": "3404e504d5d07278ccd9b95cf7ce67ab43f941b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565753, "uuid": "f2313b2c-3bc9-4439-9981-39e57ee856fb", "comment": "Malware payload", "value": "f2030a5d645f713ca72cc5fc3d31a7bd87c593bc71958da07b77f33773b04cc6a7c4537143f4e973e2a7ea8b0e66511b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565753, "uuid": "fb10f5d7-08fe-417f-ad96-26e154aa24ac", "value": "T14AA4C53D6DE5623BC677C670DAF669CB9D1836133212580EA0DE478A5A43E673DC320E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565753, "uuid": "4b041b26-c3db-4e0b-a347-aba64e1b8581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565753, "uuid": "6d89cae7-18e5-4fd3-9d5d-5a9ee20a0777", "value": "6144:QDSkF/Kuq5K1GRVNXjEuZFkLMk/lOF4E91cQZt:gSkFMo1CNzEusLMkdOFh9/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565753, "uuid": "e4b76dbe-75fb-420d-8d7b-cd12be506a8f", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565753, "uuid": "85210947-b9f4-4c33-b9b4-6d0541f56468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565753, "uuid": "590a5273-2efd-41cb-b3a0-bcb7b22ca2b7", "value": "4ca6ef20b73800f2c9e596f430b70456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7116bbc8-3055-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634590406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590406, "uuid": "409a0357-9f7c-4f21-8abc-b0ec1e0f8a0b", "comment": "Malware payload", "value": "03080711e2952cde2c9fd19d133a939e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590406, "uuid": "f86e56c7-2ac9-472c-82c6-4f9fccdb0bac", "comment": "Malware payload", "value": "3b2c7ef4cf7315a1bf510c073a7bd50bbc16a371b5e624479a2333b840f72e93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590406, "uuid": "9ebf23d8-05f7-4644-8619-93bd638f2497", "comment": "Malware payload", "value": "3237ca2d142a3c4a0e87bca096bcca738d9601a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590406, "uuid": "b5a86e0b-3d61-4420-ae2e-aa2517ba6e36", "comment": "Malware payload", "value": "de00c0786e674f4e0657c42c408b116af123882abf538487cc9e8dea6717d975a86b71dbcb9e2b26cafa6763f8a742a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590406, "uuid": "1a685938-5eea-4acb-86fe-e71cafa51766", "value": "T1D3A4E0267265CE11C0A153BAC8BE905707BEBC174422E24A3EE97EDB39397C34415E8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590406, "uuid": "e6b9ffe4-036a-4662-9fab-f39de72e5cbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590406, "uuid": "6bf75b82-596a-42c8-8d25-175ee25e03e2", "value": "12288:0cDOfRGBbVigs7rC99j5jMhTvsgSvOgdELGa:0c6QAVkfOsgOOLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590406, "uuid": "5fd1331c-be12-49f8-9c00-cc6caeacd721", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590406, "uuid": "86c33e6a-4b53-480a-858a-86994d867ef4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590406, "uuid": "c442bbfb-eb07-4c97-99b2-e23618aa7616", "value": "New_Order_PO#960780_MT_Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56db437c-300b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634558580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558580, "uuid": "4887086e-a31d-405a-9c64-0d0fec50a6f5", "comment": "Malware payload (SnakeKeylogger)", "value": "08188e5102d3824ad530a21c1b25ad97", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558580, "uuid": "edf8d268-3918-4d04-8655-a1b3d1b084d9", "comment": "Malware payload (SnakeKeylogger)", "value": "3b437baa9a07e9dece2659f20b5d97f8f729ba077d399933041cdc656c8d4d04", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558580, "uuid": "e388a2ee-a2d0-447e-bbad-84e9787b934e", "comment": "Malware payload (SnakeKeylogger)", "value": "1d5fb4b5a63f16d2c8bde8e42f9bc15fc8e1ff03", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558580, "uuid": "351db568-5bbe-4b3c-95d5-414bd82d82ec", "comment": "Malware payload (SnakeKeylogger)", "value": "718aeb75422d9179b9adc4dbf7703d1519648140a85f38803459916e17a361014b95888b02bbb7f8a9a137ccedee06e8", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558580, "uuid": "465715cc-2ce6-4099-904c-01276a143cd9", "value": "T1FE842364976C58E647CC35BBD488129DF231F6338386EB9A0DE894B9D40324C4BFE789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558580, "uuid": "589ae8ca-3e8e-4568-a89e-31fc20d5c5d7", "value": "6144:nQ+RqiI9rPYvKW88hNdgZKoJzHN0/5DC5GHvvxU99oCnlAyPPyuUTuc9r33YaW:n/I9rgy583oJzeOcHvG99oep3B6uc9Tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558580, "uuid": "ffd2b991-f06d-4898-ac9e-10f52a853af9", "value": 372598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558580, "uuid": "a25af7b2-b292-452f-be94-ed281dc27883", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558580, "uuid": "ea317d24-3db6-4d83-891e-83ccb1d5c167", "value": "Rfq# 1769.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca234e7f-3062-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634596139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596139, "uuid": "62788d9c-619d-48e0-ae10-0b3553723a46", "comment": "Malware payload (SilentBuilder)", "value": "d2f46f025c7ca9e0fc7e78283406c2c8", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596139, "uuid": "ab2a17ac-bf4f-432f-9e7a-c9aa235132b2", "comment": "Malware payload (SilentBuilder)", "value": "3b881ef311755438e9bc47cca397a2940a20c297478be63a3a7b4cddefa1a9de", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596139, "uuid": "6ac24a03-d8f8-427e-b80b-a1dd613ae290", "comment": "Malware payload (SilentBuilder)", "value": "fc43a2a39eee6f4f3bc880e2ce03a20131ce24f5", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596139, "uuid": "8e3b78d5-5213-421b-976f-3516117ca017", "comment": "Malware payload (SilentBuilder)", "value": "888bb8e7c03df6a710b0d8b66d493a568e7eae9896317ceb0ad946a635bb6ddd616cc6c3bf34bb2701413a2ed2cc0b57", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596139, "uuid": "d3c8535a-19ef-4e79-85d3-86548c888b88", "value": "T1D344E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596139, "uuid": "ccb4db19-574b-425a-b929-e892a523860d", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw76:U9jFrjmkD7IvLDK3vLvfn1+2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634596139, "uuid": "9e78db5e-2ab1-4d14-8e58-3d5d27c67cb9", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634596139, "uuid": "fac4f8c4-5084-4b21-bf5d-0622ada48dbd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596139, "uuid": "77272239-85c2-4282-b3b6-9c6cb3c48263", "value": "d2f46f025c7ca9e0fc7e78283406c2c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd1c992-2fea-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634544282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544282, "uuid": "4bc0e059-c7c6-4637-91d0-240ae6e8f818", "comment": "Malware payload (AgentTesla)", "value": "6d13873a053be7742317fd310f5d1307", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544282, "uuid": "d86b35ab-32da-4c08-9c1f-d539e6c803f1", "comment": "Malware payload (AgentTesla)", "value": "3b90e29fb249892cf6dc101070bd0acf70acb19e387cb92a279c743ac23f6898", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544282, "uuid": "de3bddae-17f5-43e3-ad4f-e92b776bddfb", "comment": "Malware payload (AgentTesla)", "value": "ed2e3ea2a915b174b53637252682e4d8e1f89f4c", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544282, "uuid": "d0eb89f0-9783-4d62-bde0-a6b872c2cd97", "comment": "Malware payload (AgentTesla)", "value": "64bdaa65ea1523beb386fc8b73827a72de435517570688f7429cddef79ce5c122e8f37736cb530fe5f03570a8f67112d", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544282, "uuid": "625aac71-65aa-4c01-9e07-84d1317ebf77", "value": "T14D43021863396125DA2424362362F0B130381BA7CE51519F60B6F285FD3FA7F56EF6E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544282, "uuid": "81bca4c5-b695-4e78-9554-6f7c21a3c9a2", "value": "768:HFvXH1kaSQ2F0HRG+pr7/bmrzxV0J3kA3X/sjilgsffJlp5jQhMeATn8vkrtj2wW:H1XH1kbQ3HR52r43PLiq3+vjvkrtSem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634544282, "uuid": "a4cfcca6-92ce-4bc9-aab3-966f933a7c0b", "value": 56800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634544282, "uuid": "89dfab2d-6881-4c5c-846f-fa69a5b66d0b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544282, "uuid": "eb3acf0d-b7fe-4d02-8ed2-d72da8d35c8e", "value": "Payment Slip.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6637da8b-303c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634579651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634579651, "uuid": "63b51866-f1b2-4402-a019-755c5bbc5dc6", "comment": "Malware payload (Dridex)", "value": "94395a29f0cf16cc80c2a1a4aee0d8d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634579651, "uuid": "79c06aac-a7e2-45b4-897b-0ebfbb40d6ce", "comment": "Malware payload (Dridex)", "value": "3c4be1285b8069c2db590c1de6a77adef3198cc9c3f323aef5de73753421c2e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634579651, "uuid": "82bac652-0d0f-4d9d-a5ff-abd870c14eef", "comment": "Malware payload (Dridex)", "value": "c40574963b019d49fae4cffcefd970edf3957826", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634579651, "uuid": "cff6a50e-d569-4242-90b8-380f1bc80597", "comment": "Malware payload (Dridex)", "value": "ba5ddaba0555c9e7eec06680ff084a96f8f7c828ff2bcbf7f4084485eea6756e34cac9537c7d64cd5624cc9e717649da", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634579651, "uuid": "ec64093d-e169-45d5-8999-65a75fe6e6be", "value": "T1FA340EE16075DE74F98C0FBB00173F1EBAD81A40C66E42D8E7A147D2927B7AB30999C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634579651, "uuid": "6199f65c-f0cb-4232-b122-1b025f017cd0", "value": "0ebde65b3dfcb0fcfb0a3a0485d4c13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634579651, "uuid": "5ed5e599-58c5-4a30-ab7d-68b5399e93f1", "value": "3072:2EmMHLYjs2g+ciAlYDyOWIsh0pMf+66C4FxTdCU1byGkGcyXDTEXlDkr/:9rHL+tg+cGyZzheB6b4fJCwb8d0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634579651, "uuid": "0e1d3e9c-207b-423a-875f-cf4b56b4904e", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634579651, "uuid": "7bcfa56c-17ee-469f-ae9b-a1b59abbf2ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634579651, "uuid": "530a8ec5-a580-4247-9496-c03477cc2601", "value": "6_aaclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff15d69b-300a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634558432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558432, "uuid": "ffc7d553-84e3-4122-9b55-f9dcd380dfc3", "comment": "Malware payload", "value": "ddcacd8e602bde574e3380cd34b17a22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558432, "uuid": "77ac1593-d16f-4851-8e1a-8ee98799c1de", "comment": "Malware payload", "value": "3c6d3d8d1d1cd0e7503c141e407c2d0f13f87b5b76dac2cff033baa027033e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558432, "uuid": "6009cfb3-7060-4afc-a93d-809a50186ecc", "comment": "Malware payload", "value": "3bfdd32e7f21a9c74aae2b798c9b478f1b160072", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558432, "uuid": "d1d2e154-7072-4c85-be50-89ca4d94ddd4", "comment": "Malware payload", "value": "0aa9e7deb111370d7ff614fd050138dde23c6e47ee7de37e137c3dfb28cac2a0094c09539df03802e1475e74eed82656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558432, "uuid": "42c1fed1-9df6-4cc3-90db-5db672ca9250", "value": "T17BD4F1216BA1C035F1F352F8097693A8792E3AA0B73494CF12D657EA4A246F1FD7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558432, "uuid": "fb50039f-cc7f-484e-bafa-33bc059e7f4f", "value": "b2b1ce057c4a3ad8c1ee685e46521866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558432, "uuid": "dcb7ebdb-2b14-4fc5-94ed-447232313e96", "value": "12288:he7bIUncjF2EjM1bDUJDwtk81mEjN1otGBjlG1iDirElKdNHd:M7MUncjUKM1PUJMtk0N1o4hlGghK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558432, "uuid": "2e80644d-acca-41d3-a944-5bbbb97602de", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558432, "uuid": "769cf269-7133-4a1c-bb8a-d8378924f953", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558432, "uuid": "11bd6821-3ad0-4a50-a104-7fdaa3d4edec", "value": "ddcacd8e602bde574e3380cd34b17a22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0024f7-305a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634592596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592596, "uuid": "cc63f570-d25b-468e-ab26-05c6513348c4", "comment": "Malware payload", "value": "e8545399823b411ea6cb927e80aded0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592596, "uuid": "04e4f553-89ec-4e49-b594-9e631f9f9481", "comment": "Malware payload", "value": "3d31e58a5488a2ec7fb942d3b7005b73b7a617b2b31c89aae7edf6b460edd11e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592596, "uuid": "45866b1f-af00-4d26-bc6a-4fe35cd44051", "comment": "Malware payload", "value": "22af521e6119003289b6bd5d7be9a3328acb59cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592596, "uuid": "9120b71a-9fda-47b0-b335-d771f6dca453", "comment": "Malware payload", "value": "d974e0c4520806e18cc404b753690683a6eb5581c7e8646b9ad8dde3ab96fc3b12fb60c6d6c69762152362c8c036d198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592596, "uuid": "fec4f438-641d-4947-9bc3-b4c2af0ca933", "value": "T100B48E6873599B5CCB1C4E378137421853E8C06BB66EF72E79C29AE458C6203E71B9C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592596, "uuid": "96a375c8-2b8f-4e61-811f-8b2652474b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592596, "uuid": "13cae34c-91d1-43bb-b83a-4927e57d9056", "value": "6144:WE3WAe1LXFPQbIQrn7xVEcMXBvsEbfKBqwOwD71tJ71Py6QSIRhg0ST7IYzMTFOB:WKWAebYYc4hbmOwD71tJha6QSGdAF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592596, "uuid": "6e323231-f5f2-4937-81ee-b85924e1691b", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592596, "uuid": "a80fc800-8704-4f04-81a5-a7c81b76ef20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592596, "uuid": "7ac9e684-7b6e-4eba-bf73-119e01c4c07c", "value": "SecuriteInfo.com.W32.MSIL_Agent.CFH.genEldorado.1778.11526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff2cbe0-2fd3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634534650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534650, "uuid": "d52e40a7-58fc-45f9-b802-a0f8777595ba", "comment": "Malware payload", "value": "141e2bb2335e7163dd30ceeff59bccab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534650, "uuid": "b906b365-46c3-48fd-b74e-ac8e1d346e65", "comment": "Malware payload", "value": "3d9691d4b5bed87055ac01b0dace378de3ba83e81bf9341e3247e92756ae6f9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534650, "uuid": "8fa8ee5f-3e57-49bf-8324-af6daa0bf98b", "comment": "Malware payload", "value": "5383efb888dad5eeb87b81ac545c516efff5e9e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534650, "uuid": "a153caff-8d52-4ccc-97d7-dfd5ad32d135", "comment": "Malware payload", "value": "b29dd2c53e0ec90374c9ea17ab35cacdaaf04488b94a432925c26e6b699e1bc506e477c049d63ba20c3990497e371f54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534650, "uuid": "36a8c34a-a4cc-4eb9-932b-9e7f81f5ca5a", "value": "T1F6730611B7FA0068F2BBAF71A97245841E37BED1BC75D50D0149168E0E72EA8DE78723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534650, "uuid": "34f16712-5bcb-445a-b09a-bbe6f2041a3f", "value": "1536:VkbrUqP+d0yR1bSyQa28OgZ1eW6tmCcFdO93IbEwBiV0YF5O7:Vk0qP+d0yR1myQEeW6tmCcK93lwBOF54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534650, "uuid": "831e27a1-eb45-441d-99ff-13c85568a949", "value": 77878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534650, "uuid": "64be01b6-ad57-48bc-8e21-205651b62bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534650, "uuid": "c8c55088-24d5-4f35-aff4-9b5190406981", "value": "141e2bb2335e7163dd30ceeff59bccab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca445584-2fd3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634534721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534721, "uuid": "79c47272-548c-43a1-8770-bff52361ca41", "comment": "Malware payload", "value": "21dd88a07c2c023f133b4b4cdfd99283", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534721, "uuid": "f5b16931-0d38-4d8d-ad4f-95970dc15785", "comment": "Malware payload", "value": "3decc481f2dde3f4276ef15ac1e1cd2c24bfd034c147f1eb4c3351307313cada", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534721, "uuid": "31259f33-a86e-4668-bfe1-b60d1f1c6668", "comment": "Malware payload", "value": "95e03e04a9354dcb290cdc47ef3b3145aa7cf2aa", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534721, "uuid": "69eca3be-818b-4fc7-82f6-807fd4ded12f", "comment": "Malware payload", "value": "55295ee9f8bae6a8a6161f120dadb61a44d1bd840708affdc56965ae3c175d18a39958db5a1459bb20826ceac95751ef", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534721, "uuid": "4c731c14-ca75-427a-8e02-5cafba8094a1", "value": "T10392D03BE36EBC6BE01DB235491958EDD9E03D4607E552E33484B86333982D78223F24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534721, "uuid": "5e1208a2-6ce7-4200-b02f-bcc1850c2d21", "value": "384:6xIO8/pZunvUdqplggf+BgmwXOs6xNCcK4PLfc9iFqcJyw:DDZSTnTmyc5LfEs4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534721, "uuid": "4eaed352-bf49-46ca-b2ba-0b18f742924d", "value": 19828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534721, "uuid": "2efa1ca3-d75a-4a1c-b1d0-6b8807ae5512", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534721, "uuid": "c5ee4e2f-c552-4da4-a681-df4d37ee4035", "value": "21dd88a07c2c023f133b4b4cdfd99283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9558cb34-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561261, "uuid": "b7a4ed67-190e-47bf-b117-be2de5311db6", "comment": "Malware payload", "value": "a16d97d83e86c96e74214a55149c0f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561261, "uuid": "8f4edcc1-f72e-4edb-9f4e-7f40337426a3", "comment": "Malware payload", "value": "3e9a05916c586e006b8b234a6d56da5c54e5824ef3ae7d6feac22cc87c0c4d6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561261, "uuid": "fc08ad27-f296-4a24-9982-7310390fa950", "comment": "Malware payload", "value": "f793afa6b306af8aab556961229ba14935ca5ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561261, "uuid": "62441f76-31f7-468a-83e3-e6ba5e6e8370", "comment": "Malware payload", "value": "60743d5cce4521ed81c4ae8465225ba940793f2b6705308e8d6844076ab1d07ed83f0cce8294e4e5abff40e4c48d152e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561261, "uuid": "adfb3f01-3641-4559-a91e-eb1582bf3e3b", "value": "T189A4F10671589F21C8B907F7C87895135776AD274610E29B1ED1BDCB3ABAF838124F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561261, "uuid": "6c899d54-31ed-40cd-80c3-232ee191063a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561261, "uuid": "6757fb12-0c2f-4f5b-bbdb-6c3b4cba38af", "value": "6144:leSGSNthV68TW19ix9ieBWZlM1JB9iKbfTW1cyca86/ITP/vkdNqDIP62Ytw/:ISGSNtzLjieB/hiv1cyAzkS5fG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561261, "uuid": "dbf37787-8a68-4c8e-a0a2-d21ea9cf8013", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561261, "uuid": "42a3cded-3a30-4557-b2b5-cbb65c8b81ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561261, "uuid": "96174cf3-def5-4c69-bc39-24f46bbc9679", "value": "5WyLjlNNTIPWdoO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a52c66-304f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1634587991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587991, "uuid": "afd1af49-71c2-4eaf-b474-5cf841a3539e", "comment": "Malware payload (Gozi)", "value": "a4dc36f13e46d20efd7c46cd501058b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587991, "uuid": "00e1c5bf-e9d3-4c2e-841f-b71256661761", "comment": "Malware payload (Gozi)", "value": "3edf8ee5c6c8662d5e7ece21923c29a630a8309d6168a3579108dde18e01df18", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587991, "uuid": "e4603427-50e7-46a2-8e9c-544181fa5fd5", "comment": "Malware payload (Gozi)", "value": "fc876ed20a1668ab4af8af2b0eb04193fec3b56f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587991, "uuid": "f1240763-2392-40e7-b3b6-58b814cded6c", "comment": "Malware payload (Gozi)", "value": "7d8148769b80ccce52e544d6d4ff603c0a0d06478a0f4e40b08140642616bf4014fa8f45e23ab0f56b1a55c9e2ca6462", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587991, "uuid": "258a80cd-dd86-47a5-a47b-b8dc19a63172", "value": "T156947C1033F64431F1B3433A48B6D1405AEDBD629A70ADCF32C52A4D16BB6D19B79B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587991, "uuid": "bd0af8ab-2917-48cf-ba53-b8dc72c85de6", "value": "8ab28ff89ea1dd5f7e70bef00986ad9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587991, "uuid": "96a99fb2-4916-445f-bd0a-30e957e8cb9f", "value": "6144:rFvyrc/+PEa2S+sTks/EqyHYOgf9YfGQMQavPeTCzLNzrkOXAxuXLl:5KZPEzs9/vysiOlFmUtzCu7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587991, "uuid": "55bd23c4-1461-427f-8d98-dc0a45843b23", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587991, "uuid": "4764a7d9-21b2-4797-8a69-080d40405db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587991, "uuid": "b65ea603-cdf8-4a0e-a6d9-c259820b40ef", "value": "a4dc36f13e46d20efd7c46cd501058b1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44817dab-3068-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634598492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634598492, "uuid": "bbc3995a-3b65-4185-96fa-eb407e2ef62d", "comment": "Malware payload", "value": "6044de3430709817472e987ba3eea468", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634598492, "uuid": "ca752af4-25bd-4ede-b5f8-d6ebf402c166", "comment": "Malware payload", "value": "3f54aa231423dba5910935268304479637e3d1ec2d4b048df8b22d39106214f2", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634598492, "uuid": "48965c38-30d4-47cc-9bde-82d7bcd842ef", "comment": "Malware payload", "value": "bbc66b10106e2e6a8c350e07e4a47429078377ec", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634598492, "uuid": "d36666fe-fa05-479e-a437-90fe353bc833", "comment": "Malware payload", "value": "c6d93779abeeba1c24ef85397c7827207ad7dc400a6d93581c0798fe7826cb164292a518c70d9e1b0126104ace4cef1f", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634598492, "uuid": "f9096651-77a8-447c-a6ce-186ba11787b7", "value": "T12524223B75E15179C2A5C03C87DE1B9AAC25720F8D9AD7337C3852ACF5531CDAB82185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634598492, "uuid": "4cb61871-8fa0-45cf-8ce3-a9455cb9d6b8", "value": "6144:Hn3an90bRTJ82x4GHb6TCNhkTHlOfk1IpA7pNAmwMz:DlHxh2xIpA7pNAmwMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634598492, "uuid": "3e42557c-dafe-4ea3-9afe-d81a6733b31f", "value": 221300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634598492, "uuid": "40d4a6ce-6cb2-405e-ad3f-c695de1266e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634598492, "uuid": "5e3fd551-dab6-44d6-9470-01d577723e21", "value": "Invoice-3277028_20211013.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83aa1e82-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634555648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555648, "uuid": "75541720-813c-4f59-9773-34ebefdc7d41", "comment": "Malware payload (RaccoonStealer)", "value": "f75bf9d3ea194bee098497c14bc53ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555648, "uuid": "37a5261e-d6ed-4e00-a220-56ff7c9a07d3", "comment": "Malware payload (RaccoonStealer)", "value": "3f7782d85f744e3e728fb3b2c3dc04d00993f3e6a7caf3b4cab412837bcc4c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555648, "uuid": "09e47283-5d76-4ed5-a0ab-0a68f2ee6f6b", "comment": "Malware payload (RaccoonStealer)", "value": "99dbf72cd1b1a301dd538c2b8ebebd0d771cac3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555648, "uuid": "d47feda3-bcbb-4d15-84af-91bfce6717ae", "comment": "Malware payload (RaccoonStealer)", "value": "533f561069e0061a9dfdf5574350a0102e7163793a67a8ccacc78976638f017455203c75c575c05960b8743b9cc0099e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555648, "uuid": "b2944dbc-3918-4376-aba0-b81a1f065d60", "value": "T1F2D4C000A661C039F5F612F44DBA9EB8A52E7FE0672450CB52D52BED97396E0ED3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555648, "uuid": "1dea0143-a012-4c59-b89b-19944e7c4e7c", "value": "bd3694527adf0e2f58ae8cb4e18ad5ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555648, "uuid": "6015a289-3c97-4238-86bd-31cd0b937245", "value": "12288:JUvW8g/mRplmUbH7tg0FzEfdW0l6+UGvgVBgMJL0EnFCl9KrNr2/NuLvQSCg:JR/wi8bVFzEfdWC6dGvmgUCA2/Nub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555648, "uuid": "082fb01d-e547-4f1e-b337-b75f90c6a9c3", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555648, "uuid": "4284a11c-a136-44d2-986a-3e8293e30b3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555648, "uuid": "b3433240-61a1-4259-b095-8f7480058e31", "value": "f75bf9d3ea194bee098497c14bc53ada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f42daa7-302a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634571962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571962, "uuid": "a4c94d36-986d-4db8-b45f-7739324ec9d0", "comment": "Malware payload (Formbook)", "value": "d6eee4d764d2c79132ff4dee0ec08c8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571962, "uuid": "d9ac4ada-e4fc-4839-83ce-190f785845df", "comment": "Malware payload (Formbook)", "value": "3f95e7795f8c0b70983561a48425e735ef7832603543980f460b1356403ec622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571962, "uuid": "065922c7-881c-4d82-a7ed-adac0520d157", "comment": "Malware payload (Formbook)", "value": "3ea04975f148b98734e9d962d714851af449836c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571962, "uuid": "f89d09d3-fe44-453b-8a08-526fc22531f4", "comment": "Malware payload (Formbook)", "value": "efe291e3be43493098d439b4a0246ca9774b66c629be52e2922045773784d9dc4d69f9aa65aa333421257ca10485e691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571962, "uuid": "80c06131-d540-433e-9602-c63a6eb73208", "value": "T11E34AD5C72B0917BC5BE9B313969C37C06323E143DBE914E31847B6E1BF26A28D5A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571962, "uuid": "1be6261e-22da-48e2-913d-2ed98a1ba3eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571962, "uuid": "22bc1604-2944-4054-8423-7f090b410735", "value": "3072:3xbvvUAVfUfcbk6VdJ1OgvHi40mMFDuj3EQ3Qpt13Q3aJ:BbvcmUfcbk6VdJEeC4NMFD0EQ3g4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571962, "uuid": "43ffc0bf-8a76-4b4b-9255-7d5b53546710", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571962, "uuid": "e546ed43-838a-4e0a-8def-72de751afc3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571962, "uuid": "3d3e720f-28cd-4ec4-ae91-785ec0719ecc", "value": "ORDEN DE COMPRA-34002174,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75e76a5-3060-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634595356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595356, "uuid": "aa377a70-d891-4f7e-9ac2-193ce3864bc0", "comment": "Malware payload (SilentBuilder)", "value": "034d3b8927eb90521267ca102fd27595", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595356, "uuid": "9b638efa-6916-49bc-a89d-fc2772e9e0a9", "comment": "Malware payload (SilentBuilder)", "value": "3fe4756c00b919c56c2e76fed9d8651ec816aeacaad628eac2090a17e32e00b7", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595356, "uuid": "4e158cb2-6176-42ca-a6b2-a2d31d808e73", "comment": "Malware payload (SilentBuilder)", "value": "842b4a9f379381c0b5b60fc4efbb9c86fa053344", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595356, "uuid": "a530d319-3835-4082-b0b6-b4b90bceb7db", "comment": "Malware payload (SilentBuilder)", "value": "a0b7da5ea1588d56ebbbe4d0b20ab2171a131bb44121a24db8b5e0ece302caceaf647d5f7d358a9edfb285408854e4b8", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595356, "uuid": "f15047f6-4439-4390-9726-3db99ecf86d3", "value": "T1A344E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595356, "uuid": "96b2741d-1b13-4647-9174-dc1e0f8a8522", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7G:U9jFrjmkD7IvLDK3vLvfn1+28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595356, "uuid": "96629192-9016-476b-a133-7f4f0a3dc7b2", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595356, "uuid": "2863cf8a-a98a-4a5e-987e-26395c677ac2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595356, "uuid": "b66e75a3-5115-457f-868d-a3b617c9dc53", "value": "034d3b8927eb90521267ca102fd27595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560f6b0a-3060-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634595086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595086, "uuid": "04a1eb91-49b5-414d-af53-fca3d6a14bbb", "comment": "Malware payload (Mirai)", "value": "b53e5b6aa47f71f52e5ada4ca6f77c0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595086, "uuid": "3f635807-8b0d-4f8d-9767-9e9c3a53012f", "comment": "Malware payload (Mirai)", "value": "40179beafaf3dfd80d0bbb68132ebf7486080dbfb54810edd361604db5f00f46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595086, "uuid": "4ef3aabc-bfa1-45ac-a836-d02dff18ba1d", "comment": "Malware payload (Mirai)", "value": "64906709343872d6cd98413f44bf83f84c3da93b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595086, "uuid": "82f3a23c-1429-48df-8827-63ee41d3a879", "comment": "Malware payload (Mirai)", "value": "3ed72f8c7e91194fcf6f7a2fef9a93f88419c868665df9528b2a9a8f734dc81016a6dfd60e18824a3b056e2db2c8af81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595086, "uuid": "4e42e460-14d3-40ad-852f-671e3e7c9a9b", "value": "T1EC638D22F8102D51C82152FAF4B4967DE3521DF542A61C726DCFE65904BFE8EB84E7E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595086, "uuid": "8b8b4e84-1e2b-465d-9bfb-349a791b73fc", "value": "1536:oUl6NHDKS3Xc3p06TTY//HKPZfQkbOl0r:oUl6NGUXsbTTOfKPZfOlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595086, "uuid": "a54ea41d-8cfa-4682-bc0d-97d22d317e41", "value": 67452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595086, "uuid": "39e553d5-013d-4507-aa57-371e1dddb766", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595086, "uuid": "c3023aee-55ab-4e97-9fb3-3c5cd9fd693a", "value": "b53e5b6aa47f71f52e5ada4ca6f77c0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c10b5a-2fbb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634524159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634524159, "uuid": "c4f44f2f-0eb3-4be8-b223-06d7eb3a0a2c", "comment": "Malware payload (AgentTesla)", "value": "0a319fcaff75155af14b98f3292a1b1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634524159, "uuid": "248ae387-3b03-41c8-8609-b2d647f4b837", "comment": "Malware payload (AgentTesla)", "value": "405b3676366ea03fa6a3673499137339c4abe643b9d73eb027bdd7bb255788de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634524159, "uuid": "f6dff953-2619-4d91-9947-553f0b83cf12", "comment": "Malware payload (AgentTesla)", "value": "0a15198b36eea03b3bec2e599e8c5cc8830fc6b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634524159, "uuid": "d30c0e9c-909c-4f74-b3de-91578bb0b266", "comment": "Malware payload (AgentTesla)", "value": "a9f6fb00433eaee23a611b2cbe52b941483bc87f828e33ab61f87a407e9705d0320599989b02e3e866d4f2bcbb3d5693", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634524159, "uuid": "5483c973-9f55-4305-be02-8152770accd3", "value": "T189A412A6B794C117CABC06B4A0E1E3B473B0F9322EA9CF565E5D38DE5D72B400E90563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634524159, "uuid": "8cbddc58-c24b-498f-a6c9-691c59bc676c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634524159, "uuid": "353b5619-8b41-4e76-86ac-85d329661b2c", "value": "6144:G3kJbU1JhQdf/65DMXqCFdxTRHDiK4KhrR+gAj3dDpS3GsLl4hHJjvY:IebU1/oKHIdxTNV7b+gAjNDk3ziJjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634524159, "uuid": "06bb5dbc-0689-4452-a3c5-5f9d6166713e", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634524159, "uuid": "4a2d852b-62ef-4888-bf66-39189c1cbf4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634524159, "uuid": "1df4e8a8-d6aa-427d-98c3-0360d0f0fbb6", "value": "Status of Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2deffd2f-2fe5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634542190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542190, "uuid": "60071f83-3169-411e-a4e6-11ae03284c82", "comment": "Malware payload (AgentTesla)", "value": "9ab5d41177cb248218b0719c61cde879", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542190, "uuid": "63767d9d-f237-4170-a50d-663cb7b055af", "comment": "Malware payload (AgentTesla)", "value": "4125f2eb7af619c5a6dd3603246f22310995e7bbfb8bc03e032ca74bd8243fe1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542190, "uuid": "9b1c3ec8-6fe7-4611-97df-846e19cdaf0a", "comment": "Malware payload (AgentTesla)", "value": "c23845b414b8763a02e1e6fa5b5d4632402123b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542190, "uuid": "c9ea2758-8698-4fe3-a923-b728a167e9d8", "comment": "Malware payload (AgentTesla)", "value": "817b801355cc440d007210ea101a82f4b3becf071f10706431fc37dde6d8504902b031031dea82582ad9da4115119810", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542190, "uuid": "8d1e04d1-b81e-436a-a0ab-42baa451791d", "value": "T15184239F960AA5F3D91FEF4C6916303C5B78069EC9C2958212456DB7E1C01CD2A7BE0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542190, "uuid": "1117b3e5-9828-49a4-88ab-563149b90a29", "value": "12288:QwbwNOxSG0TMiTQHnbJ2A0lIr3UO5Kh6hy3fq6JSfA:Qj8YzhQHbX3gkhypJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542190, "uuid": "6bbb1a9d-c6f9-424f-9613-f0777f6b92c8", "value": 402120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542190, "uuid": "0b771f8f-e465-41b5-9aad-8aeb18945db7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542190, "uuid": "216332df-7461-44cc-90cc-1de9caf3f009", "value": "70654 SSEBACT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae21300-2fd9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634537326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537326, "uuid": "2d925648-a03d-4e72-a6d4-45d5bae49041", "comment": "Malware payload (AgentTesla)", "value": "081964c37b284b77cd71ce356461d1a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537326, "uuid": "8d8f899c-8e75-4b81-ba0a-d381173e303e", "comment": "Malware payload (AgentTesla)", "value": "4149ed81619e6fbe482cc898f5d5796a4bbb50cc2e7c0f4abe02e87d0cc0c77d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537326, "uuid": "590df15a-8f27-4e91-a730-2173368769aa", "comment": "Malware payload (AgentTesla)", "value": "117aaf0d5581a1fa05182af43866f07eb33f20fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537326, "uuid": "4b7448e8-ac82-49aa-9238-5a725811232b", "comment": "Malware payload (AgentTesla)", "value": "6c47241c46f14f4e7afb03ac5c69dcca79170bc83f83d24b32e6bde3bfdc7255af0bfb0d878c30632909ddbcda22a299", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537326, "uuid": "7f73ca8d-a5ef-454a-809b-f8051352e9e2", "value": "T1B6451606A7B47F29E43DB7B96930540483F0B415E7A1DA1E7CF5A0F916B9F044BE2A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537326, "uuid": "49e75888-1b77-48bd-bc90-f68b17abe70b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537326, "uuid": "d2c5b2fd-f913-4f81-a774-64a60660148e", "value": "12288:YaeRPiwoNdSUTEbDUjFKK1w9y6b76q/tc9t7JQmoo:aeREcZy06bcDQmoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634537326, "uuid": "6e5b6b6b-56e3-4c6f-ac94-bda643bca2fb", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634537326, "uuid": "c74b8e4d-94fc-48d9-bbfc-53c5eb6a7172", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537326, "uuid": "b305b6b2-f6b4-4e2c-9561-492803cb241c", "value": "081964c37b284b77cd71ce356461d1a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a140e5-2fe8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634543599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543599, "uuid": "c3c3ddc3-8669-4c29-8a02-2c17ec0e6de4", "comment": "Malware payload (AgentTesla)", "value": "7864fb0b03ee179f129ac268e9c1e6c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543599, "uuid": "7f6b5866-347a-405d-8940-b4a299fa1086", "comment": "Malware payload (AgentTesla)", "value": "4248a8c899ffd31c3b3771124b5aa9ddc5320bf5b4c274990969a663cda33c01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543599, "uuid": "8baa94cc-6f83-4c1a-a57d-de755017085e", "comment": "Malware payload (AgentTesla)", "value": "b2c5fe1cdd6b50563d88d74ba4c2a5070401110f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543599, "uuid": "f3353594-bfb3-49e4-9449-33b30ebc8cd1", "comment": "Malware payload (AgentTesla)", "value": "e2db5526e7ffdb97ffc56366321aa75f8bf3eb6c17ff80fc28f0264c6e1472a03311d13195ee119ef267434d04c4d000", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543599, "uuid": "999f5e01-5c97-4870-b745-5cd8990e77f9", "value": "T17C45B615B3DE689FD457463240D019A39E003DB2A51AC32EEA7379E719BDF814B08BDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543599, "uuid": "c3e94984-9b56-4543-a45e-ab7c284e98fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543599, "uuid": "ba47ce8c-f93c-4a18-b1f2-b284ad4af671", "value": "12288:Ha9y2jffBSkkkkkkkkkkkkkkx9L+kIkkvkkkkkkkk7ZLXRckY8PDsMm9fbzV0yI8:2DklIbm1vM4Oy9kao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543599, "uuid": "613e22f7-7e79-498a-97fc-5f3d9e405c34", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543599, "uuid": "ed4e9d1e-9c79-4115-8540-dbcd2757bd97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543599, "uuid": "6cce63e7-001c-4e9f-92e6-745d5a681a5e", "value": "SWIFT MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc15476-300a-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634558403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558403, "uuid": "af502bb8-4c5e-490b-a12e-e690864d4119", "comment": "Malware payload (Smoke Loader)", "value": "580fc5cd72d7979040fa1c4866ada3d0", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558403, "uuid": "e4bb4b99-2f7f-433d-9f2a-af36cc9ac1fa", "comment": "Malware payload (Smoke Loader)", "value": "42e7ef551c652a5e6f0ff919fcb53cd2c34682006cb1436295205a41abec6589", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558403, "uuid": "6fb56ca9-5fbb-45a7-b306-94734d13c18d", "comment": "Malware payload (Smoke Loader)", "value": "7da202d99be94f57f355c611bafde9656bca65b7", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558403, "uuid": "f51d112a-bf97-47bc-9970-266bab0c5339", "comment": "Malware payload (Smoke Loader)", "value": "7448308c5d683717c5b75dc5f4114f5df9243bdd548a2670c800f8c41819b63a676f9fd9d517e42754992b7b04f55926", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558403, "uuid": "ebd6ca82-38ce-4a1c-b1d7-216a27de6d13", "value": "T169746C00B690C039F5B352F88AB9627DA52E7EE16B2490CB52D516EE97347E0ED3035F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558403, "uuid": "9f744793-3cae-45c2-926b-0721901a3f1d", "value": "b4cda15a674ef12000829b9be50880b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558403, "uuid": "9b1ecddb-fc37-4bce-8e48-2b93dfdb0074", "value": "6144:3WbmUi7XUPNWmWPYRCuuWouCd0Oj12zOfG6/ksyfGhQ+J2Y9u/:3WbmUizUPomWQRCvWoumtj1iOfGbs+G6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558403, "uuid": "a3c9b043-2d52-4571-9118-4fb2bda34899", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558403, "uuid": "3d97bf64-a001-49c8-9ee4-b18c138ad6bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558403, "uuid": "b8a0a8de-1c75-4113-9167-7a179b12dd60", "value": "580fc5cd72d7979040fa1c4866ada3d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c3d952-3005-11ec-843c-42010a9c0014", "comment": "Malware payload (Xtrat)", "timestamp": 1634556263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556263, "uuid": "c09db017-2dc3-45f4-8840-4a6372a853cd", "comment": "Malware payload (Xtrat)", "value": "f97ee2a5b3396760e99dbdf533d464dc", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556263, "uuid": "8f0c65b4-d4da-462d-a263-35efdb4159da", "comment": "Malware payload (Xtrat)", "value": "430fa057a8749ccdcd4657254417da11109ecec0ffec3c661c80cab88a6c73f0", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556263, "uuid": "f911d5fb-caa8-4b39-819a-0cf94849d7a2", "comment": "Malware payload (Xtrat)", "value": "ed1e8747c16083b32e68b62e7548da7c09675e56", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556263, "uuid": "721e8262-2784-4f65-b850-4ac94dd33756", "comment": "Malware payload (Xtrat)", "value": "98e15c308c5b97cc2a4ca2a1bb3e17e58c9e903f476b66e3cb5fafd953edd738d9250beba7e55b09568a612cb66e81f4", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Xtrat", "colour": "#7CF5D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556263, "uuid": "f69d6695-5322-4857-9b80-5444cd593a3b", "value": "T175A2E13EE55FD1F2CFD799B71A9E306E343D124D1A020AFB3414EA0CA1BAC290A5C95D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556263, "uuid": "d43880e9-3139-470e-9dad-cd16753d33c0", "value": "384:dXPE1mX0mSkOLvfnXbAU0tXCcDGNcEBB+cu6s3svUF/oYmq1w4Pxzlorsx:VPE1DmfKrAU0t2cMBd/s39F/d1wUzloA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556263, "uuid": "c73748fa-945b-47a9-b0e5-9383d7a22365", "value": 21806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556263, "uuid": "da27ea74-ec91-45cc-932c-48359ab33179", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556263, "uuid": "9eff2d54-7f2a-4d55-93de-f64152f63d14", "value": "00833233 Acesso aos Dados de Carto.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cd66d0-3063-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634596486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596486, "uuid": "86bb46d6-0cc2-4fc7-80d1-0aafbc00c8cd", "comment": "Malware payload (Mirai)", "value": "802f417b1cfadda568de8888ebe8a6e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596486, "uuid": "7fcc9961-f10b-4087-bf41-940c5b1e42c5", "comment": "Malware payload (Mirai)", "value": "4363c4f88c14156c9e112fcce91663c6f7797f5c7fc60a22bd3f699702850739", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596486, "uuid": "226feece-65ff-433e-ba15-1af9239f82c4", "comment": "Malware payload (Mirai)", "value": "5fc385876191c7437d68b1d9fb63da6bc84c25f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596486, "uuid": "a4d29208-42b9-441e-bdd2-1129a9664ee6", "comment": "Malware payload (Mirai)", "value": "af920f3cf3571651c170786ab746bdcd413964866e4f8141a2dbdb100985f081b1db1d303df237837469db96ca4b0e93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596486, "uuid": "7b2e0f32-23de-4cd4-9719-9006f2e183b2", "value": "T11093185AF8815B11D8D926BEFE0E118933535BACE3EE72129D145F2037CAA6B0F77412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596486, "uuid": "557f7732-cb1d-47e0-a755-fe16b4c5badd", "value": "1536:xrngex5PZKtKncKSKWKOIP3S6ym4SNwq4JazntFrQ61Btalyc9ida+kn5YY73Zl0:Jx5RKtKncKSKWKO+3SFmxaqWazntFrQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634596486, "uuid": "e49f3ea2-7176-4418-829b-6f7d04a7980f", "value": 96596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634596486, "uuid": "5242d457-9049-44c0-b768-91082d332ec2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596486, "uuid": "88f6a5df-99c5-4bf0-95c7-c578e1d00b3c", "value": "802f417b1cfadda568de8888ebe8a6e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d72aa9-2fd4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634534826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534826, "uuid": "888bb0e8-ce12-4700-a932-46fc26039826", "comment": "Malware payload (RedLineStealer)", "value": "042a6066d9d10bbbf7de5503eb76157c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534826, "uuid": "d0c98acf-a778-4738-9646-e86881a21e95", "comment": "Malware payload (RedLineStealer)", "value": "43bf339f8d440b52a1a8385223ff7c15674952c020325c5839c99a8291e97512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534826, "uuid": "2789cfbd-e2cc-4e98-9276-ea1b8e33864f", "comment": "Malware payload (RedLineStealer)", "value": "b141a1aa941781564eed45370c3d900f7957735b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534826, "uuid": "852cbb54-b9cc-4e97-8aba-79e0da7e1479", "comment": "Malware payload (RedLineStealer)", "value": "4fe84f1e71aedea4d5968561e7fe9d2f7de9800db2d7c77d1c65900c9e0add78663b6ac3d0f3c87f5c2c7a33210b8717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534826, "uuid": "f0bbce94-22f1-48e0-87ef-e5f0d2d99b4a", "value": "T19B949D00A650C139F5F652F98DBA92B8A52E7FE16B2450CB53D51AEE97357E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534826, "uuid": "c12c4d2a-ef2d-4be4-9bbe-f6e8f5b2bb87", "value": "bd3694527adf0e2f58ae8cb4e18ad5ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534826, "uuid": "5d4bf0ec-e062-4ffa-8ee6-5259081c2b62", "value": "6144:X9fvDYyH509RoL0p+y+xJGOALwFdkJm6Fi3rQUyES99F:X9nDYC080p+TxJGH0dkJm6FiUUtS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534826, "uuid": "857c39f3-0ef9-49b2-8a1c-0f574794d2b7", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534826, "uuid": "a0670e89-13dd-405c-9718-5c0d1676691d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534826, "uuid": "31087718-6c3d-435f-b8f5-7204022c8c2e", "value": "042a6066d9d10bbbf7de5503eb76157c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5437829c-3055-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634590358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590358, "uuid": "196bcd73-f189-4081-aabd-adacba7d0962", "comment": "Malware payload", "value": "012e070fb7343a002506974adc39dcef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590358, "uuid": "8bbd67cd-6493-4b0d-bcb1-d2823891e12e", "comment": "Malware payload", "value": "4428c955f11bf14ee87a1c6540314b9f24f6adbe848724dab4029242fef22137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590358, "uuid": "f48b8d1d-fe93-47fc-99e3-1bb9cac5e355", "comment": "Malware payload", "value": "e75c8ab934161493c347b2d4fa553de49bf51169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590358, "uuid": "26a9d0c4-86cd-4532-b04f-4c570b8020fb", "comment": "Malware payload", "value": "387edeab46ea07d9d7027f97277fdbcec9ab70662649a311958ca490cd9e3a91144fe9baddf88c936b6d35e853e5bc86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590358, "uuid": "15361132-3514-4078-b426-466dddf9353a", "value": "T1859533115F1A1CE0D47E0EBE6AF846A9E4285E9C46E0A5A72187F3522F1CD2FDF00757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590358, "uuid": "79dd6373-c153-470e-94fc-f74b992739a6", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590358, "uuid": "5aa2476f-4cc4-4097-bdfc-3e46d84cf456", "value": "49152:idB7cScxVB5tHJv+mhH2DkNHPanMLtDoweoSmTjW:E7cScxVB5tDWDG7iLoSmnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590358, "uuid": "76cc4697-eee4-4b38-ac72-7bac7228f875", "value": 2050048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590358, "uuid": "69cdc8b2-186f-4903-86d8-2c230ce2c502", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590358, "uuid": "1f598874-0691-430f-899e-622a5cf067b9", "value": "Config.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24368cc6-3005-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634555918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555918, "uuid": "19b54e4b-355a-4350-8200-069e96541157", "comment": "Malware payload", "value": "f0486b7bf9c0b74234289a61d15e74bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555918, "uuid": "d64d9f9f-5d5f-40e3-b8ac-3e1cc8f53baf", "comment": "Malware payload", "value": "4449509494a4d95644f527d782eb194c742af78ef0b5d08b8d34c2a658c0af40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555918, "uuid": "4a51aceb-c9c3-40a6-be16-d7a9c14d59a3", "comment": "Malware payload", "value": "fcb53895159c929c4701b735a5494734186b764b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555918, "uuid": "41c59be4-d906-4d92-8350-7b44ec8cfea0", "comment": "Malware payload", "value": "fcbdacc7a0901af054d2abfe6c22e83cbf57089ef434a4958c6e6d22e08b17799a876de97a6f49538044b4263b9ba01b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555918, "uuid": "cf41ad27-3284-4da3-b01a-c478a8e55119", "value": "T19FA4F1193028AE67C4A401F48C3842D71FBEB9574520E3CA5ED5BDCF3AEDB81C52AA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555918, "uuid": "1321e236-4c7d-4fb8-bbca-31666029ea93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555918, "uuid": "1933f0ef-3eda-447c-8047-d7d30d7a7676", "value": "12288:6U0U35zGuCquTI7UAWBBK338ezl8LSZKfVwnhhUrnVxU:6Gqrg9WBUh8LSSVw3AVxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555918, "uuid": "94cb299b-5b44-4af0-aede-f97fcfa44a50", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555918, "uuid": "e0d04b5a-71ff-4fb0-8a87-662239e9db4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555918, "uuid": "dd914618-36fc-4975-92b7-dc2a1e62f43b", "value": "L8IHQWFozXPUPpA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b0afd3-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561267, "uuid": "24876571-8edd-42fc-99aa-9cb0159cecff", "comment": "Malware payload", "value": "86d3a24eb2cbbbbcf51e7b5a9084af58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561267, "uuid": "26a53152-7dfa-4533-970b-4ca648237e4d", "comment": "Malware payload", "value": "44cf97fb109f84ebb361e89cb4a65f9bf80e4645f7e8fae75ee40ba4d29fb32f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561267, "uuid": "8efd9c9b-32a1-4d1d-8ca7-34c59f6eb513", "comment": "Malware payload", "value": "1a3d3765008252978aa8d192bb5cab49551bb663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561267, "uuid": "dc6d06a2-6d60-4f27-8e99-e61644a15182", "comment": "Malware payload", "value": "fd756f758fae177d3aec8401c4d97584f170d5ba4cc28d66480402fc653db8a280fef894083eef767a97f5375ea64a4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561267, "uuid": "d7a00fea-c049-40df-a796-d8b517be4731", "value": "T1B1A4F0D5B224EC57C5A502F480B7E59313725D2B91A2E6C76DC0BCCF3AF9B81812DA87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561267, "uuid": "2f3b78f4-8f85-47fc-9d1c-3493e4e25849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561267, "uuid": "0414e308-e55e-4961-a195-d2ef87f7c352", "value": "12288:7xPm18GEFMMfeND7FFW54qsS2x8txqzjK5:7tjcDZe4qsS2x8txwjK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561267, "uuid": "c9b12489-f298-4d07-b4da-e6e066ad93d8", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561267, "uuid": "d1752e2b-2d35-46b1-b929-996b3272810e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561267, "uuid": "21d1a3cd-d828-446f-805c-aff74bd0976c", "value": "PVH-LSCRW180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17abbfdf-305f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634594551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594551, "uuid": "f7e59a21-a8e1-453d-a3cb-ca22e8165760", "comment": "Malware payload", "value": "58798a346a3e2938a8b333978e36d6ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594551, "uuid": "e9d9ad7c-5965-46a2-8ed9-66f0b0e06f97", "comment": "Malware payload", "value": "45bd7ca68c999b2a4285a3fb80344ec1e8cb25d9b9152f756219c2543f81b10e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594551, "uuid": "18cd882a-d072-40c6-a10b-74d781e42483", "comment": "Malware payload", "value": "0e104ecbe807adc68e06b8515fc44af79c45402a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594551, "uuid": "ee1a2513-0af0-480d-893d-91c704582b2a", "comment": "Malware payload", "value": "2c30ebd74b3a87155ecc93f7549945b4b3ea3e14c71875fa51051f3ab7921dfce6b3e6378330acf0e91c5576b382d45e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594551, "uuid": "7fc3b285-6ee9-4ba2-bae7-e027e8c93d1d", "value": "T15315079C726076DFC857C872DAA82C64EB6074BB931BD203A01716EDDA0D99BDF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594551, "uuid": "6023481e-4e73-49c0-8204-1f7189980d8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594551, "uuid": "1face3b2-cb31-4008-a827-8772ae3664af", "value": "24576:g5Ff4a9CnaC88HmUubGCf5EkUl6OxEW+vNbOGEG:gDAa1NUGGCfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634594551, "uuid": "3eacf840-0c4a-4320-b33f-5c51b828fda4", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634594551, "uuid": "8ce60c20-fd76-4e42-98a9-1f016c7fdd0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594551, "uuid": "351aff52-8f6e-4f5a-a756-c730a4305d32", "value": "Paint1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f25026-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568433, "uuid": "5394b17f-42c4-4adc-bd23-206b60512826", "comment": "Malware payload (Mirai)", "value": "0628697538e7be2f99aa73244228db5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568433, "uuid": "ae9827b6-42bc-4409-b88b-26b84faedfe7", "comment": "Malware payload (Mirai)", "value": "466b5eb7df2802cb26b9cb8ac6d249a00039cb34f6a86b1a27676aeff6649f93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568433, "uuid": "78e92992-1426-4d8c-9fd1-453a08112787", "comment": "Malware payload (Mirai)", "value": "c0c4f00863618a6731f7310cd4c3f160c18d5b9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568433, "uuid": "cfdb6f91-076c-465e-a362-f9cc43016438", "comment": "Malware payload (Mirai)", "value": "21e12ff62c332ae21f687bb382eb50695770ab43f1e1a0db2beb47490a5c903deffc5ecf0db5b6c41a02445779cf8902", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568433, "uuid": "5ee299ce-ca3a-4519-9d31-35b422639010", "value": "T16613E02CFC4881C9CA2C50F905761FA52BB04FF2BC437DC64989E69B9C954B974A3BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568433, "uuid": "51fc4a9b-6431-4a86-b438-910f0f4ec555", "value": "768:Hdc72pH4U2rVEpM/xOPgh1F6TU7lQmj0WpGdYP0qZXrYNYndq965YJgGlzDpbuRB:9c72B4UB6xOPIF6TiVj0WpGBqZrkYnd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568433, "uuid": "7dbb13fb-f382-41e4-ab75-ad52e74f1642", "value": 44236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568433, "uuid": "66e99577-6ea6-4c26-9ca2-22b2b3e91bbe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568433, "uuid": "398b9dc6-4f06-462f-8a54-81b8f663165b", "value": "0628697538e7be2f99aa73244228db5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27176a52-3010-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634560647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560647, "uuid": "bd1de854-991f-4e06-aa6d-cd854f55a075", "comment": "Malware payload (RemcosRAT)", "value": "bf6bcbda23200e2bb0b6acc4fd744ad5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560647, "uuid": "a111f0ef-cb6c-4462-8e98-c474f9bbf377", "comment": "Malware payload (RemcosRAT)", "value": "466f914dcfe4bd5ca22f2748ccc4effeb03378c7cf7f9a089de910311176e1bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560647, "uuid": "bf411440-a290-4004-84ae-799273ba3409", "comment": "Malware payload (RemcosRAT)", "value": "70be1fd2bbf78fe8fc2d45c771802e3159cc001c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560647, "uuid": "2ec71f49-51d5-4edd-aa84-6c1821d601a6", "comment": "Malware payload (RemcosRAT)", "value": "4dfe55db3d54bdfb33c6a7b9d63db620065e2d9a8b2b3223b738e3d51566ab94fce359e37c9b2a84d1df6cec1287c37f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560647, "uuid": "f433005a-6c41-4211-8c25-0ce4b4201e34", "value": "T1B9D48D0164B1CAB1D173123A0FA9EB71B5BDBD2029214D6BF3DD3D5EAE710C0A62536E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560647, "uuid": "049daf90-c49d-4fc6-92aa-9e720d935e19", "value": "fd2a350e6b9d34ec5cf88c61afb9d41f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560647, "uuid": "8457c194-f29b-4067-a4f9-78d51385713c", "value": "12288:hEYDoAU/U3AVE2gNrY9iH8+1YMfZlAAeG7a42:2YkAU/6AVE2Urp8+1dZV90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560647, "uuid": "3a0b03f3-7f62-44ae-9a02-f2d6bfd4c7b1", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560647, "uuid": "ef25df3d-fcae-4cc9-b017-4212acfef00e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560647, "uuid": "4d0c336e-f2de-4b0a-a585-b3cb9e7925d8", "value": "bf6bcbda23200e2bb0b6acc4fd744ad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a6160b-3006-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634556593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556593, "uuid": "b445a35a-8a34-4d7f-ac37-6b7160e6ad80", "comment": "Malware payload (Smoke Loader)", "value": "363fece1255b4dd7f688225dbc090e8b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556593, "uuid": "6f1aaa33-3e22-44c0-9ede-5c5e812bb356", "comment": "Malware payload (Smoke Loader)", "value": "477af70aacb75d845210fbb00fe37d4c6bd22422ed62dc859ebdf1dc93433c3a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556593, "uuid": "d421eb44-72b4-4df0-8944-35d08efbe199", "comment": "Malware payload (Smoke Loader)", "value": "624e505f3b828e0f27bd8c2d82687def04ea63d9", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556593, "uuid": "703ef1c1-fe3d-4ee4-84f8-36dde7f0ec57", "comment": "Malware payload (Smoke Loader)", "value": "7232a69f43ed43070724711c399d20c94fed02646240a5c835573e3f6107fc42b9bb677c15fd902f9e2563d0ace25146", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556593, "uuid": "2a5a196d-051a-47a4-b699-4acc02c0e19d", "value": "T19C448E30A7A0C035F1F656F849B993A8B93E7EA16B6494CF52C51EEE46346E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556593, "uuid": "c396f361-6c18-4472-b639-992b27d02ff8", "value": "b2b1ce057c4a3ad8c1ee685e46521866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556593, "uuid": "7fb91f5e-4d36-4569-98f4-3a98678d8910", "value": "3072:j0jp77ySS1p9kJY6VFNrHvxd9vnb62Ok37SeMz9A3p3SHgd/ktSosZEY5XdfcmMC:MSwpd9vblHWe69A3dL/k0oaXV/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556593, "uuid": "36404095-a01f-4cc8-8422-c9167b65298f", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556593, "uuid": "0929e1a7-8de7-4608-9dee-8fbe2f7ef59c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556593, "uuid": "099415bf-a3a8-43ab-842a-b65721de345f", "value": "363fece1255b4dd7f688225dbc090e8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08163f6-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634561388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561388, "uuid": "9a8a2577-4065-478c-aab7-59081130a7da", "comment": "Malware payload (Formbook)", "value": "02872d44e47404752a4a34bbfbab961e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561388, "uuid": "64c1473f-1627-42ed-8e33-48c0e916a86c", "comment": "Malware payload (Formbook)", "value": "47b09ea398ebcf4ec0091986cbba1c846bbbe12a7b4423763d6c50352137e937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561388, "uuid": "97e106c4-2371-467d-aea8-e3e2cea10e4c", "comment": "Malware payload (Formbook)", "value": "a72fa0ba595261c45b8e04580777b48849e80684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561388, "uuid": "815eb9db-9908-418c-9631-e03f8243d2f4", "comment": "Malware payload (Formbook)", "value": "babd09d184d1fdf6bbe9b40a3b094c2fe400afa5bb55b159f04aa19bf3305e90eb1b00c30bae214288781be6d1508c84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561388, "uuid": "50782372-b3f7-46f8-9bec-768dfa21efd6", "value": "T13B25120532EE0B29D6FB6BF6987264124BBA7D6B4872D31D5DD620CE0C23F904DA1B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561388, "uuid": "8c76eb5a-668d-48c6-a3e0-a85a9fb62834", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561388, "uuid": "bee0cc2d-7852-46eb-a13f-d77766c99153", "value": "24576:HWFOB1PrF7TyTp/IEWN69v2CzXhr0EoLI56G2pY9SPW3:/B1Px7GpgqOCzXhrToy3YES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561388, "uuid": "abaf7c07-e6fd-4ec1-bc2a-496734cf3e34", "value": 1032704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561388, "uuid": "d6b59e6f-a065-4a2a-8091-df3bbba257c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561388, "uuid": "2a6d4a55-703c-4549-9163-b64e27fba6b7", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c717d05-2fd3-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1634534430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534430, "uuid": "79bcdcca-71a1-4f54-a561-20afa891df80", "comment": "Malware payload (BitRAT)", "value": "eb7e5970f2f476dc3333f3a788e62ec0", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534430, "uuid": "187d2dbd-2a41-4964-9797-cb05053785b5", "comment": "Malware payload (BitRAT)", "value": "482ba9ca86a9cd8058972818f56f650a92776a6e0ef5b21145fca6423f71f38c", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534430, "uuid": "dca896ab-79f5-4865-8724-ef4b86439f88", "comment": "Malware payload (BitRAT)", "value": "3f05ff09af98916f9e8e84d4e4cb6477da722230", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534430, "uuid": "8bbf1861-bbb2-476a-83f9-80a3e44caaa1", "comment": "Malware payload (BitRAT)", "value": "3ab1e37b70bcb2dd399ad8c7f09be1b07d9539a130c5d0cb3c7e7879575074f6695efddf0efff57171e19961ce470f9a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534430, "uuid": "f79ffefa-3ca8-48de-a043-2821ec2743fe", "value": "T1F46533E15B0EE73AF65ACC3CB9A61D13CC78D56065B749027E6CC4FE60FEA921844C52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534430, "uuid": "b7e8c63e-4d94-48f2-a4c7-6fcb3eca589c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534430, "uuid": "39a6a657-7799-4794-ab44-605fe4f1b254", "value": "24576:yndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkz4HGd42SYf:kXDFBU2iIBb0xY/6sUYYxHGWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534430, "uuid": "4eee319f-81a2-42c9-a66b-abc31f60e69f", "value": 1511424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534430, "uuid": "b0826f74-061c-4aa4-9ba0-4eaa8c04dc04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534430, "uuid": "fdbd8025-8fba-44a5-aec7-b60052b78054", "value": "eb7e5970f2f476dc3333f3a788e62ec0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ae3917-304f-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634587789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587789, "uuid": "b825f9a4-2491-4e41-8b9f-ee2c1f250178", "comment": "Malware payload (NanoCore)", "value": "70cb56c6c5c12806d8ab9ec9cb9f9721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587789, "uuid": "0b6eb45c-2752-4498-86e7-e6ccdd96a853", "comment": "Malware payload (NanoCore)", "value": "4838766d4fa1bd049a8d49f32865f1ef93a56b0ffd5f5fe4fb3401e6329ade0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587789, "uuid": "149acf01-b0dc-4f44-acb3-2c4d8ee8f5b6", "comment": "Malware payload (NanoCore)", "value": "9f112cd0766ee8fc0cb64506de3549aad9d75625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587789, "uuid": "cdb42ff6-b129-4bef-ae65-17946a23af60", "comment": "Malware payload (NanoCore)", "value": "bb9272595ad1094d15ed18a76ca1f964a3997bc70f0865ccf1cb46c5c085fb3bbc200c1d43781a0ad1284bbd99162f6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587789, "uuid": "bb965427-d319-42e2-baf2-6d6b9527ea56", "value": "T164351202B7E68832E07319329A2577515E7D78305F259A1FA3E4896DEF356C06238FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587789, "uuid": "23e5a152-ed63-46eb-9be5-416853dfe38c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587789, "uuid": "b62d4d03-c602-4c52-8ab2-f175464dc4bd", "value": "24576:rAOcZEh1IvGG7YFFeJIowz5B1I1sDx52gWbh9dl5:tPipaFDow5BS1sDxIrtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587789, "uuid": "7d5aa55d-856e-45ba-885a-610c3825d963", "value": 1131372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587789, "uuid": "4fa381e0-eebb-4fea-a914-ff4fc52d72c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587789, "uuid": "059db5e9-7318-427f-82aa-0b03176baf29", "value": "70cb56c6c5c12806d8ab9ec9cb9f9721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2281f14-3010-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634560988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560988, "uuid": "305a1036-2612-466f-9271-fb4441c849ba", "comment": "Malware payload", "value": "78d230ca55a0775337fd965834da854b", "object_relation": "md5", "Tag": [ { "name": "Atera", "colour": "#6EA25F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560988, "uuid": "c3aefd66-30ef-4d10-a54f-e0503b31f958", "comment": "Malware payload", "value": "483cdc0f656b77ae3092c5b0bf56d6e710e223f4185d7903da043b239c92978b", "object_relation": "sha256", "Tag": [ { "name": "Atera", "colour": "#6EA25F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560988, "uuid": "4c68302f-d3bc-454e-a3c9-abcf949a4263", "comment": "Malware payload", "value": "ad47fdc1d73d163d61d69fce30dd65a2750ee72e", "object_relation": "sha1", "Tag": [ { "name": "Atera", "colour": "#6EA25F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560988, "uuid": "b386c399-57f2-4177-a50c-a1b3ea6c489e", "comment": "Malware payload", "value": "e740d07888df2909f935b2457333779bcf70ff1b12e918878fc6aa85136eca20f70e2108f740fce1e699564b74c8d1f2", "object_relation": "sha3-384", "Tag": [ { "name": "Atera", "colour": "#6EA25F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560988, "uuid": "57563560-e335-4f48-a8e8-ce0943f79214", "value": "T184D4F1217544883ED7FA0932A93ED6719F3CFE241A20C99AC304B90D6EB44D16BB7776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560988, "uuid": "4338cb8d-3634-40ce-bcb9-03c32ce6aeef", "value": "12288:cs+WC8R/Mn4c6b3Diy95fP701DpHyNRAX7PaeAkCP437+8jOZy2KsGU6a4Ks:uWrBMnsO85fP701DhyHreAzgLhOE2Z39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560988, "uuid": "9e108e8a-ffe9-47a7-a33b-5ab1c3df47e4", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560988, "uuid": "5c3153ae-7a3e-4f42-8670-0a244dd9ed36", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560988, "uuid": "9a570c73-be81-4458-889c-be6718436e38", "value": "Dike_Infocert_upgrade.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d8f4e8-301f-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634567384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567384, "uuid": "39568531-bb1d-492e-92fb-9b2589fcd2d4", "comment": "Malware payload (Quakbot)", "value": "89141c9ffcbb60880e8187aef83c935d", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama117", "colour": "#2CFE58", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567384, "uuid": "5418232f-df05-4f61-8f66-6a17fb0f842e", "comment": "Malware payload (Quakbot)", "value": "488aff5976e8fee5f941b9ad61214565723c5f7b324b5d26a978abd336d321da", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama117", "colour": "#2CFE58", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567384, "uuid": "cf6bf098-22b5-4bfe-8edc-fe32e54c63eb", "comment": "Malware payload (Quakbot)", "value": "d8f5e0e230889afdce67de83caf12122187887f2", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama117", "colour": "#2CFE58", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567384, "uuid": "adfe509c-7daf-400c-a826-e49452c21a1b", "comment": "Malware payload (Quakbot)", "value": "811d56675efd8156269b927a2c3e02a14296772915a1c1df67661efe2878b0f82ec59c0d7216695bd32e835bbda29d39", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama117", "colour": "#2CFE58", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567384, "uuid": "b63d8b69-67a1-48b9-ad05-9c5f9c36021e", "value": "T14DE48E2031A0D022D027743FDD64D1F81AAA7C25CE686D8B36C92FBFAA7D5C18E1575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567384, "uuid": "de66ff46-f767-4f0a-ad0a-b4e5cb72d495", "value": "eb572005c7ed222abe0041104347212e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567384, "uuid": "5eded68d-15bc-4bec-b73c-8e382cb76eba", "value": "12288:1rI0bPKn8p/S0jXgfFWVkMXl2xAgwFX2dpG83tNzZ0XssC82H6/vLy2MA:VI0bP1XWMXsAZX6tcTLFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634567384, "uuid": "406b4f45-1010-485e-99b7-467f78d7838e", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634567384, "uuid": "4c33e238-6f5d-4398-bda4-75563899cba3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567384, "uuid": "d395bc64-67f5-4536-a41b-db405d9cc049", "value": "44487.5969353009.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04da2d6-3028-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634571185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571185, "uuid": "fc4de64f-55d2-4c7d-a7cc-5fa7140c812e", "comment": "Malware payload (SilentBuilder)", "value": "8de2a1aebaabd30c1dafc32a2b8051c1", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571185, "uuid": "c76a7f10-0c66-4c6d-9026-3f1b4f5909a3", "comment": "Malware payload (SilentBuilder)", "value": "48f22c89e0ae6af708acf019bca1f8f7a7b389bc16ad8b19efcdbe3a1deb86d1", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571185, "uuid": "96bf5c1e-4ffd-4b86-957d-2b2f2dd4274c", "comment": "Malware payload (SilentBuilder)", "value": "9a8650298d9feec27340acb0efaefa20232da5af", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571185, "uuid": "5347d168-f6e2-4ea7-838d-1aaddeb4205e", "comment": "Malware payload (SilentBuilder)", "value": "75da73a07ecc3e154983fbec4628cc15d627cb92b990682935ea99298f474f0d26ac4b46cd45d31803ae0971b265c005", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571185, "uuid": "7935e426-0707-40c8-a9b0-3f36cea04c00", "value": "T15744E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571185, "uuid": "1dd6a133-4988-4de1-b84d-f2b59e34deda", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7I:U9jFrjmkD7IvLDK3vLvfn1+2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571185, "uuid": "64ca06a3-2efe-4919-adcc-3f46a74f3380", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571185, "uuid": "2ba67323-1267-432d-9584-4db891238fbc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571185, "uuid": "45f405f8-287c-40b2-bf88-34ceb7f5a88a", "value": "8de2a1aebaabd30c1dafc32a2b8051c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530a1d41-3024-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569311, "uuid": "5e9faa0a-78e9-49f0-8346-0af4c7028501", "comment": "Malware payload (Mirai)", "value": "619036bce1825fe66c271abe9eeb5b73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569311, "uuid": "589b4af8-69f8-4a2a-ae8e-222b40869b13", "comment": "Malware payload (Mirai)", "value": "4971534c065711c5456a1cfd790d35dccf5d8c799cec93c73d33d0e7df596353", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569311, "uuid": "820e3cfd-326d-449e-9bdd-a87b7bf45f17", "comment": "Malware payload (Mirai)", "value": "6681da5c5c134b64f760429ea4cf61bdd86a877c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569311, "uuid": "3809d0a6-2802-464d-9794-708ee6eb2f37", "comment": "Malware payload (Mirai)", "value": "c037dc6ee24dd943e63b06c613f8e2a2c17dfb8a7edd4e5df00a014caaf06c1cad845181023279b43222c7e4b4b4d370", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569311, "uuid": "8c1eaea4-76a5-46e7-b2a6-bedbb435afd2", "value": "T11B23015174849EF083556E75B49B8D57ABB5F3C8926F3691AA380F39A8D08CE397C0C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569311, "uuid": "7d52e800-4597-4183-97fa-b95218252600", "value": "768:dssAwxfNeStReYLAXxmEVOR5zeY0s3eAvUjgi/oRjhNyOh0mVJX/SHW3bUcdfz9H:YwNZOoVEV7+3eAvPiU9N/bVfocdfyL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569311, "uuid": "18ab28d9-fd8d-4561-a417-b5bf7bd4e0e0", "value": 46536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569311, "uuid": "56f48a5f-f1df-4446-945e-5b7a0d9895d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569311, "uuid": "b485a549-233d-47e2-afe8-49d000dd5480", "value": "619036bce1825fe66c271abe9eeb5b73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5416497-2fc5-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528673, "uuid": "9614ebc3-8a25-4ba1-b8ab-373e0b658c6f", "comment": "Malware payload (Gafgyt)", "value": "3dfc4019c1761f552a9b4d41d34e6d5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528673, "uuid": "14c9d1cf-868f-42bf-91bd-70ff60c782ac", "comment": "Malware payload (Gafgyt)", "value": "49a74095e2815960cd5197accf770d8a6c3f426a270b2c0461384590bb437524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528673, "uuid": "ea7e2f9e-7e59-4be6-afa2-516357d5d568", "comment": "Malware payload (Gafgyt)", "value": "f2de57fff0eb88e1c8273a510d1577278f16960b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528673, "uuid": "fde49235-f984-4c17-bf5b-8087d1c1d3e0", "comment": "Malware payload (Gafgyt)", "value": "d07112740ef791b1ad83bb6b66e0fb25898411bc7e62f2a60ca2e97e4d7fead9864475e8dc0b913220910639f4c1fadc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528673, "uuid": "665fefe4-27ff-431d-b51d-3c4647e99370", "value": "T12B933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528673, "uuid": "09ed0d32-083e-4834-846e-29ba10aa3c14", "value": "1536:myqmiTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emAGMUNLe5um7WAgcVjmZIcBI:myg2UVUtBUI8GwPfHkk8rGeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528673, "uuid": "f1af76b3-ab38-46a2-b56b-e5b0b5fd7402", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528673, "uuid": "1e25d6b7-3309-4c70-919a-974d4ba6c70b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528673, "uuid": "90abc966-9b7d-4706-a548-b0f3884adfec", "value": "3dfc4019c1761f552a9b4d41d34e6d5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45000aa4-2fd6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634535786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535786, "uuid": "9f744081-2f0b-448f-9b38-1da893177e54", "comment": "Malware payload (AgentTesla)", "value": "9e944f39542cf55c8cd0513307c507e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535786, "uuid": "8c3efa33-73a1-4190-bf53-a6014e0f5660", "comment": "Malware payload (AgentTesla)", "value": "4a5d34fcda47700161c2fbc4ee64713e81e563d04e319b7a48e52d778e70e4b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535786, "uuid": "65c44f34-40ff-4ce9-9201-47df1c54af35", "comment": "Malware payload (AgentTesla)", "value": "5dc457b12d42e9a91ba4ef70bbbf35494399cef7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535786, "uuid": "70a599c3-10ae-4fb6-9f22-341c2dc5b8a4", "comment": "Malware payload (AgentTesla)", "value": "624e2d35c3d1c270b8060af09b999e77c105380f6812cfca205626ab1f43476cc000f346efd35ecc8d531716d7f16fe5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535786, "uuid": "8871620a-cc54-4d24-a01a-cf981c130e52", "value": "T16B54122723A08873E11399B1BC6E2F6BD3B6D2050025A5AF23253F267D11BD7CA5B4D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535786, "uuid": "7894b064-9e81-4df4-824c-1aa7141f017b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535786, "uuid": "0286c96f-db6e-48e7-b4ce-4bbad3c6e5ce", "value": "6144:yBlL/DD0Pe1TC028jhtxQC/hNe9bqSex1OzlH/:4hwW1i8ttrrim1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634535786, "uuid": "595c76f1-3b73-42c6-a234-72b5fc72098c", "value": 284598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634535786, "uuid": "89ce2836-e614-4f91-bedf-9005a3097292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535786, "uuid": "d1e9ede0-0cea-4af8-aeed-d831efa45b13", "value": "Shipping Document PL&BL Draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23df4fc9-3042-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582116, "uuid": "734bf06a-df67-4730-a56e-1bc3d2351501", "comment": "Malware payload (Gafgyt)", "value": "f665b23c48eb87e3b524f34d2f9f5a54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582116, "uuid": "74c7af6d-21be-4fc5-967e-dd4717d75c92", "comment": "Malware payload (Gafgyt)", "value": "4aa7f5e93ce67499d2bd4ffe963565265935b191207f9dc9a0a3ef15aa93b07f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582116, "uuid": "16fe2534-779d-4984-90c2-09a071720738", "comment": "Malware payload (Gafgyt)", "value": "07a85ffbcb8455bfebc88a3b83fdd5b46cee18ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582116, "uuid": "7a31ed33-a47d-48b9-8fb5-840606107bd9", "comment": "Malware payload (Gafgyt)", "value": "f6fd90632a28a8d5c429e971677300228cc1e6fbfea05352f2de3757dfd487ffaeb610cece01fac40dabf6a5f58e0a76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582116, "uuid": "bda16827-c1d6-4cf3-b987-174442bc65d2", "value": "T107832A42F646C6B3C4430AB2029B9B560932FABB0E665E55F36C7CF4AF128C57127F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582116, "uuid": "08bd2011-1643-40f2-98bf-bc323036a5ef", "value": "1536:3TO7bSPJWVjRWHW8l9gfW+M0MXxGLUpJetR5hzddddd1wbtmYHc0r6jmVfKXd:y7bSPJWVjRWHR8OF0MhGLUyT5h/qtmUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582116, "uuid": "ec226d45-e661-4e0f-817f-f8343eb0969e", "value": 85756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582116, "uuid": "4f2cfbe9-90d5-4a52-b903-1644b8d582ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582116, "uuid": "72c4e3d1-c810-47ac-83ef-19f7f7946fa0", "value": "f665b23c48eb87e3b524f34d2f9f5a54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87bcddb-3058-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634591842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591842, "uuid": "5ba83826-4909-4f71-9af6-7e2dc27ec7ed", "comment": "Malware payload", "value": "8043aaa7e52aa679354252db31fae9b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591842, "uuid": "449e9d2a-3c31-412d-9bae-511cbc6e2929", "comment": "Malware payload", "value": "4b65d2994a5df65ac893bfc03f1d052623ec387f974798654e593db284d4dfe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591842, "uuid": "04f4eea6-a099-4313-bf04-64255bb0fa74", "comment": "Malware payload", "value": "68221513bb666ea948e15b8cc7b301ca9bab0c13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591842, "uuid": "274412e9-a4d0-45f4-8158-94580b7db479", "comment": "Malware payload", "value": "f3b4781372d16118512fb3587139c2379a77bbb6a8a9bece0f0073fbf58d152e5ce007133317f3e6f55441c0695be2c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591842, "uuid": "4e3c1ff7-c20a-4ace-baaa-d798fc104a5f", "value": "T1C9D533013EF584BAF4921972BEA97F96E096E39CDC9288933344832C1BBAF55C33515D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591842, "uuid": "f06e21b7-c243-4f21-a42a-a397bd498634", "value": "e00de6e48b9b06aceb12a81e7bf494c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591842, "uuid": "954db135-d137-4758-b4ef-f82b0c54641e", "value": "49152:GG5UfgBTFurx12F+zAaSHV2wopAma07VDWktrGuDUlv/9TNU0LXeRINBNn:GG5QgC1lEBHVDoVa0R6mBUl9u0KRkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634591842, "uuid": "e7d07edb-6fdc-4f39-98af-f252077fbeb5", "value": 2921144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634591842, "uuid": "c7b4ef0b-04a9-4685-af19-c859acb2bc20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591842, "uuid": "12df644a-1d32-4b2c-8862-c771137b145a", "value": "script_hack_412.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b7e608-2fd6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634535892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535892, "uuid": "9d401489-5936-4049-900a-b9829d1e2d6b", "comment": "Malware payload (AgentTesla)", "value": "393f89477fe3d6aabb74cb7ab0c889fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535892, "uuid": "e01ebd9d-0a59-4884-a42b-b62aa8d851b5", "comment": "Malware payload (AgentTesla)", "value": "4caa07b5c1075d0316e76251c1e95b36dce7be3c737e7e4947cc99a3e7b484f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535892, "uuid": "7d9df188-756f-44cf-a499-593fd5ae5026", "comment": "Malware payload (AgentTesla)", "value": "9c08992baeb0373c0996ad09d57abec3d761427e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535892, "uuid": "99d92106-dbd1-47b9-986c-c1b072797692", "comment": "Malware payload (AgentTesla)", "value": "2cfdbec7bfeb83cd402a429519ffb7fa16955d208458218ea19b7009a076a377ea9a973e66a68b10598f0853a2b5a8ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535892, "uuid": "ca6fb7b8-94e1-46e4-82ac-4970b3fb6240", "value": "T1C3E412446B1C101FC93A5E7A991E224F37B7C99269D2F29708E3F6A716F73D315022A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535892, "uuid": "58a87929-dd05-4a50-87cc-acadc58ecd2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535892, "uuid": "7c23ca1b-8003-45fa-8f5c-6fa6e2cb08f7", "value": "12288:0QSBJbqw5O2Ese+eYzp4QJzBN5W5dWtFLvBtcLzcHRELJq5rMsQNrCMeyX3ob+eV:KBJbNONEBrS+lt8si8iruynobb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634535892, "uuid": "9f8cb04c-ced0-4cec-aab3-6ee718c5c5f3", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634535892, "uuid": "dfc7b57b-9c29-48c6-892a-55d69f72e8e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535892, "uuid": "2e46dff7-7cd1-4459-95e1-cb8e783f9f8c", "value": "t4IMlwZMoIeKGQL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdcdeec-3054-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634590183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590183, "uuid": "45c8740c-eb3f-4455-9902-5b9ad1211f2f", "comment": "Malware payload", "value": "7962ef8fe859a3936d7629b138f190ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590183, "uuid": "b93cfe78-2a73-439b-a6db-6edf78b32f7f", "comment": "Malware payload", "value": "4db98fd82c7587c5a3c69ecb7574596aa411cded0cbf8f623dd15c3299e0a30f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590183, "uuid": "8eef7cab-af4d-4c43-995d-86efb53b7f8d", "comment": "Malware payload", "value": "06a3d533611c6cd8ac1509f00a3a881671f6732b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590183, "uuid": "c8bff5d6-f55c-440d-a80e-e60511808075", "comment": "Malware payload", "value": "bccbfd408549ae47f3bac6b3b954d9f181f3d5502dd0c0fc93085fd042c2fd38c46a9c211be2f126da21ba59e7576df5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590183, "uuid": "bb46f123-c84b-463b-bf02-a0fbb0774c93", "value": "T10494252864BFC01985E3EEA52EDCA8FBD99A55E3640C743301B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590183, "uuid": "a7097d86-160e-49ac-a23f-a647ca61f209", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590183, "uuid": "804fa47a-129a-4fce-9bcb-305b74ae4ed7", "value": "12288:Xhhl1EF+iEYvpbWC7dr2Strplg9KRblbS1:3lG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590183, "uuid": "4b355e45-9577-4ce6-8ff9-4ca6d0cc6e27", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590183, "uuid": "546d57ac-4a54-455a-8f28-5caaa84430f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590183, "uuid": "71ed23da-6687-448d-8141-5b30210cdf34", "value": "Static.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3e7fe4-304f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1634587850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587850, "uuid": "131263a3-b0df-40a0-80da-2c73f0ebf8a7", "comment": "Malware payload (Gozi)", "value": "22877606fe4c8e6f35345ae13554f5e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587850, "uuid": "ca31ece9-a9a6-4f06-aafb-d704147e5319", "comment": "Malware payload (Gozi)", "value": "4ddacac68fd062781fece1e92b3f1682d49fe23fc812e721c330f25237f4c20f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587850, "uuid": "532b7241-1adb-43cd-9f9f-b16a6be2d1ae", "comment": "Malware payload (Gozi)", "value": "a426b2b71cd8c019f8542b8f6fcf6943b0237b5d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587850, "uuid": "eb0ab1ac-e4fe-4966-981e-b79eae59f08a", "comment": "Malware payload (Gozi)", "value": "897835883caca45681b1231e127da23e98e7eb1536da6892d5578b149c3ac31dbc797b1153b74648cc0569cdde9ca4d7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587850, "uuid": "09cd5ac8-5eb2-47d7-9c70-0439c2d3262f", "value": "T1BF947C1033F64431F1B3433A48B6D1405AEDBD629A70ADCF32C52A4D16BB6D19B79B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587850, "uuid": "7890442f-395d-4233-add3-b9e9ac937d75", "value": "c27496098b0c2dd1f01696b972897787", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587850, "uuid": "169b8ee0-05c4-4f3d-ae98-764f8fc0b591", "value": "6144:gFvyrc/+PEa2S+sTZs/EqyHYO0f9YfGQMQavPeTCzLNzrkOXCxuXLl:+KZPEzs2/vygiOlFmUtzMu7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587850, "uuid": "5ca301f2-e57b-412a-abf6-f41c8b6ff9ab", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587850, "uuid": "9c3693d8-839c-4643-a63a-7de4e6c88bfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587850, "uuid": "157a2f35-84c3-4b76-a34e-aee962bd2c72", "value": "22877606fe4c8e6f35345ae13554f5e9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af387433-304d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634587075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587075, "uuid": "bfcc14ca-6497-4666-a106-a17d9106ab69", "comment": "Malware payload", "value": "558ab1f37a1f1c97be45955d7e0134c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587075, "uuid": "1b3fd9cd-e755-4d85-93de-ae49b86b27f4", "comment": "Malware payload", "value": "4e005541f0869dedc1e4aaa2810ad9ab6b1515d206426ecaab78eee201dcea10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587075, "uuid": "09c13a86-2f2a-43aa-a990-4a15f12fd55f", "comment": "Malware payload", "value": "79bcf2c1b50d512a5e9936a5a208d7d3dcf21a33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587075, "uuid": "3f58142b-e755-4477-b6e8-bc6f4547a46f", "comment": "Malware payload", "value": "01576a537fc3d93d2bd3741759bb099693239a6a86862e109ddc8d11ed7faa1474aec7d473ce166b7ef289efc31ec88b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587075, "uuid": "703030cc-786f-4131-982c-684f1f16df06", "value": "T193430B41AA418B13C1D32BBAF7DF47697B21B9548B9B33017A297EF42783BDC1625321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587075, "uuid": "a4aed05a-7567-40bf-9e54-eeadf2c96537", "value": "1536:48d2+74vI7byToji+WPXL62Rx0QHQO45Xer:A+7iAGT0WPbD0QHj45Xer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587075, "uuid": "a0a79c4d-c518-42d0-ad89-901df1567268", "value": 58560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587075, "uuid": "7e64e146-1b1d-47d7-b701-7e81f4f4dc40", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587075, "uuid": "3a54f910-4f92-4dc1-bd34-60965967054e", "value": "558ab1f37a1f1c97be45955d7e0134c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9235adf-3006-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1634556597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556597, "uuid": "ce2edc98-2f17-4590-be1b-d8e83f089387", "comment": "Malware payload (NetWire)", "value": "03f5ded5cd864b924a530c7d30b52466", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556597, "uuid": "0f9251db-0efe-4a56-a1d7-57c72f295778", "comment": "Malware payload (NetWire)", "value": "4e9bdfb5333105d8c8ebacb89c352372978eabdcd17f9a23094ac05c519a9b54", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556597, "uuid": "cdd96ec2-f052-4f5d-a0d9-6997bbc65e84", "comment": "Malware payload (NetWire)", "value": "05ba9469a781fe337fe5898be495358f4ec1ad65", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556597, "uuid": "96f860d8-9d4e-41cb-a694-fc8a5c324092", "comment": "Malware payload (NetWire)", "value": "536d0983e1281e0c0d6e78e4fdff8b2fc809dfd499dec4ab5f73f8f0ea13446f92114ed4e1595f1b25b1bf3bd7de4c4e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556597, "uuid": "ddd8b9ce-1240-4607-a0b3-d33c9cb6a624", "value": "T1B892D187F859E64E58D7F2C721D6A838BA5084E72BC623121FF86007351EEB7AD36444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556597, "uuid": "97c76f5f-95b0-4578-82e5-1982358adb22", "value": "384:V2POg+uw3j3Gq7U5avkCIc8DOMAjHVHbryAfuRK0ks+cy76JgKrh9p:V2PPw3z6acpcGpwR/yBQA+c06JgShL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556597, "uuid": "2347dd12-4927-48c0-8e79-ba939b9d4594", "value": 20826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556597, "uuid": "7eb6caf1-6c45-44ee-9b16-268cf2a10727", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556597, "uuid": "e8a0d3d1-9b34-4a63-aac9-5272a447cbc8", "value": "Details_File_Copy.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982e03dc-2ffa-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634551388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634551388, "uuid": "eea417e0-f605-4aa4-bd33-1a4f1217f317", "comment": "Malware payload (Formbook)", "value": "7ddf9139b29b7b35647dfa9e585023de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634551388, "uuid": "c933101b-4d4b-43d6-806d-b180b7809f2f", "comment": "Malware payload (Formbook)", "value": "4e9cb6e83b7ea6e353bafe82262c6b1c1de8a5fb5517fa8bd8bd80b353ca472d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634551388, "uuid": "0ebc35b8-dcf4-4f06-b50e-73971ff62cfa", "comment": "Malware payload (Formbook)", "value": "ff9455ae69b531bf1864ece4ab90dd8186f1ae28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634551388, "uuid": "b1dc8a43-785e-4ce4-a32a-bcff57f81a9e", "comment": "Malware payload (Formbook)", "value": "c41db07aa297272210d316f34e2fc14279da4befde021eb540a8e1e050675205801654586b8ebbdb6b32c63a2cb49ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634551388, "uuid": "a25df629-a94a-4123-9975-8065a94c5b59", "value": "T1DF8402027B98C567CE2D06B5B4E2E3A027B8D5717B01C75F8D8834DB2E72B846D90A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634551388, "uuid": "68dbfb7a-0f4d-4e8e-8028-bf587b192c4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634551388, "uuid": "560d2f42-14d7-4066-a06d-3f8d0cdbbefc", "value": "6144:agwqt/BtMSCT/xmu9DC1pZbpUhiGYcpskR+8O57P7/CpYQCbszjY:AqSSEUKDC15BGJekR+77lQ94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634551388, "uuid": "93e9cfc0-b4c6-4e7f-972b-9f117ac51951", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634551388, "uuid": "a50f1687-76c4-4593-ae9c-68570399040a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634551388, "uuid": "5f8787cd-c64b-42a4-ae41-3a50c0bef68e", "value": "Diagram and Specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e32956-3050-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634588247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588247, "uuid": "2e1ea6c0-f166-4c90-b27d-6c9fe9cdf0a8", "comment": "Malware payload (Loki)", "value": "e77e7ea25ddfd54f329c9d4427f331b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588247, "uuid": "f88c7226-61f5-4463-8947-1f0456c7b4f6", "comment": "Malware payload (Loki)", "value": "4ed734e9759f4c0f6da12c3863ac192a5ccfd0493b5cb4a045c7466791bbd154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588247, "uuid": "ead5941d-a64a-4d0a-81f1-0a289343a287", "comment": "Malware payload (Loki)", "value": "e62abe4c13a0e6d572e24671d30dcb3cbc1ef914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588247, "uuid": "076813a4-e14a-46af-b8e2-cc75c78e2403", "comment": "Malware payload (Loki)", "value": "e5a8d914218cccc94e5e6a95e3db53df60b65bb109c6feeab6cec29a9664703dd78c257ead0d119ff09db2721b322306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588247, "uuid": "9b5a8fcd-7a4f-4d3b-8e84-afdc0bc76891", "value": "T17C3412B965D248F3E0D656709BF6CBBCF27E661A2011629B8330DF7B38335C1562E246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588247, "uuid": "4855b66e-3cbb-4f78-a87c-db8e34c7f881", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588247, "uuid": "ef9e9f6c-e89a-4761-8b77-6ffa8ed00575", "value": "3072:wBynOpL12riocLMChZvGXvVbqE2OldeiZ2ekytG/XL6z6SU8DUROTzeppTEZ6Oa0:wBlL/cCh5GXvNXe2rtVz62sIa+rAWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634588247, "uuid": "4d42a42c-16a4-4d76-b891-e7eebc3946ee", "value": 249177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634588247, "uuid": "e4bfe562-38b8-4242-8702-0c91d60420d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588247, "uuid": "37e87af0-97ff-4a19-889e-5146bb83a51a", "value": "e77e7ea25ddfd54f329c9d4427f331b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7470c3d8-3059-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634592130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592130, "uuid": "ee4ff718-08ad-4895-bae7-28f720f99b3d", "comment": "Malware payload (Mirai)", "value": "fab3f28b5582ff8f8cf1ab8faf3b997b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592130, "uuid": "0bbc2c4d-e6f2-4501-92d7-2c0434233f27", "comment": "Malware payload (Mirai)", "value": "4f22867b3136f66405946b1f725928ef45beb575c68bb3a3b90973e17ae1b4c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592130, "uuid": "aee71916-21d2-4971-a1a1-17c7373801fb", "comment": "Malware payload (Mirai)", "value": "067e510299b8be0e1af48394875fcd72b6c30f96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592130, "uuid": "d5cf71fe-4fa9-47df-8ce2-b856a18bcf4f", "comment": "Malware payload (Mirai)", "value": "c67c8ab75900e4e3e1afc6c59ee097717c63980dbaca6b0faaa4bbfe32d0d07a9618eab8289192162b7d425c088f12e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592130, "uuid": "09a43a73-851a-4b5d-8518-584cb832223e", "value": "T1CDD30892F904DFBAF04BA37604D30721A770BFA10B935636732779A3AE365C49827E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592130, "uuid": "7f7bb73c-b658-43c7-9cea-28f7b4ca5f8f", "value": "3072:xQ7yh8qt/pA/Uar9ub8xxNP4oyYR4EUdJavmqcM1JDN+iuxX:x+C8yBA/nrA47yYaEUdJsmqcM1JDN+iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592130, "uuid": "95094509-5884-42fe-881c-cb1e7668f2a6", "value": 142164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592130, "uuid": "5a192a6e-5da5-4b7e-bbe7-d16ff0f5aa6a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592130, "uuid": "78fa9e17-d382-4127-a7ec-1ec7547c0199", "value": "fab3f28b5582ff8f8cf1ab8faf3b997b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8432d0-301a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634565005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565005, "uuid": "40bd0a9e-9e88-490f-a116-2c3bac8fba9a", "comment": "Malware payload (Mirai)", "value": "b35b5d3fc6e31a1d71521530884d3999", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565005, "uuid": "c02e1792-283b-4233-8619-62737c3be2b6", "comment": "Malware payload (Mirai)", "value": "4f3f1b0c5b29010be675bb58b06610d35e2766ba91197b708b8893812a43ab19", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565005, "uuid": "0f4135a6-8f58-4fa4-b861-c3c8a9c17317", "comment": "Malware payload (Mirai)", "value": "866cf9ba1be3982a16ef61a621409a5867420823", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565005, "uuid": "478dcada-7fe1-469d-a604-a6796f4b16dc", "comment": "Malware payload (Mirai)", "value": "544aca2b8aed84e8be03671ad24a23c07fe6d6fe88d0139856e23f21597adf427357f3ac050d70b7ba02f60c07c20625", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565005, "uuid": "372a35c8-072d-4cac-b444-54f2b3f304a0", "value": "T199735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E61625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565005, "uuid": "f0e29c21-79ca-4acd-b4f8-0f54553f803d", "value": "1536:b/DYQYs1ZokODichz+15UzOHIt09bfsH18ruUGDKVQSi:zDhzUkODichzcUzk40h0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565005, "uuid": "b7d61268-5e96-4028-af63-f1f66d4f7286", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565005, "uuid": "aaa286a8-21b2-4642-aca8-1c99f4b6ef40", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565005, "uuid": "58a2d202-f692-4f62-b150-2eb19208667f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddc466e-2fee-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634546378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546378, "uuid": "d512029f-1590-4544-a50d-b2a64a44926a", "comment": "Malware payload (AgentTesla)", "value": "a00323d66feb6d05cb3cfc28ff8c79a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546378, "uuid": "966ffc5f-e0c0-45d5-8a65-95a5c56897cc", "comment": "Malware payload (AgentTesla)", "value": "4fcca1bce2dd80a24a9def40ab28cc5197e8dd477c2ef77c4d47a19b73fa8bf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546378, "uuid": "565f7b95-daac-449b-9e71-ed6111a19c59", "comment": "Malware payload (AgentTesla)", "value": "50cb3fa623e7a92553512d4b26f797ed23eab0e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546378, "uuid": "ff3b3374-a505-48a5-980c-509b1943d043", "comment": "Malware payload (AgentTesla)", "value": "23176fd24af63b169fd6a706dda8db74463b547460cba857e686dc41023e0c0035a49e07508f904bb8a1a41656d315a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546378, "uuid": "f766470c-adb0-4f13-a9aa-d27526e6058e", "value": "T17B32D0F8FA417788D02EDF351CB221952DACBD19F1C4520FBF1D364426F1BC64960088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546378, "uuid": "5ba326ca-9c8d-4285-b35c-858b53a6dd96", "value": "192:97XqRf7fuRf/dSX49+KsBHa5QOmD/h52FpbNVIKUxaLNPpGpSwxXP5XOv:9cTfo1SXWnsBHOs/h52LJVIKUwNopSwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546378, "uuid": "bf6dc957-ab67-4bda-8d52-0092b9628800", "value": 11431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546378, "uuid": "060929b7-1e26-485e-abcd-23e90d57b3ee", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546378, "uuid": "71f0c806-cfcd-446d-877e-5b8fa5b4bfb8", "value": "Shipment Details.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec3e4c5-301a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634565009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565009, "uuid": "35d3e64d-8707-425e-a457-8540b4fa9526", "comment": "Malware payload (Mirai)", "value": "8a3a71dfb3627403a56fe5d2390761d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565009, "uuid": "f80673bc-5489-445c-b34f-0e310b3620e8", "comment": "Malware payload (Mirai)", "value": "5059fb34f94196500a02f3cd00e00252046023173af3551d9231b5d76e937442", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565009, "uuid": "6b085d2f-aaea-4601-927d-aadf284a2d27", "comment": "Malware payload (Mirai)", "value": "7f8535f30ee237d33b694159af0d20127ba76b28", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565009, "uuid": "ab4af3e1-fa2d-4ec7-a5fb-9956b4320c2f", "comment": "Malware payload (Mirai)", "value": "54de6bb4ffe4b6b7dfcf09d2a90580a1be2840cbcff417eae07ac7ddd7e188081fe4d9383a30ea1cbc5b14793423fbd5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565009, "uuid": "3d1b121a-2fd5-4801-96f2-636a6efa69d7", "value": "T1C5431895BC82DA12C6D4237BFA6E418D331663A8D2DF3213DD222F517BCA82E0E77551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565009, "uuid": "caba0912-5147-4b43-9004-82b7c1ccccc5", "value": "1536:KAPynxsLz+PPjTd8RMTtkLNvM57Ut5YNz:KAPGxsMjq069M57Uw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565009, "uuid": "a19c4912-f148-4439-b830-b8e42f9672b9", "value": 59580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565009, "uuid": "309caefa-0339-4718-af25-85b8c1617f19", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565009, "uuid": "4c86caf0-b569-41ea-89d9-7c84b1760d95", "value": "arm.light", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594ead22-3060-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634595091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595091, "uuid": "2bab2940-3dc0-47d1-bacd-cb564d92b3c4", "comment": "Malware payload (SilentBuilder)", "value": "7c152a53b31f16b40e06d951a41aeb69", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595091, "uuid": "4c5b461d-98f4-4a8b-9b9a-49da2768e419", "comment": "Malware payload (SilentBuilder)", "value": "505cdb0ce13a353b51d88c5d86c04d6e12fe9ab3145a2756d549c2b2e81a42e7", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595091, "uuid": "5ac92471-abb0-4e86-8471-b2f52fe783de", "comment": "Malware payload (SilentBuilder)", "value": "4884ca586832dc57b641cf1c8e479be603f51a90", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595091, "uuid": "12488016-b457-4ab3-ab93-0248e63bc0af", "comment": "Malware payload (SilentBuilder)", "value": "190807a0efecf9d9a41c1fb79f6110dd203b930b6199f562b156f7aa9ce595e8d6766615191dd24f64ecf40e2a82f87d", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595091, "uuid": "649d43fa-a54e-4247-9a04-2197ed106eab", "value": "T17944E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595091, "uuid": "88c371bc-617c-4e26-b8ac-35e7993395e8", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7m:U9jFrjmkD7IvLDK3vLvfn1+2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595091, "uuid": "f430ff83-fac3-4609-b1e2-31880c448245", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595091, "uuid": "f2a5d029-d426-49eb-8a1e-3968d604e8b0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595091, "uuid": "fa835fa7-d24f-4471-a7aa-84d64b842e1e", "value": "7c152a53b31f16b40e06d951a41aeb69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5c14d0-304e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634587578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587578, "uuid": "d3879a2c-90be-45ec-ba64-30bd737d90d4", "comment": "Malware payload (AgentTesla)", "value": "92d46dc497cc7f6fbb8e8dafeb5004c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587578, "uuid": "69bf3835-0927-4f4c-9ec0-0e593f6df40d", "comment": "Malware payload (AgentTesla)", "value": "506909940f55e0c21e273759d8f7dcc1a3d76ea0374f212008ce871d706f1fe6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587578, "uuid": "8cf1396c-c943-4869-8d98-b41efbc36732", "comment": "Malware payload (AgentTesla)", "value": "f2fce89e6f5f7d997f190d8d4aafefcc8048fbea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587578, "uuid": "84c05fab-9785-4717-95ad-8224376aaf31", "comment": "Malware payload (AgentTesla)", "value": "367312b55943f21ce5bd986f2bc5a5ba30413039f3ff6b1a646e2673fa359a2d9fde10b74be093c8acd76f47da24af6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587578, "uuid": "31882749-3734-4b7d-8289-604e7b7a844e", "value": "T177A4E1157225CF12C06246FAC47EA0570BBDBD139491D2AA3ED57ECF3A62BC34814ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587578, "uuid": "eb0fc648-0dc5-4efe-9839-224602971572", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587578, "uuid": "623e72b5-2589-413c-8509-48690f0943cb", "value": "12288:YWnb573GL1PVlPHtRVmI5tD8HYsrGxKR4hg29V:Lofjvm2IY8yM4hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587578, "uuid": "ce50f896-2cbc-433a-a6f8-0b6d182a65d8", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587578, "uuid": "c51f1d76-734b-4f60-9016-83c4f53fd883", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587578, "uuid": "9c1d80e5-9244-4c60-9913-ef6038965f28", "value": "HSBC Payment swift Copy emt 103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9d1b19-304a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634585564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585564, "uuid": "e34dd48a-1bf2-494a-acfd-40186059559f", "comment": "Malware payload (Mirai)", "value": "ff0e7b40d724b0169eef029f4ac379e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585564, "uuid": "1eee0975-0f80-4445-9b7a-f1d1c585efab", "comment": "Malware payload (Mirai)", "value": "507bd0543ec1d2648f1ce4584dccb7e7cfb7cfe3c0f3f41ebc998dd376294b96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585564, "uuid": "a0732bce-2eb4-4986-90f5-8872f73d4d7c", "comment": "Malware payload (Mirai)", "value": "d531588bc33c520d67ae96539cad5f04ad855f17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585564, "uuid": "d2da4259-0536-4562-9e46-b78ac08bc214", "comment": "Malware payload (Mirai)", "value": "23f1a0c5778f49f6388f680efe035d2bcbceefca7fcb746c68eac34e430407a651ae5ccfd3df4557e33f52c9d661ab72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585564, "uuid": "d4eb57f1-d471-42b7-8d7d-e7e1364db358", "value": "T1A473A70A7E329FACFBA9523447F78E11AA5833D527E1C585D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585564, "uuid": "ef36e496-570b-44d8-ab95-0003ec735c09", "value": "1536:3IHb8FMv77EKQHly1R1Fa6yBm3froxvdeEOPFal:Y78ivnEKMyZFa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634585564, "uuid": "a0fb605c-2fe9-47e1-ab7f-1389242264c2", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634585564, "uuid": "15254766-fd4e-45ec-8f5f-1b431183c027", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585564, "uuid": "8a8efd91-66b1-4400-a505-69d4c0257f4a", "value": "ff0e7b40d724b0169eef029f4ac379e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57313817-302a-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634571895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571895, "uuid": "b38fc26b-0bc2-44e0-9289-65c456a91e31", "comment": "Malware payload (SilentBuilder)", "value": "e55afc549a8c357b00d98f34e48af06b", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571895, "uuid": "e5bbeefc-d6e0-49a0-be0a-7e9bab661ba3", "comment": "Malware payload (SilentBuilder)", "value": "509e22531a2da5c374b04c9c1b2a191d62367e63a7298a8112d00026f8c5a689", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571895, "uuid": "efd8773f-a250-4651-b65e-ef7debd4014a", "comment": "Malware payload (SilentBuilder)", "value": "a6c09a829e7a959e9417341ad4d8caa219cd3874", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571895, "uuid": "d3fa5b4c-6ad5-4b7c-a2bb-f84d59457670", "comment": "Malware payload (SilentBuilder)", "value": "f6a6b8c8f5d6ebde8c9fc8bd9076a4e03e3d0ba002ab81caf63a3b81d01696d2252495a9d6d52303894c0bebd8092771", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571895, "uuid": "a62a3dfe-7c71-44d3-a894-5888a9aa121b", "value": "T1A244E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571895, "uuid": "a0febf14-5ddd-4690-9282-5f4165c6ce7a", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7I:U9jFrjmkD7IvLDK3vLvfn1+2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571895, "uuid": "6d955d8c-264e-4427-bf8f-8d7a0e317168", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571895, "uuid": "66bbde70-288a-4c37-92f0-85f9b440030a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571895, "uuid": "3f382bf7-1911-42bd-8bad-ddcf00e30395", "value": "e55afc549a8c357b00d98f34e48af06b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14513ad5-3055-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634590251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590251, "uuid": "b1dd5750-d81b-4f3a-844a-4c408481783b", "comment": "Malware payload", "value": "c85cb875f5995716be5b02c24d76a4ba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590251, "uuid": "a47eeda7-5f71-44ff-a813-ad786fe457e8", "comment": "Malware payload", "value": "5151fc0296e1f0460a7de4bc1a2a68c8874d74e8dd7ce67798a71bf3be407d84", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590251, "uuid": "2617cd42-8f1c-41eb-8bff-5221d253c9a2", "comment": "Malware payload", "value": "b7fa24a187a978546b664d97507d1f2cd64113c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590251, "uuid": "c9adf095-20d5-438a-80b3-4428d976b9c3", "comment": "Malware payload", "value": "c699a3d7aab07a0c9a9956c2cf58039fdd421dc368daf10f6a1a9c3ec6434eb3f6ee63f2b903f98f7566038fa530949a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590251, "uuid": "92e7adbd-0461-4704-a6ae-75b18d82eee0", "value": "T1C882ABC67FE55CD30E0A67A7FF8464F2F6033990195BBCAE86252446024C736E8636F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590251, "uuid": "5efeee4d-8e06-49ed-a381-94c75d5f2bed", "value": "384:er9/un3VPfqRhehhNHt1pvM9gmd2D5nI7f8Vs6diq:w/aVuhehHrpv8YRyCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590251, "uuid": "a5b41e06-93da-4277-8069-5c45a5d4e417", "value": 18456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590251, "uuid": "f2e1d9b9-dac9-40a2-86b3-f751d633c98d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590251, "uuid": "71d980ad-57b6-4ea4-b5c7-545e2dabd3c2", "value": "Stolen Images Evidence.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb41dad7-2fee-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634546293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546293, "uuid": "91f87e46-2ee8-4585-b4d0-1209913f341f", "comment": "Malware payload (Loki)", "value": "b1d25fccfa3bac61c224dee5ac4da7c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546293, "uuid": "c970c7e5-3c66-43a0-8828-7d72b8099069", "comment": "Malware payload (Loki)", "value": "5276828cc9b76bee177d1ff0f6fa4209a00f01a7e8aa70561cc520f0adc4d856", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546293, "uuid": "2ac9771c-3f43-4cd6-b659-1982aa72f1aa", "comment": "Malware payload (Loki)", "value": "fac061ef0ef3b2a1c7755b01bb091a4b9ba49bb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546293, "uuid": "f9a5dad1-7ed0-43c8-81fa-6b793ec9e05a", "comment": "Malware payload (Loki)", "value": "60e17d41a9e7af4683b52685c1321cb97914eb3726dd02ff7924be60714c8bcf3f1c705aa5e5f58e5ba292d464de124c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546293, "uuid": "780a7f1c-f6d2-4648-a00e-23124506ddaf", "value": "T1B6748D10A690C0B9F5B312F48ABA5F78A5AE7FE16B2460CB53D516EE97345E0ED30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546293, "uuid": "1663797c-03d4-4c94-b5ab-f8cde18635f0", "value": "b4cda15a674ef12000829b9be50880b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546293, "uuid": "e3719ba0-13df-4670-9bc4-5ffdd102539d", "value": "6144:d7EJd7ejdWwwMCZ8WF/Dr8NiqjsohIhOYv1yiG6mCQYDs8Vs7:er7ej8wwMCZ1F/DrsLjsohIhD1LG6fD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546293, "uuid": "4fe733d7-967c-49f4-8b27-22696ebe4afd", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546293, "uuid": "ce554e77-a1a5-4181-8d8e-6b93e4d94efa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546293, "uuid": "f003e9be-825b-4a50-a26b-e2c80a9e7ecf", "value": "b1d25fccfa3bac61c224dee5ac4da7c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27e109f-2fe3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634541580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541580, "uuid": "36ec6ca0-74b7-4092-b010-e79b9d5216cd", "comment": "Malware payload (AgentTesla)", "value": "e61588d0729ecc06f559537d258ffd91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541580, "uuid": "1ad2d69e-fcb6-4a6e-9ccc-3e6b38d7d8b6", "comment": "Malware payload (AgentTesla)", "value": "53acd70a0b9a9463116c92c3f0d43faca4ccf8d6922117936ca4f53de6398403", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541580, "uuid": "849a8bdd-293f-4282-b3e2-267c6519ddc8", "comment": "Malware payload (AgentTesla)", "value": "7421bd486c14dd3df9f520f1e4224806e6c823d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541580, "uuid": "51a21910-cb89-4808-a673-17027764b23e", "comment": "Malware payload (AgentTesla)", "value": "0e1f7e264942776e0dda76cb43bf1a5a4e132b6125ecb894fd7ef4891f832b82f1ebeedfe6e90a5cd76ec8af46ccc721", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541580, "uuid": "82eb6596-3d74-416a-9000-678a30cea141", "value": "T1A1842320C839CA742A77F116A424D3D63F45F9DE57CA8E76B1C685294AC368277BF840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541580, "uuid": "c2966bba-b2b3-43a0-9294-fac94a2a45d3", "value": "6144:fYAzwLWQGJpbDW54MJF5Z0s4eA33dNd+iVcc0t+h0N2gfU/dPErjXEbaJNW7zmKA:fi75usnA3NNtTY+KdfGEU6er5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634541580, "uuid": "dc43c335-43a4-4081-ad3a-d4932c7a4e02", "value": 396860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634541580, "uuid": "0733e2fc-208b-47e0-b53c-68cd9f34a239", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541580, "uuid": "4b617d34-30ab-429e-9554-d69fb62033ee", "value": "CI&PL-AWB-HEL-21-324-1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6d0e55-300b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634558562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558562, "uuid": "19e5224e-0ebe-4d7c-b258-8946518977f3", "comment": "Malware payload (SnakeKeylogger)", "value": "99a0109485e8ca6d9ee2b809390d89b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558562, "uuid": "b402d14a-aa80-4717-8c11-ceef9439c176", "comment": "Malware payload (SnakeKeylogger)", "value": "53d520c1f12fe4e479c6e31626f7d4aba5a65d107c1a13401380ebca7cca5b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558562, "uuid": "aee7caea-31af-424a-8d1d-0caeaedcbb43", "comment": "Malware payload (SnakeKeylogger)", "value": "ea89519b812adc5dff90531a6c64c987d6d109d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558562, "uuid": "bf53fb3d-709c-4d05-bd62-7000c7cb2c10", "comment": "Malware payload (SnakeKeylogger)", "value": "bb417445b3c7761dc0ed0909730d7c5e87455f1793ca5933a84739ca5be44251a88f3c7ebfea44cbb5ca6cd1f6e31314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558562, "uuid": "96eb2bc5-439d-4c4d-9d58-3027b5cec2ec", "value": "T1AD73C7013E046689C4D20C7901F259D1A3789DDF8E9ACE3779E1B73E78B3664AE07939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558562, "uuid": "0a923486-da52-4c2f-b528-e16c12aaa436", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558562, "uuid": "2c8abae7-8533-4c0b-9ae5-61679c3322b8", "value": "768:lw1QHHkyIULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0cf:l3tIULFMAAiu6JL6oNsgFAyox0cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558562, "uuid": "475a8a01-a59a-4e0b-9db9-7f8460299043", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558562, "uuid": "22dea57a-a3e4-457b-9c5c-2dd06b64e09e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558562, "uuid": "b19eb4fd-21d3-474f-8332-f9f6a2e61afa", "value": "99a0109485e8ca6d9ee2b809390d89b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8b9d47-2fcf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634533061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533061, "uuid": "820582e0-318b-4392-9b19-773091bac90a", "comment": "Malware payload", "value": "10c2bab7a44816e0c5c54cb8d21ef46d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533061, "uuid": "af83248b-1782-4b6e-b524-70c38c84ec18", "comment": "Malware payload", "value": "53f9cb3e338067bfbd0683a69f29ab8848d9f2494750d6d36683871523b01625", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533061, "uuid": "9a61f7bb-6b25-4584-86d6-29a9c69b872a", "comment": "Malware payload", "value": "a6560322c706cbed52cb3a32f6a02ec6d399a12c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533061, "uuid": "38ce487a-2036-44c3-a680-f4002f07125f", "comment": "Malware payload", "value": "a91fe04fac561d1b39aa9dd8db1d67197b14a1da3031cca8176fda6eb923087a3155f32f8c8e5deb6ab64ccf61767b02", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533061, "uuid": "5a3eb153-4ad0-4473-a86b-8be808aaafac", "value": "T156A1C63A13790803CE5394FAC575FF634AF2F62695CB4682337DF9700B5B782992A185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533061, "uuid": "d2528ee7-b893-483e-b222-d788e19a4ffc", "value": "96:wIv46p4mfdWsPOuVvwNXeiqKrehUdifIowx+Le:BptfAsPOOvwNXfqiexGx+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634533061, "uuid": "33887f26-a986-4c96-90fd-4b6db4648b8f", "value": 4884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634533061, "uuid": "3752659e-2c43-47a9-974d-64bd1c385454", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533061, "uuid": "af621535-34d6-4edd-870e-43f3b91b7fe5", "value": "order\u00a02021-10-17.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd367ac-3003-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634555427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555427, "uuid": "cb91ca10-e216-408c-8a63-5fec8aa4fd38", "comment": "Malware payload (Formbook)", "value": "9b20c6a0c05584185da23f0892a7a982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555427, "uuid": "258761fc-751f-4996-888e-30576c93b716", "comment": "Malware payload (Formbook)", "value": "53fb1511812b33448fb51c4a6a7f4095600f2d30251546466ab1d401191fa59a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555427, "uuid": "8ff9fd93-54d8-4aa8-af7d-fab29d9452e5", "comment": "Malware payload (Formbook)", "value": "dfc1531489c4a803b0125c95b93609989dc3b138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555427, "uuid": "0b668eed-7af4-4007-8a04-9cfa45a5df8d", "comment": "Malware payload (Formbook)", "value": "2d7abedad372f22dcfe81f3368832c1e3aa9f258ac3fb16a88765d2988bc0ea5a48af3ef09070aaa523f3c8eab489ee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555427, "uuid": "832ee1b4-98e4-449e-aea2-256af9c9eb79", "value": "T1A244137132C290F7C5C357B08E9FAD5AE2B5E60A1571860B9770AE3EFE441C75B0E1A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555427, "uuid": "2e919067-681c-4dbc-baa3-f90e4d060d78", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555427, "uuid": "fa314048-7150-47d0-bf82-7a066d51ce55", "value": "3072:wBynOpL12riocLMRcjGk4bKcahjDTAZ2rhS1FhySMsQuK89M2NvkskmtjIk9qcCX:wBlL/cRzZ5aVTA2khy3MRks91Xxazt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555427, "uuid": "98331cfd-66e4-43d9-9210-39e6a35de903", "value": 258215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555427, "uuid": "4e9029cd-c031-4498-ad4a-2b4bea064e9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555427, "uuid": "a97f422d-bd4f-4202-981b-4028f49e07cc", "value": "9b20c6a0c05584185da23f0892a7a982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec0c540-3013-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1634561948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561948, "uuid": "c5ffafe6-50fc-4611-8a7a-1a4668349e6a", "comment": "Malware payload (CoinMiner)", "value": "fc122ec1ff2513aacae932d05c8bc6d0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561948, "uuid": "e6fe19ad-9d7f-411a-b9bf-fd601d0bbe28", "comment": "Malware payload (CoinMiner)", "value": "54442dc00ab26302545618a4c0f32e8b5b3fdacd38316007e0a3db646e073b14", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561948, "uuid": "40e34342-b7c7-4460-a64a-4ccbcfc1f3d3", "comment": "Malware payload (CoinMiner)", "value": "219b57cfa18042a66a44086fd3bea2f938cdedde", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561948, "uuid": "edf0fca9-cbf7-4f46-957b-ada40917fccf", "comment": "Malware payload (CoinMiner)", "value": "387fd75600e95854a42ef55d2ae643dc647969fc3410e8d7c24cf85c55b31ed2afb3a6fb3e627772f270993182e82de4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561948, "uuid": "7152f502-ad48-401f-9719-77d95e8016f9", "value": "T1160523C122D268CDD29DF7BF201567EECDCA606598EDEE5D62F8F07530F4092A48817A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561948, "uuid": "fdd2a781-7227-4560-b0ce-0491f14e87cf", "value": "563557d99523e4b1f8aab2eb9b79285e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561948, "uuid": "fc7a77a2-88fe-4c36-989b-13eca866c88b", "value": "12288:Llek7VIjqS/AttnfMznf81aW56jmi4EAEKw46Ye/WOw6iuex082+ueN3Rm8:lfKE8WHEm6Yjjduex082+VNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561948, "uuid": "074971d9-eb41-495b-9f4b-6e54451358de", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561948, "uuid": "d28cc74f-f909-40d4-b6a5-68b81f8bf4af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561948, "uuid": "f7aa3d36-3f4d-4888-b819-a02eaff7e39b", "value": "fc122ec1ff2513aacae932d05c8bc6d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba4ee43-2fda-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634537542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537542, "uuid": "cba5f579-ccad-4a3d-8fa3-2db442c8d30d", "comment": "Malware payload", "value": "e389dcadff8a071fc76a9ef81369a672", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537542, "uuid": "a833f35a-a372-460b-b6d6-bffe709de162", "comment": "Malware payload", "value": "547dc4b2e3b8256140bc7ca0871470ebb96cd08a099c3cadf26191f01613e04d", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537542, "uuid": "4352a605-4b5a-445c-8552-bc9bcd697ddc", "comment": "Malware payload", "value": "071a6fab4472dc8cadf7a2ef2ea7814a609a18a0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634537542, "uuid": "f0886bbe-f4ba-4d44-a45d-2b04a9dafb53", "comment": "Malware payload", "value": "c76087637e33c07b88fd2d13589f8a4310fe6e041b566991edc1a251812949668f986c0b68a1647817e21fcc00b9227b", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537542, "uuid": "77b3e0f0-4982-4ada-8ae9-9ffe30bf9745", "value": "T18E23CA89274201098DBA1F207BF12F4DFB279273D742C0567AFD94648FBA564CAA0F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537542, "uuid": "00a97a2f-486e-4daa-966e-2e8d782004d6", "value": "768:9FpKME1qhxQrLsxkPEP4xxK53OPe6dAF4zMOdvg5ginOzQ5Z7U8O8+oM84aGEk7c:97VE1qUrLsxeEQxxK53OPe6dAF4zMOd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634537542, "uuid": "eeb48213-7efa-4f4a-830e-fe647908b9ce", "value": 47255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634537542, "uuid": "d16d0b04-2cca-4a26-a10f-a6419cd2d2f1", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634537542, "uuid": "b81ef6e2-67f0-4be6-b29c-ed9996ada742", "value": "CMA.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004344ba-3051-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634588499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588499, "uuid": "cf8d2c22-f276-40a6-8039-871f6e34bd17", "comment": "Malware payload", "value": "217406c42eee7058fa7de49d0224cefc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588499, "uuid": "c26a326d-506e-4222-abfd-652237beb059", "comment": "Malware payload", "value": "5518dea9d561047de9b895b2c920b4fa8e1ecff309bf90f1752d3f80ebc5b4d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588499, "uuid": "7b32a513-cf7e-41a6-98cb-33b8a81aac3c", "comment": "Malware payload", "value": "d895dcb34661590c5d9d9f0d64999a672ad6deee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588499, "uuid": "239b30fb-ae2f-4a4d-bfee-a4384200d747", "comment": "Malware payload", "value": "07bf26a4670bae19680c9f372d4f81cacc6c495fa06978cb830ea6cb0d3b700ad9a64028ba8ba0ca9e19c9fa4861cf61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588499, "uuid": "e46091f7-1b9d-4a68-9232-b170cc7e3919", "value": "T147C5238796645803ED9BA8B031EDF6136D35BB921F91C2EB1495F1891E63BD03B2C31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588499, "uuid": "9beced00-06af-4e02-b816-37c382a552a7", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588499, "uuid": "0f434486-4118-4aa4-9ef9-9f0d7b97cd94", "value": "49152:AeYNgxxv6FyJgJQ4n0PHuDSFHMacvr+YLhl8rvKIuA:A6xxvV3RvkKpcvr+Ydl8mE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634588499, "uuid": "d4e065ed-679d-441a-9f05-de3e19efbbfd", "value": 2733056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634588499, "uuid": "fce64c9e-b0cc-4bc6-9178-181db79ed028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588499, "uuid": "5b564c13-dafe-4cc0-89e3-bec5814dfded", "value": "new(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665651ba-304b-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1634586093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586093, "uuid": "d16c1eae-31a4-4373-b817-e83e9a3c4ebd", "comment": "Malware payload (Vjw0rm)", "value": "3e7dd715a15046585cb8034a1fa847b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586093, "uuid": "04e26059-dec7-4b90-ad26-b44e13b95484", "comment": "Malware payload (Vjw0rm)", "value": "5518f5e20b27a4b10ebc7abce37c733ab532354b5db6aed7edf19c25caba2ff3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586093, "uuid": "32f1732d-00f4-4edd-b48a-9c84157eb1e6", "comment": "Malware payload (Vjw0rm)", "value": "4cbe1b633a7859821c0b7082385407cb140a0ba5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586093, "uuid": "3d6ed1a9-845a-472b-b8cf-f6102aff87b6", "comment": "Malware payload (Vjw0rm)", "value": "4e57ba86dcfb3b5e29f79d71ac2a99f21fa3e1b4533b23ee36707475da71e92616287346923416affa52a52d4c215709", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586093, "uuid": "520d8bd4-4db2-4918-9034-354f72312dcd", "value": "T14642AE8C3504B571265A6A3F812F1E4B3A0BE83E6516F19C5492E16091FEB4B5B8FCBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586093, "uuid": "238cdc90-1648-419a-b166-e7367559784b", "value": "384:Y7z4C7+owFhl3rwUY5mn33QPHOS2A9P2N:Y7zV+ow5qk3AOSx9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586093, "uuid": "d3f6f8d9-b890-40af-9a73-0494679e24bc", "value": 12784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586093, "uuid": "ff9b93c0-974d-485c-83d1-9ea8ac13ce9a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586093, "uuid": "596d6bb2-9b90-4130-baad-1ebf4334aeb1", "value": "TOO89_Payment_Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcabc5bb-2fce-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634532605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532605, "uuid": "7e95e048-8645-47ef-9464-89621db98d0a", "comment": "Malware payload (Mirai)", "value": "1d65eec68e500d41c4ec8ea713e2a161", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532605, "uuid": "8af90570-746e-47a2-b1d8-347fdaefd03b", "comment": "Malware payload (Mirai)", "value": "564f5e1a7132573ee469381a265c1529c2756203a5768d567f45983b0495a9d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532605, "uuid": "daad9d8d-1f93-455a-b5c9-531a6fea99d8", "comment": "Malware payload (Mirai)", "value": "933870bdd9ae01c98aec9ab442fb23ee27eaa2ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532605, "uuid": "a261e238-5a4a-44eb-b7fe-1c2ba3fea02a", "comment": "Malware payload (Mirai)", "value": "9d1598db6dfcedf31251d9b0271eca669565d3d7d30d5839bd13641b58352ff75513241c844c372928db9af1bf1b7e70", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634532605, "uuid": "90936117-f174-4bb2-897a-e62057792f16", "value": "T1C1F2E16AA4FF8A07D67F003A0FAEA61C1152CB06D5359119E9E05272DDADF9DFC382C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634532605, "uuid": "010294e3-4a7e-48f5-b331-c46bad5b0157", "value": "768:XkJ7XGW5xN2nw4FW/c9yqIJWBeiZtBO12WKWCUYIKCrsmHZC+pYnbcuyD7UHQRj8:XkkW5aw4FEtqIJWBBc2WKWCUY/UsYgca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634532605, "uuid": "24bc8fd1-2e01-4a6e-8ce2-dbd69890fd30", "value": 36152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634532605, "uuid": "03bef6d9-c355-4092-a9c9-b6150286f533", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634532605, "uuid": "33985004-cc5a-4c45-b71a-bc77a0fbc68c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee72c7fc-3005-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634556257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556257, "uuid": "728cb97f-a888-4657-9194-c1c13cde0316", "comment": "Malware payload (GuLoader)", "value": "e6e313dd940dfbc0d84ed77d482905ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556257, "uuid": "bbbe7dfa-6092-42be-8860-6a3069545b2a", "comment": "Malware payload (GuLoader)", "value": "566d4e0fe339c642ac195c95589bea922a5314cea14bcd98b2405ffaaa387d0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556257, "uuid": "4e5e37e5-5a3f-48ea-baba-f6d46e0cd676", "comment": "Malware payload (GuLoader)", "value": "406f17749d077cee32cec32a7e2b657dcb5465a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556257, "uuid": "4e209548-f37d-48ba-a1cb-4e1d02575f45", "comment": "Malware payload (GuLoader)", "value": "0f52c12970548ae07be1ac41c6a94498bd9083e1d2418d35facf1f55f34f59b32badf126a60e77a0217e33985c2ba736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556257, "uuid": "95b82108-68e9-4bb3-a4b5-de8128d8a0d4", "value": "T14E935BE2159CBCBAD585C9BE477F067B430EBC336995D71722C4030AE82EB859D6431B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556257, "uuid": "8b0a02e5-d470-4174-9707-bcc5ca68fc3f", "value": "6cda8b61dc739fa685b0a1af3300013c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556257, "uuid": "32e2737d-c213-419e-88e9-7b46c7727136", "value": "1536:tiDZfwfyhenn1iUdcN9zhILtVdGyfCarTj50bWXQacF3wD:tiGfRnYUQI3dxCKbfcBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556257, "uuid": "6fe52f12-ece7-4d23-a3b3-4fb81990a6f7", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556257, "uuid": "916bf04e-0cc0-49ea-8895-4113304edb77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556257, "uuid": "095bbdc7-eea8-4195-b90d-dfd4879913c0", "value": "Fra FAC-ES101-2107-03806_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a00f96e-3029-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634571577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571577, "uuid": "f4ea2c02-53aa-4272-960f-6595882e0fc3", "comment": "Malware payload (SilentBuilder)", "value": "487bd30c586d802b416be0f4f695ee9c", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571577, "uuid": "98645704-9a6d-48ad-ab0d-dc8e2c4e812c", "comment": "Malware payload (SilentBuilder)", "value": "568e1aeaaa9939bf7dc4ca8fb49494e657a63f88abff25dd7f6fc94ba3899569", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571577, "uuid": "f3b623ff-bafc-41dc-b3b5-f6c9a244bdc5", "comment": "Malware payload (SilentBuilder)", "value": "cc898a7b0d4b9c9b962596b8ba8ae87ddb8a0702", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571577, "uuid": "b23888fa-024a-4394-a4ea-dbc06a85f44c", "comment": "Malware payload (SilentBuilder)", "value": "797f4f61d6b64a650167de32ed14f3d50e5fe9426368b228cf6d169520e649ed13a09639962dabd3a36fb7e0522b26da", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571577, "uuid": "763b85ea-35f4-4711-838a-37d3c48ad801", "value": "T11544E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571577, "uuid": "e631ead8-48b9-4fca-b8f6-663ee97daf49", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7o:U9jFrjmkD7IvLDK3vLvfn1+2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571577, "uuid": "89ce2752-c4fe-424b-83ea-726b320fd8f6", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571577, "uuid": "4f8c5180-a2ab-4e6a-bdef-42ba0d1230ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571577, "uuid": "ce161d0c-fe43-492c-8403-75318a388ea8", "value": "487bd30c586d802b416be0f4f695ee9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db97f152-2fce-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634532603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532603, "uuid": "6ee648e1-6c9d-4214-b532-68b4d18ddef7", "comment": "Malware payload (Mirai)", "value": "e4c9fa03117509be7d7635f783bbc9e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532603, "uuid": "c9626266-7618-49eb-95c9-1d6ca8f544dd", "comment": "Malware payload (Mirai)", "value": "578dd805b6b8a216bc1c0ce4faf64e5eb34e3e31d3d00f61be6fac4782250785", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532603, "uuid": "7418e7b4-ce6e-4e93-b134-0d2e240c4cfe", "comment": "Malware payload (Mirai)", "value": "5addf47e7d610a9003d31ffc5ef4faefe60804dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532603, "uuid": "19a1811a-cda9-41a3-adac-4be0db01152a", "comment": "Malware payload (Mirai)", "value": "5697545699d7d23a66c5435e3065ce68b1b2151f05c11a0f7678cfb275548ad88041d541d5f579f5dc4e3f4d280da141", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634532603, "uuid": "8c3ed038-3800-4e06-8304-a3a09abbf6ae", "value": "T15463027046EC91267828EA758F3EC28CBE8C67F9A5ED324E05534E6C4E89D1642DCCC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634532603, "uuid": "6dc24b3b-5580-40b1-b2e6-0e16566e018a", "value": "1536:0djEVr8f0T7ETrwhg9sk4gDOSx10LtsCEhi0clhBGKlU:YEaO7MrJ+cV0L+CDnlrGK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634532603, "uuid": "f8d4b74d-e326-419b-9d04-9e963387388d", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634532603, "uuid": "2be29db0-5dfc-4907-816e-fcaaee3ae5aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634532603, "uuid": "bf4ac2a9-9d9b-4467-b91d-17b165840162", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fb03eb-3060-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634595350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595350, "uuid": "248bd909-8a19-4387-9a12-3c2379b8c08c", "comment": "Malware payload", "value": "2bdd4191820b32b9b6ec1a22b598df15", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595350, "uuid": "96f9e2f3-9405-4f76-ac17-5d92fafda464", "comment": "Malware payload", "value": "57dd8e2293bfb01c7daca6752cc8ca4f2f045e33dd3aa001a5b6e38542a93535", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595350, "uuid": "b082e08d-ff34-4436-9a95-d1eff0e24d69", "comment": "Malware payload", "value": "1672de6ae9b4750f0e88a1bd8c67e51975ec4464", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595350, "uuid": "2e9eb94c-c654-4fd0-82b4-9d06c9099d81", "comment": "Malware payload", "value": "8b9bd1bde30b98e96479239cbdaeb7fe5c944520cc7d87f03c71f31472d31a1610b93ca5fcee74daa280d40272dc322c", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595350, "uuid": "670cd789-1371-4b18-a142-3d8f61ec43fc", "value": "T18944E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595350, "uuid": "f92721c3-4995-4055-a810-b4500e690dbb", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7G:U9jFrjmkD7IvLDK3vLvfn1+2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595350, "uuid": "d3aa2171-0cf3-4dfd-ba74-450c031ed1cf", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595350, "uuid": "37aa105c-ae28-4c22-a67f-90d84240d360", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595350, "uuid": "5eb758f1-b6b9-4535-bba2-c907ca7dae58", "value": "2bdd4191820b32b9b6ec1a22b598df15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d316093-3061-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634595608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595608, "uuid": "4b0b477f-a0a3-4834-863a-69c723342170", "comment": "Malware payload (SilentBuilder)", "value": "cc08f19713d4ce93bbf24471bfa6218d", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595608, "uuid": "fc56c788-96cc-4694-bdcc-c7dccf28d1fe", "comment": "Malware payload (SilentBuilder)", "value": "57f2d18417df8afa946c87e6a1fa14c8b29f515c4ff43f47249ba69a422382f6", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595608, "uuid": "968c1443-7acc-4c7f-96ce-085be65623d3", "comment": "Malware payload (SilentBuilder)", "value": "86ee4ba25ba76fbf4be1086f459c1d242ec75797", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595608, "uuid": "be36745d-24b0-45cf-99ee-b876c4ba58d3", "comment": "Malware payload (SilentBuilder)", "value": "5ee79903023f2ccdbf8bb470cc7f66c49a49381eaeda635d28f4ec87da1d92654a09dc3fd55216cd6f4c93cde15f6ad4", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595608, "uuid": "ae6f52ab-f100-41af-89e7-c0574080a4b0", "value": "T15744E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595608, "uuid": "b4eae3b1-c68b-43fb-bfb3-26b135eab82f", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7o:U9jFrjmkD7IvLDK3vLvfn1+2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595608, "uuid": "77e3bfa2-991f-45ae-a83d-8ab64acf65cd", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595608, "uuid": "3f6c37fd-d479-4698-9c98-1886da6ca08b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595608, "uuid": "d6b9177f-5259-4e9d-9a08-bb967361e6a8", "value": "cc08f19713d4ce93bbf24471bfa6218d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa2cfb9-3017-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634563695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563695, "uuid": "5d50af07-3b65-4384-92b0-fe77538c3d4b", "comment": "Malware payload (Gafgyt)", "value": "957ef652c46cc12ba6eabd229c2574e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563695, "uuid": "eb877ea4-f006-4032-a810-81d0c36f1874", "comment": "Malware payload (Gafgyt)", "value": "597acaab8808e86b9633a7c13dd2b7d0ae48212cc145baa85672a857fbba50dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563695, "uuid": "fab0e827-092e-47a8-9ceb-fd6aa2e62a7b", "comment": "Malware payload (Gafgyt)", "value": "18cb8a888b4fc655f17fc6fd2c06c5c0a1afafda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563695, "uuid": "d9688c19-a6ca-4356-8c69-170bda0f7611", "comment": "Malware payload (Gafgyt)", "value": "3290eabf59f9e088540a34ec9e9fa3deccfcaf4d987841df77f9e477e14313bd620e605e1fd6aab7f02937e4d07ab34d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563695, "uuid": "5491130e-7a18-46f5-8a3d-420c71da1f9e", "value": "T10BA34C03771D0B53C85B59B029BB27F1CB5EBAE216E261C1A11DEED05733AB02522FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563695, "uuid": "dbfa0368-9384-40d1-a292-a7731cc9e63a", "value": "1536:lM7oK3OJeXL1/nMkxFAi03+uht5vfsig5hxdddddbd8kq6mYj10PZjgVf3Nj:lgEiMAAi03+uRu5hjOb6mK10PZkVf3Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634563695, "uuid": "6d40a231-c4b0-47c2-a413-47877898f6df", "value": 98046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634563695, "uuid": "7cdeedf6-1820-4e3e-90fe-c90cf642274f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563695, "uuid": "d7fa30b1-550f-4cfe-87ff-0322dbb87878", "value": "957ef652c46cc12ba6eabd229c2574e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd50be7-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561252, "uuid": "e4ba2d47-984b-4188-816b-63cd3b5cfffb", "comment": "Malware payload", "value": "16bffd0f279abf913c3c909dbe469c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561252, "uuid": "d1b03f03-1a07-43c0-937e-cffbfb26d464", "comment": "Malware payload", "value": "59b6b6dec316df3c153ce6006006643d209be81ccbba2e1a3b8f610418a21373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561252, "uuid": "809f14f9-5fde-496d-938f-c729b0373992", "comment": "Malware payload", "value": "20c056add709a744531347b3ae2abf928571331c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561252, "uuid": "44f79ef4-6e16-43db-b799-d23033b34ca4", "comment": "Malware payload", "value": "3ea391d723f6fa21ad41f4e1204ce20380ee8abc8d5a100c4f76c209bee60a72eaaefb233309f7b0395c8ca85ad43013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "LTU", "colour": "#6BAD67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561252, "uuid": "e4dd2d09-d9c4-45ae-968e-ad600d628962", "value": "T1C3D4BF473544CA58CEBD52F6A226814123A6DCBFC514E2496FC43FC76EF9B930826B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561252, "uuid": "1e651d3a-6e8f-4b5e-91aa-cfb18a4da5c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561252, "uuid": "580833a0-596c-4c0d-81cc-85ae8ac79551", "value": "12288:8pt8GPBYo8ET/Hi8Xp/VIkZwxYcm2Fv6nnjqKoe:8r7TKSp/akdcm2V6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561252, "uuid": "5d9176f2-75b6-4957-a050-09da8006b5c5", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561252, "uuid": "d0275086-e467-425f-b634-f473d84d83c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561252, "uuid": "8e8b4161-7eff-4d82-8feb-2b16a847305a", "value": "S\u0105skaita.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703b2a0a-304b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634586110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586110, "uuid": "3afe0388-43f3-434e-a56c-065c1454bb91", "comment": "Malware payload (Mirai)", "value": "088e70ea3cc029f0e6664fb97d0d5196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586110, "uuid": "23e49a45-54aa-4b2c-822d-e39077132dc8", "comment": "Malware payload (Mirai)", "value": "5a51795677cf92711c8deed4cc832ab045d5cae03fcc2be11db5e143bb73b560", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586110, "uuid": "267f8405-5119-41a9-9142-6369924dfc16", "comment": "Malware payload (Mirai)", "value": "bd92b61fb24f459e4f25bafb246890d49269790d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586110, "uuid": "b7d1adb8-3643-4e62-9f45-c346f086de3f", "comment": "Malware payload (Mirai)", "value": "0cd1c6996ef649c0f15e8e9c5c76b5f4b134dabb07e047250990cd6e16d9f39a64d9955003e6553d30fd0223fb3b8e04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586110, "uuid": "f227f821-dae2-4ba8-968b-4532c97ae034", "value": "T1C2735A01B3584A47E5A61EF4393F1FE197BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586110, "uuid": "584a57b8-cd82-4067-8517-8adea1be1fdd", "value": "1536:DNpp9RXI1vgi0uvc8zomzrKRyxOReqpNiSejOjNfXM:Xp9djCDomzrE2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586110, "uuid": "fdc32626-5a8d-4782-bce8-5c9716dac397", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586110, "uuid": "983453f8-5420-4124-950d-e474bc101d04", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586110, "uuid": "036ab308-c084-4932-9472-46eddd74534b", "value": "088e70ea3cc029f0e6664fb97d0d5196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5bc638-3017-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634563686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563686, "uuid": "9b36d2a7-0d4f-4d5e-b62b-36ae731a8efb", "comment": "Malware payload (RedLineStealer)", "value": "ea9748d43fde0c8942c9f7e47c8cfa37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563686, "uuid": "d4fb9a04-b817-4467-8ae9-d859fdda0888", "comment": "Malware payload (RedLineStealer)", "value": "5ae2a36a32ceefc6fa2af322192dabf1f453bf0b19f20ee09d42224cf95e5d8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563686, "uuid": "246e39be-52c9-4e52-a26f-07c9f5ef4c13", "comment": "Malware payload (RedLineStealer)", "value": "ff319ce791d901a965cc6cd97225d0c32cd2f968", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563686, "uuid": "cac9ca6f-011e-4a8d-8cbe-1f2cb65ba18d", "comment": "Malware payload (RedLineStealer)", "value": "8616c6b37e150bd2fc460c6d6789771cdbb9c73328ac57fa1e6776a5ea6f21f5937cd41456b1c6597add50dd8996cde7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563686, "uuid": "35801698-cdd2-4d0c-bf7d-9da05237050c", "value": "T143A4913968E94637A1B7DEB2EBF1A993FA56B12B3615080D24CF03804753E47ADC701E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563686, "uuid": "855c0997-6ad9-443e-8d0a-37ab84ab4475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563686, "uuid": "66a7bf6c-a611-490d-8836-f285407a90f3", "value": "6144:FSkF/Kuq5K1GRVNXjEuZFkLMk/lOF4E91cQHYe:FSkFMo1CNzEusLMkdOFh9/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634563686, "uuid": "172690c8-c6f7-41ec-b22b-e4fff03a1528", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634563686, "uuid": "ebe00eb5-0add-4aae-a39e-d95984d24fa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563686, "uuid": "79b89038-af1f-48d8-8e1a-8ab20a1a5fb6", "value": "ea9748d43fde0c8942c9f7e47c8cfa37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dce7437-3027-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634570510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570510, "uuid": "a8fd9c82-db8f-4843-9b82-3d24df4114bb", "comment": "Malware payload (SilentBuilder)", "value": "5ae54e17694f20b91217f903003e7632", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570510, "uuid": "5359e246-5ce1-4d2b-aef1-610878c5c762", "comment": "Malware payload (SilentBuilder)", "value": "5b81e944b045d955afe287c1f77c9a7921bf97d5aeadf9f0a46ba0894de5ebcb", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570510, "uuid": "38cf72fd-0be3-42fc-86be-dfbaf498bc68", "comment": "Malware payload (SilentBuilder)", "value": "d5aeb91e2a1e95a6516e8756bd69e3932754da82", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570510, "uuid": "1dae14c3-8307-4261-bb5f-4b79b4aed01b", "comment": "Malware payload (SilentBuilder)", "value": "34aafa41c1e45862d3923b24a03616a7d669875a56f083e66c3998952ddddda20c90cbb2663a885b1199144138849368", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570510, "uuid": "aa45fc0b-72f9-4557-b7ca-9b3c0c69a76f", "value": "T19A44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570510, "uuid": "1c8301e6-59fe-4176-93aa-e35237639f0b", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7G:U9jFrjmkD7IvLDK3vLvfn1+2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634570510, "uuid": "bbc74b3e-cf6a-4536-84c4-f52c83e49278", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634570510, "uuid": "c7054b61-273e-4d74-9660-a52351e3a6bb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570510, "uuid": "3fd494a7-c199-463d-97e7-1aa4357c4704", "value": "5ae54e17694f20b91217f903003e7632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623c8a4d-3026-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634570195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570195, "uuid": "0e94701a-d448-4f31-bc70-9196947116eb", "comment": "Malware payload (Quakbot)", "value": "932cf14b4f91d84439db9c977beee326", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570195, "uuid": "ae36d861-f68b-4195-9ffa-0a85febcddd9", "comment": "Malware payload (Quakbot)", "value": "5bd614dc6eae997fc33c6faf2c98f862222c7729b2e4c94dcd13f2150e6f7f88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570195, "uuid": "753ebb0f-3917-4f8d-b55b-0bb9a200a756", "comment": "Malware payload (Quakbot)", "value": "e9eb1f908042d89d754e843b24b3f7b423fbff37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570195, "uuid": "d44018f2-92b0-49b0-ae58-2d784b34e074", "comment": "Malware payload (Quakbot)", "value": "7a57bc17d992a6451cd1d7b7e6e1e10e899a3a9913071edec8e913a81586f8b27f0b764e7e88edcb9f3dd40f9e95a10b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570195, "uuid": "1a9ee4d4-4819-4eac-b6e7-b38410ad2d9c", "value": "T124E48E2031A0D022D027743FDD64D1F81AAA7C25CE686D8B36C92FBFAA7D5C18E1575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570195, "uuid": "375870ed-daec-4015-b752-f214452e149b", "value": "11889ac2a26c28171d8c91a6e27804c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570195, "uuid": "f4a2a2db-caba-4d6f-96df-e0d776e96f04", "value": "12288:BrI0bPKn8p/S0jXgfFWVkMXl2xAgwFX2ddG83tNzZ0XssC82H6/vLyWMA:pI0bP1XWMXsAZX6JcTLdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634570195, "uuid": "d94a9ba0-cc1f-438d-9a7f-e5979364c822", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634570195, "uuid": "818b722a-3de5-484e-b5ff-7e934212a20e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570195, "uuid": "08d7fe77-7b75-4bf6-afca-c2c6e33b35f6", "value": "44487.6724652778.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e744266-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634555532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555532, "uuid": "aaa7f198-7bf8-4b20-b632-af916f756567", "comment": "Malware payload (RedLineStealer)", "value": "fec88756eae3dbb6972089ce8d0f634e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555532, "uuid": "89b266ec-3a23-4172-b619-fe7d2effe6f0", "comment": "Malware payload (RedLineStealer)", "value": "5c3bfe4d99c1d268231d1dba42bc4f9ff95556bed9110817c13c03c49fc198ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555532, "uuid": "82a0ccd3-8c9f-46d2-a7e0-496e730a94c9", "comment": "Malware payload (RedLineStealer)", "value": "09f2ad804cca8c8038da1dcbbfbbb75c54bcc187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555532, "uuid": "fb2fd560-77d8-4a24-bbea-7e3c184e8511", "comment": "Malware payload (RedLineStealer)", "value": "c17ec09f4a9dd785a68f88da00687cf8578a13b036475a48b8d5dcae95e00fa3ee775dcbb376eb772b9e02032bacde89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555532, "uuid": "ae1c5d70-df1f-415b-915a-249061e4b3f0", "value": "T13FD5238682206802EDDB69B131EDDA579D357B814B2285DB102DF14E1FB3BD1AF3D31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555532, "uuid": "1cbd9947-42d7-41e1-959d-8847c65ef462", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555532, "uuid": "2c3bcf39-6706-4dcb-91ee-55f7f26ce321", "value": "49152:jkgXPcxN7zv3zr6/LoPEDSe9TWTWMSJvAxazy5y:jkaExN7TMomSe9TWT7SJvAMzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555532, "uuid": "d20c5f9a-23a0-4ed2-a1ac-b7f6b6b61e79", "value": 2978320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555532, "uuid": "0eed7c12-e62d-4391-84d8-7b0bd16fb310", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555532, "uuid": "af76268c-d276-4a14-9946-7940758f2c17", "value": "fec88756eae3dbb6972089ce8d0f634e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1e172a-2fe9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634543910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543910, "uuid": "7d210483-547e-4918-ac8c-37481c196b88", "comment": "Malware payload (Formbook)", "value": "cdda5b2580b9392c15f9dbf31e194a48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543910, "uuid": "cda52bea-59e5-4f82-87e4-5a31fbe1fbd3", "comment": "Malware payload (Formbook)", "value": "5c4023944c61d2985cc5c50811481eb3cd64d4e3caba1e4f96d8fcc7adf7c72a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543910, "uuid": "503636ba-911a-4cbf-9a9b-90ca9c010f21", "comment": "Malware payload (Formbook)", "value": "8f74a7b387f298192730c46b837d6821d50a915b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543910, "uuid": "5458b661-43e8-4977-8d0f-b79e5a9a4ccc", "comment": "Malware payload (Formbook)", "value": "e961d4555aaa5fd03753cb26bc277565d70102fda7ed0e28ebfacaa4e6fdf3d8bcc6793b8e08923ab0d2db998ecf2821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543910, "uuid": "0875ef38-70ac-4861-9eb6-13d1debc4864", "value": "T1A894128677D4C557C76C0AF468B3E79813B0E8312DA5CB4B4A9E30EE2DB77845E90523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543910, "uuid": "4a7dd600-e961-4c8f-abe0-bfeb9d1426fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543910, "uuid": "20aca307-5cda-44a7-8023-7b7af7bd17bd", "value": "6144:waUwRlfFFS+AwbTwKS/sZ2l1crsWEXDNaRmxp8c3Cn8VOnsKY:woFxdbMKZG1cQXXpWmzj3CnQOnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543910, "uuid": "beb624e4-7d59-4699-be23-1e34426e7032", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543910, "uuid": "4bebfba7-07f4-4762-a68a-28c86824bdf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543910, "uuid": "64440369-d8d9-41cf-a721-c9e19193a726", "value": "SecuriteInfo.com.Trojan.Inject4.17696.9430.31863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec90bcad-3060-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634595338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595338, "uuid": "a862e1dd-b194-4eea-adb7-60e26ea9ffbe", "comment": "Malware payload (SilentBuilder)", "value": "889c424d36587c1c8c04d98a3138ca57", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595338, "uuid": "f2263b8a-27b3-429d-a269-eb4e3cf66960", "comment": "Malware payload (SilentBuilder)", "value": "5c55e4260baeb50255334e42084359907dc6c4da09828060b5f60718283a2788", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595338, "uuid": "6c618e04-adf0-4d65-8ad4-532429f128e3", "comment": "Malware payload (SilentBuilder)", "value": "271d7ca5521a40ff1925b0344a7e50526ab8dae7", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595338, "uuid": "69ea5169-e598-4a33-b0de-d57465eab0dd", "comment": "Malware payload (SilentBuilder)", "value": "8f2c0862b22369fda1a2225c3a4ded693c449b2eb900eb6381959064dcf4227ce00d323c72f17dddd7bd0fbafa61bee3", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595338, "uuid": "10b63c3f-38a7-4954-9cf1-eef82021b696", "value": "T10E44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595338, "uuid": "f4b4a307-9bcd-404c-aa8e-9cfc057c3912", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7a:U9jFrjmkD7IvLDK3vLvfn1+2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595338, "uuid": "bbf2863e-bf32-42a7-96fc-d8f1260ba8ca", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595338, "uuid": "f4e79ca1-c48f-44db-a27b-ff6803bd8937", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595338, "uuid": "90c99775-b186-4c6b-adb8-0b40f80c6ccf", "value": "889c424d36587c1c8c04d98a3138ca57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6298badd-303c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634579645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634579645, "uuid": "36b34800-0cd2-4b29-bb52-f15c3fc4ec53", "comment": "Malware payload (Dridex)", "value": "6b3416e2c517621b5d670800a30d484f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634579645, "uuid": "6ba5c13a-9db7-4529-b0a5-a3abefd00b2e", "comment": "Malware payload (Dridex)", "value": "5c702bade3f8adc94fa5433b35274d28712ea44892d4e37ee4a41deccdc7e1fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634579645, "uuid": "39b2ccb6-249e-43a4-8ccb-eb4a80d270f8", "comment": "Malware payload (Dridex)", "value": "99a6cb09bfbff5bd041b25648f90779f5541c52f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634579645, "uuid": "ff92fd33-22dc-42b2-b263-e13668435935", "comment": "Malware payload (Dridex)", "value": "fe441a773a8bfd27f44340077d3f5a2296fdfd761ff06228140db6337704569d6627ebee357e9991071a73b5c16514e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634579645, "uuid": "470998b0-8f31-4af0-b007-4b9874725986", "value": "T199340EE16075DE74F98C0FBB00173F1EBAD81A40C66E42D8E7A147D2927B7AB30999C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634579645, "uuid": "8e9b36f0-70fd-4acb-aaca-c479486b34cf", "value": "0ebde65b3dfcb0fcfb0a3a0485d4c13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634579645, "uuid": "3bb0141c-6c87-459d-bf56-37cdacd5fc14", "value": "3072:umMHLYjs2g+ciAlYDyOWIsh0pMf+66C4FxTdCU1byGkGcyXDTEWlDkr/:urHL+tg+cGyZzheB6b4fJCwb8d0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634579645, "uuid": "66189acb-5d04-4831-9f38-043d3de04248", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634579645, "uuid": "d00a10c6-4691-422c-b9fc-1cb803d3f4e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634579645, "uuid": "5f9a5ff5-eb43-41d1-8ebd-c039f2027de3", "value": "3_sbs_mscorsec.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d38f732-301d-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1634566214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566214, "uuid": "51d19bf5-94f6-4ca2-9d38-72b318a24c98", "comment": "Malware payload (NetWire)", "value": "400fba5ba55de726ed484ba680e74500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566214, "uuid": "3ac59c11-8a38-4a1b-bd29-ccc3d24526a7", "comment": "Malware payload (NetWire)", "value": "5d91391caa4520c281f6b5cab65914417fed0445d836067c7f70c77795417af6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566214, "uuid": "3b98fc37-4a12-4987-811f-4ecd200c39c3", "comment": "Malware payload (NetWire)", "value": "47162d96f3a19e579cec5413fb88246a9a3a8c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566214, "uuid": "3865bed2-16e5-4cbd-af53-2e5ad5be6399", "comment": "Malware payload (NetWire)", "value": "120ac833e1d384e3780ea86fb8a83d8ca9947e829acc2d701218f0a090bfdf8f905009d307c9e6470cd83970b8de7869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566214, "uuid": "3a688a84-d7d3-4f53-a6c6-2af9b3fca4c6", "value": "T189264C00E692D139F8E100F95AF9AABC9D387670273410C792D47EEE7A15BE56C3099F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566214, "uuid": "b39ba56e-f257-4765-9f9d-44748807a018", "value": "444a63419f2dc4d9905ad6a923b878cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566214, "uuid": "3be0b5c8-9caf-4369-9ffa-ee2f4337ccc7", "value": "98304:74AqGkgAo0Gkuv0VrN2OVDv4j24lilj1qn:74vlPqsrNAi9Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634566214, "uuid": "2b86c763-e28a-4550-b9b0-d77131d2007a", "value": 4592128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634566214, "uuid": "0f2eedc7-359e-44a0-a501-0efa5611f701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566214, "uuid": "59d0da9d-e02b-4eba-abde-018befb94a7c", "value": "nett.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadfe335-3023-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569029, "uuid": "15db71e6-2c53-4ebc-be75-730e59389141", "comment": "Malware payload (Mirai)", "value": "df95da2b546d6e2a770af1c716ee0cd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569029, "uuid": "3e2b2cf6-319a-42f8-b664-cdbe8c8e4b9d", "comment": "Malware payload (Mirai)", "value": "5e304ed5cf198cf6bb7ce1b1c90a13827c16da6f94d31baf59a89e2154537c6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569029, "uuid": "5be80380-4337-4d8a-b003-d5832749fbc2", "comment": "Malware payload (Mirai)", "value": "3cf59d6962b05ad5474c17ab08c2f34333efc50c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569029, "uuid": "0c374e01-00ab-4288-8781-7390b2d65399", "comment": "Malware payload (Mirai)", "value": "61e1b8c2af7838e60126746f2fa857c5a4a412c91ee364f2e0758ae57f1ba5725a600c4e7b9ab069e8df855a3b102751", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569029, "uuid": "08933f52-edff-4557-adde-de89f6dd8d98", "value": "T1AB735A01B3584A47E5A61EF4393F1FE197BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569029, "uuid": "7b4c6e74-2a0a-4a38-a1eb-3b2b278a021d", "value": "1536:DNpp9RXI1vgi0uvm8zomzrKRyxOReqpNiSejOjNfXM:Xp9djCNomzrE2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569029, "uuid": "9407c17d-aa63-45af-851d-75adfbc76476", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569029, "uuid": "c71b2277-f2d1-452c-8bc3-feece51673db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569029, "uuid": "77f30a1b-2427-41ee-bc63-c4dbc2d01198", "value": "df95da2b546d6e2a770af1c716ee0cd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a389bb5d-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561285, "uuid": "577576e6-9586-409c-9bb7-b20ab14e29d7", "comment": "Malware payload", "value": "7910660e7c8cde6186cdc8ec32a68ab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561285, "uuid": "6d0f819b-77f8-4949-983f-380d1fcca4fb", "comment": "Malware payload", "value": "5e6eb6ba3cabd09dcdfd27fb1360f7f2380164b76aa3bff13f5d11428c555ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561285, "uuid": "d658fa88-f53e-4cb3-b389-6f21cd6cd51b", "comment": "Malware payload", "value": "359ee9b74fb8cd05c97462d8876d1afc5c5e77bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561285, "uuid": "7d7d7009-4dbc-45d5-87b6-9e2ccf9ba46d", "comment": "Malware payload", "value": "554637da61bd000981043a26a5a15bb6299e7de458cbabf70b382faef725e5e8e87f0cc3402253e7bb0bd1fc7bfeb852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561285, "uuid": "3c3b4dbc-6881-4c76-b2b4-22948dc7659b", "value": "T126A4F10172698F22D9B557F68438A16303727D2781A1E28A5EC1BDCB3E78F82857DF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561285, "uuid": "5ac141af-5010-4c01-9063-c1fc8fae70b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561285, "uuid": "a88974d8-6256-4976-9525-8a03b029eca0", "value": "12288:nimG4mhcKCbEIGXL1ke4r5I0nf+8l7Nff:n9mFSZGbOI+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561285, "uuid": "35879f90-9707-4389-9299-bda05709db06", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561285, "uuid": "1820c546-0eed-443b-ba7c-ce0889622c85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561285, "uuid": "9bb02520-da21-464b-ba2b-ad3d419df3d2", "value": "documento original 7910660e7c8cde6186cdc8ec32a68ab3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd69bfee-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1634555772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555772, "uuid": "0bc1d2e7-85c9-4e02-bfe8-338d6952be9f", "comment": "Malware payload (CryptBot)", "value": "137dd682930e7c176439f7ce3a614b6a", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555772, "uuid": "4a4cd84b-afb4-4e67-af6a-eda8161f7551", "comment": "Malware payload (CryptBot)", "value": "5edbd772846ecceb185162e2dcd4cf76e4bb9dc3899707130c54b1192d0e1f71", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555772, "uuid": "7e43fdde-76fa-452b-8eb9-01814df51503", "comment": "Malware payload (CryptBot)", "value": "2b24ffd988796c4423ba3f0147c126a356635b97", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555772, "uuid": "135ed2fe-77dc-4bca-a206-c8b0e55dd022", "comment": "Malware payload (CryptBot)", "value": "0b9cfe58d5e8736b1852a3a0c9d96faa5f3f0bbc00bc0a069c7c8a0dbf93e04999a44f4357b11bb99b1e1155747499c0", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555772, "uuid": "4227a9d4-d147-44ab-826b-56e196b96882", "value": "T1B494AD10A6A0C039F5F352F989B99378A52E7EE06B2450CB63D51BEE97359E1ED30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555772, "uuid": "1f503607-8544-40bb-adea-838f878271b5", "value": "bd3694527adf0e2f58ae8cb4e18ad5ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555772, "uuid": "9c7468a7-5390-4537-bbe9-3b962d66b4aa", "value": "12288:NKjMi41OeSU0KDOIH8sPkkd8xMhsb03SU:NKX41r/OrsMMhsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555772, "uuid": "fc58bf9a-42de-4622-a726-046af672da82", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555772, "uuid": "836c5610-3fa2-43b1-90ea-4a0ec24e234f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555772, "uuid": "b1b2e146-c9ea-4b9d-892a-d89db15a9e87", "value": "137dd682930e7c176439f7ce3a614b6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31011b75-3042-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582138, "uuid": "5cbef546-6c7b-4242-b8cd-f5be7ea40aa4", "comment": "Malware payload (Gafgyt)", "value": "8c5190cd997bf310db43cb4cad6b1879", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582138, "uuid": "f7d003df-ab0c-4722-9368-69e067b236dc", "comment": "Malware payload (Gafgyt)", "value": "5eed10631ad54d4031c885e1f230295e19a57f68c5523edf37ee5afd79cc2505", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582138, "uuid": "395a5063-7e3c-42d9-aaee-7ca652a43afc", "comment": "Malware payload (Gafgyt)", "value": "2813eeffbe24b7e0b823f2cbd461237109436015", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582138, "uuid": "12f63bfa-d6d6-4f1f-9d40-e03468740000", "comment": "Malware payload (Gafgyt)", "value": "aae2cdc6ed4d0351727b0ef41d9ff96a7b6eb4e4527c54d2ebcfac46607dae2f75a45d19566eb2cfea33a59f7bc32389", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582138, "uuid": "07452282-49d0-45a9-9b7d-b5f0814d59e7", "value": "T1D4C3A617BB618EB7C84FCE3306AA4601118DE59612E57B6BB2B4C96CF74B84F08D3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582138, "uuid": "750e33e1-8b1b-4b43-8cb3-1989baf65764", "value": "1536:lLeT8O9A9LV12ejMQZYXvayQg5ao7d0r5h5ddddd9U9XyElwmeFfkq+QCyRnVgj:ljO99ejjt8aV5hNfElwmeRkq+QXnVgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582138, "uuid": "8341f768-501c-46de-a21f-8c94a926b6ef", "value": 126905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582138, "uuid": "82810751-665c-4b67-8c22-17e91a6feeec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582138, "uuid": "d052ba3c-d125-4129-a901-a2357ff5f4bc", "value": "8c5190cd997bf310db43cb4cad6b1879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecfcf7e-2fd7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634536205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536205, "uuid": "25b0cbfe-d6d3-4729-bbf6-3852a94e17d2", "comment": "Malware payload (Mirai)", "value": "7cff8cf238a83b7b4d6d3eb3ed653083", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536205, "uuid": "4e430ea8-23fd-408a-a8f4-4db464419238", "comment": "Malware payload (Mirai)", "value": "5f2b0bb5959ea2ca21a84be2099311480d93174bafabfbcd96163846bcff9356", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536205, "uuid": "9666487a-5fad-4150-b5f6-db510f3ba08b", "comment": "Malware payload (Mirai)", "value": "6b0ee07fec5a736bb601eacacd84c746861cabaf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536205, "uuid": "a278b084-2d01-455d-9d66-90054a8e6f01", "comment": "Malware payload (Mirai)", "value": "1900351bba857a6747a8b85de817f1ff77ec3a1937ba40ae41568b2837b71ceee2bee5c017dfaa758ca206740dffaf20", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536205, "uuid": "0e4b6d3f-8590-4712-a8ba-8f651ff8b2e4", "value": "T1DB13E15A200DB566C7A414B5F93C858247A71938E08832FE5D49DB92F2836029AF07FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536205, "uuid": "abdcda23-2c6d-4672-a9fe-a343d4c5d952", "value": "768:3uv/RcDyFI/OhqdOQFFcGdyvj2VppaDa/Sevz4YfasHgo8X2a6xShTEs3Uoz+:3abhcXFEgpMDkSevzp6o8XVvz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634536205, "uuid": "36061562-6183-4634-98d8-4fc9c68fb1d4", "value": 43992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634536205, "uuid": "6d79ebc6-e516-403a-8f8e-d6b4843a6b81", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536205, "uuid": "f053a899-69f8-4ff4-b11f-eaca52c11b4d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd03e36-3014-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634562702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634562702, "uuid": "01a119ff-5c07-4656-84df-a4462d821b38", "comment": "Malware payload", "value": "ef0fa5f2625f8a90a2ff6d9dcfe40476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634562702, "uuid": "95357b12-0e62-4c28-a7ed-357e4ce65869", "comment": "Malware payload", "value": "5f513f570920656940da02d9261cf46122292510aa61b2e21a5828a2e1d95200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634562702, "uuid": "693398ff-533c-472a-bf49-0326416b4d8c", "comment": "Malware payload", "value": "623f9325affd8c191642dc228c4a8961619eec71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634562702, "uuid": "6c484d23-5974-4ca7-b84a-b330a1e1cbda", "comment": "Malware payload", "value": "ee4855a806c42c1e7eb537c3b85f44ce91aaf134e0459a79dfd1c1870001886f23d9056ef36b8d8b1302d16688ebabdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634562702, "uuid": "8050f127-e70f-4427-ae94-ef32a46d1451", "value": "T1A194E11172698F22DDB513F94038A26307B279274070F29A5ED1BDC73A7DF82867AB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634562702, "uuid": "cede0d5f-c6db-4ef6-89e0-f6e54c89b4af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634562702, "uuid": "08288210-62a7-4c53-a240-d390c47f2382", "value": "12288:wZgGgIkPq8IU8C1N2eD5YqOdqPw5ILc2+3ANUNZ:wl25LzDmAEZB3NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634562702, "uuid": "8d7b1d14-39f1-446f-b441-6038f3102fca", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634562702, "uuid": "ad4b660a-ecd6-433f-b949-d67353eac50c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634562702, "uuid": "2d7b5b64-dadc-4c89-b629-ae22a62b9a69", "value": "RFQ-033031-GCMGULF-SPS-18-10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce86e98a-3004-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634555774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555774, "uuid": "bf856405-041d-4783-ab26-e5d9668a6670", "comment": "Malware payload", "value": "3eceac4a10a0ab1d4d87b8801eeb29c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555774, "uuid": "47c54c04-e0a8-4fa6-b5a6-f8ca5f4b2b2f", "comment": "Malware payload", "value": "5fb8396d03cee9764c93ff69af0add623e125020975259663e19ad52eceef03d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555774, "uuid": "f0e55bf0-b629-41e4-b7e2-ed3ac621ad84", "comment": "Malware payload", "value": "4054dfe9753330784a85ac093e414033dc0b443b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555774, "uuid": "831e2b67-06e0-4a64-877f-ace2384606a7", "comment": "Malware payload", "value": "cfef8bdc5e11bdf033f697fd84344f2908f37387ef7ecd6e0f5cf272381946954680fc14650b478cc5b70dfb53194f16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555774, "uuid": "1f651e54-e70e-4dd6-adaa-749f7424c256", "value": "T198F533D30E245BAEC56CAB361BAD4B7DA0D1F3C6239BC81D7A1F9CB85071D0F46A9184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555774, "uuid": "ee9a5cee-1d41-4b89-b46f-bc8bef3bc219", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555774, "uuid": "de0f1fc3-6a91-4ca7-89aa-f9c3873a77e9", "value": "49152:mNXOafI8Zro5LbnHPLwT3qDPJuYeJ5VE+fnrn7cLMbou8Io3Nco7gcxoSLfrvN0S:UAYropnjw72QhP98lA+DDmPADONLyzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555774, "uuid": "7a6b2c53-ca42-44e6-87b4-9462d5317046", "value": 3463168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555774, "uuid": "961a72a4-fa41-4224-ba5a-1be07af0043e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555774, "uuid": "81ddcbaf-19ff-414e-9a47-e7f2f71208a5", "value": "3eceac4a10a0ab1d4d87b8801eeb29c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4cf494-2fc6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634529007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634529007, "uuid": "f6cb3cfe-581b-433f-92b4-d47ce7f705ed", "comment": "Malware payload (AgentTesla)", "value": "ab7585441ef37e3becc9e16291c9a183", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634529007, "uuid": "a6475ffd-1379-4e47-bd88-59b6f59ceaca", "comment": "Malware payload (AgentTesla)", "value": "603f8bb918cf97d86b4e20c72ebd9138160475c24e7633b5cc4f7c7739b0203d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634529007, "uuid": "2721bfd9-9b3a-4d88-8005-4ce456168e24", "comment": "Malware payload (AgentTesla)", "value": "6d734d333844615524faad5ff0c5c197998e0e95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634529007, "uuid": "6a52b5bb-71d8-44f7-b01f-d9b98b1fd9f2", "comment": "Malware payload (AgentTesla)", "value": "fa612c4b5a63f03bf1805f41cff50227eb72718c991728628ca2a477e9f7705b28821df7229f87d71114c9a68d0e79ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634529007, "uuid": "955e2b0e-c046-4aa7-8226-db21d6e6cfa9", "value": "T13CA412196718CA27CF5D06B974D2938053B8CAB12E42D7471E8A30F85EB77C45FA22E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634529007, "uuid": "8d44b788-f7b7-4a5f-9b77-3be340e297fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634529007, "uuid": "5aebe6c7-67e5-4a0d-974e-15855f943279", "value": "12288:MQ/qklVU4BYcaU5JXr6JuKwCXPwovbp6XKtcAtWAp:M6qYNBR1NmM8XPwMLcMWAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634529007, "uuid": "8a975391-c42a-404e-a4f4-6f486f000b28", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634529007, "uuid": "aaf782bd-a538-476a-a9c2-60e1b8e20fc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634529007, "uuid": "3e02781c-a069-4604-9a47-3a2c2a1de325", "value": "money $.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ada6af-3067-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634597989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634597989, "uuid": "57aecd6f-d941-4f79-a4ec-a33e52accfad", "comment": "Malware payload", "value": "3866db259ee7ea78b4428bd10e62b7bf", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634597989, "uuid": "5f5095d4-e775-4bfd-bdde-01b4e4a70752", "comment": "Malware payload", "value": "604cb1622f9c7f97e91e3a44375d87ea4b223775eb6bda335cfb523b3d209251", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634597989, "uuid": "90cfa79b-55d7-4e3b-81c5-a714a3f0ab37", "comment": "Malware payload", "value": "df9eb88cbfdd23a757186e3078bb3a58cf565aa1", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634597989, "uuid": "9eca63af-0bb2-4fe7-9d44-7801f335d5a7", "comment": "Malware payload", "value": "ecc4aa8e0e324c85d76d3f7a400b924efe4c867a9f44f66a735d4fff6356ccb0be657b2b4d9d25252ccbe05c6a012e71", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634597989, "uuid": "1567d5b0-a7a4-4111-b9ac-396ebc393298", "value": "T10A54130E3536B01AC471C27D5E1C629FA20E7296932AF7AD7A4CF87CD7441A301DEE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634597989, "uuid": "2463e2ad-e7c3-4591-8965-548385373998", "value": "6144:Vc35LWHd0i9GLIgK2JpjRqHOyVUEh/FHuwGLDmFG3Vt7x10Z4Ty:qNWHdoNF0uiZhN+WFQt8me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634597989, "uuid": "7060e465-0fdd-4ce5-aee9-dbcd3a9f265b", "value": 281418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634597989, "uuid": "74f56f8d-d55f-4086-b8bc-0c718ac1d4f4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634597989, "uuid": "069f330e-9c61-428a-a282-73cc74d217c6", "value": "SecuriteInfo.com.Trojan.GenericKD.47064959.24952.5466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc4df19-2fd0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634533222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533222, "uuid": "f1a3fe5f-8226-449b-8196-955ff318435b", "comment": "Malware payload (AgentTesla)", "value": "1321759f6a6952194d9180c004350d02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533222, "uuid": "0d089c4a-c4a4-496a-9983-ba7663378cb9", "comment": "Malware payload (AgentTesla)", "value": "60887ac5c32a7f35bbfaae27d1d9cd79bfdcc667914ad9be3d3b90aaaaf7af5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533222, "uuid": "94264a6e-43fd-4c85-97ae-bab5a8726f00", "comment": "Malware payload (AgentTesla)", "value": "4c00a9e7c679eb9e80061838b631e5ca42d9b6d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533222, "uuid": "4f45ed9b-48bb-4dc3-916e-6db7e7e22db6", "comment": "Malware payload (AgentTesla)", "value": "089680a14c472259f6f7a2aaaa7c9f262d04d08351402ed95af1a1ad7a7efadc755d946eae6c9a152380a520418e9197", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533222, "uuid": "e8c994dd-964e-4589-8157-7bbd23147648", "value": "T1CF74C0B07A11929BE9BF3DF09A93E111561EFD8C219A82837FE13ADB457C5E48D10C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533222, "uuid": "a5154f7a-ede5-41fd-b52f-e11ca168ac7e", "value": "6144:UBAIuwwRmDDDDDDDDj34fDDDDDDk7BbDDDDDPUUWHMM3FkQ3dmdUzuUfIN05l8B8:qik7ZWsMqymdUzuN05mZ4SuD1GEEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634533222, "uuid": "2ed8a913-2f24-4043-9c12-e1d325c7f798", "value": 351400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634533222, "uuid": "a8e515bf-a66b-4a48-969b-0635b885eef3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533222, "uuid": "d20d02fb-4789-4e49-a645-4495ab6a07f3", "value": "Order EQE090.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f32ec73-2fbf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634526006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526006, "uuid": "f8a7346a-d2aa-4b71-930b-9b13849bbdea", "comment": "Malware payload", "value": "cf3a7b84f6269b92a0778473643d9c10", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526006, "uuid": "0a1f8257-aa20-4f03-bc5e-f765589edaa0", "comment": "Malware payload", "value": "60cabdfe7574bc0d65de39e38892c3ce289db5676e47c681235e6c22a2db2725", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526006, "uuid": "8b7211ed-c66c-41ec-855b-122b84a3be74", "comment": "Malware payload", "value": "53630d2323753c9dc4a7c61300327aeb64a60208", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526006, "uuid": "48e57ddf-308b-40dc-9f24-3301a5a5759a", "comment": "Malware payload", "value": "e81923ddf2e9e9cd5931ed50b1a4ae7f3f3c1943390424824ae324bed989e731044186e884624f9a7ae7fbe549182f24", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634526006, "uuid": "74e36f64-0f0d-4506-8cbe-3aee4aeb33c3", "value": "T1B6D2D07295F5895CD1FA0431297D768E6358D13C5DA164E2AFC9603A0470BAB3E3B38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634526006, "uuid": "276a152f-352c-4f7d-a08a-cda51c942c32", "value": "768:HQNQcGgJ7bkLP9M4VOtrreTnV3Thy+TsnWc5kmfnbcuyD7Uryqi:H0Qc3bkLP9pVOtC31yIefnouy8mqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634526006, "uuid": "0ad6b1bf-c983-4e79-a0bd-fdb12eef64c8", "value": 30860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634526006, "uuid": "582c923e-e433-42e3-9b38-629ef4d5399f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634526006, "uuid": "5c172477-0b19-40a5-8ba6-3cf4178ae469", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5c5a6b-301a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634565003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565003, "uuid": "cee48f9f-dcfd-4253-a7b3-7a4876616b9c", "comment": "Malware payload (Mirai)", "value": "78ab37a74c7f0507cc920f8da7bc98df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565003, "uuid": "28a58b68-6c32-44d9-9080-fb4847d36671", "comment": "Malware payload (Mirai)", "value": "616d5959bf869a895679e1ce54af3ac3f0a770614c2eb43482119f11256aea80", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565003, "uuid": "3c8cf966-9d7e-4242-abc5-07785983feab", "comment": "Malware payload (Mirai)", "value": "b162d313e05a4f89b7b6a16f0a26f9f5489018bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565003, "uuid": "f90643c8-c08a-49a9-a938-beec05c14724", "comment": "Malware payload (Mirai)", "value": "b8c2ab8d71ec141512e9993080d2c5863e11eec4004d60a7686e0800a888d74f3fdc2ebb9a5d363380d08555e3234905", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565003, "uuid": "c0273bfe-2347-4814-ab53-f8673110af73", "value": "T19FF33C46EA418B13C1D71776FA9F414A33229B94E3DB730689286BF43F87B5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565003, "uuid": "1980e3f0-cfa0-4db1-b119-8323fdd3dd57", "value": "3072:dUW6GNytohMwMh4uaWGLKWdwffuSFYEJPdslWM/9OalM:dDVytP3SuaWGLKWefDDJPds4M/9OalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565003, "uuid": "3f2eda12-86b2-45a7-bcdb-8c88b5b7659e", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565003, "uuid": "29563227-a5c6-4d08-81de-39b90183fb74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565003, "uuid": "6ba9f1b1-1f2d-4e8e-9b69-0c905c7488aa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0736991-3006-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1634556636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556636, "uuid": "58faa0e7-b51b-4d55-92da-e90b4331c132", "comment": "Malware payload (NetWire)", "value": "a6d253e02a22e26939f3d775ee1127cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556636, "uuid": "4eba31c1-6441-4f4a-88c7-24dbe99a009c", "comment": "Malware payload (NetWire)", "value": "61722636c5cad31d212e7ea1da55d4fde3a7e93fc46f81484dd7597a684a8164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556636, "uuid": "a3954196-782c-4f43-80b3-4fc0ce1c7651", "comment": "Malware payload (NetWire)", "value": "a8e827a9c4916a4b85e5e783764173df0dadd116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556636, "uuid": "c92a58d1-0bce-41a5-b512-2d0063389a41", "comment": "Malware payload (NetWire)", "value": "0cf8266d8c3b255a9ace8191034acb2706044a0851515fac2922bcc277d9b22581a97f340d6f934a82feb9b263d94a68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556636, "uuid": "bcaddd66-7fd3-4b16-b725-3afd0c3bc096", "value": "T1D7C3FDAAD90B6DD8E476117F142A3B3C1617AF9A505CC487E0BBB21ECE76ED22051F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556636, "uuid": "fc6cb034-117f-4701-aa79-38feb12afe2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556636, "uuid": "0be7f299-9989-4cdd-a8c6-0592151a0b9d", "value": "1536:cTCOJOQA7yTatlYBMcnAXqPprska5ayVD:cTnUyTatnEAaPpa5ayJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556636, "uuid": "e16b6327-3370-49cd-a4ca-4042176271e9", "value": 126464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556636, "uuid": "3911f9e3-1688-4bb5-b558-140b1f396089", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556636, "uuid": "d37e9e45-6318-42d4-bde5-80601eaaf7ad", "value": "Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8161af04-300f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634560369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560369, "uuid": "4d7523e2-cad7-4fe6-8ad3-d121978bea26", "comment": "Malware payload", "value": "fbd950a2f1724512ec9a8bde231fe7e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560369, "uuid": "29cdb618-7457-4c7d-a5cd-431730148be5", "comment": "Malware payload", "value": "61b8cf060cbb3f706fb7b33d1aad68c86a433c5ee159ba0e8d8ebd902253c215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560369, "uuid": "c46ef57a-48e6-48cb-9986-3b2772266000", "comment": "Malware payload", "value": "4ab3a0b2952de2daa3807269fe71e71f1c36c77b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560369, "uuid": "fc3a5716-9cb7-42f5-a3b8-3cc367a3f429", "comment": "Malware payload", "value": "b9c05348e4f421989f302d05fc72f2e044ed681f8d918f3f150e41fa1092c31297cff78043e519b72c904ac91ae1f8fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560369, "uuid": "88b799b3-f132-4fe9-878c-4ef97f94a572", "value": "T14894F10171698F11C9B523F5803895A34777692780A1E28B5EC4BCCB7E79F83867AF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560369, "uuid": "bfa2ff50-0328-449d-8584-a8a8e73b7c7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560369, "uuid": "e03b31ad-b9db-42f7-b5ef-601e5cafe3a0", "value": "12288:Vh6GgFbWgMoRu1rGh3QeZIfnOnTLOtLrfF:VMJu1rcAoIfnmYrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560369, "uuid": "e4ebabab-2204-4d02-be77-b91cabc14365", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560369, "uuid": "6380039a-bd7f-47f9-9f40-f6c52b9706ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560369, "uuid": "c7048141-c8e4-401e-b780-76ba109019e5", "value": "RFQ#0890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbda1cad-2ff5-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634549300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549300, "uuid": "e845b3b9-06d7-4d30-b8c0-96d89ab7503e", "comment": "Malware payload (RemcosRAT)", "value": "f33872316d9baffc6db059fb1e42c123", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549300, "uuid": "33369046-8724-437b-9094-6f5d87940258", "comment": "Malware payload (RemcosRAT)", "value": "6319874e19952a8a79c67c05fa4defc658be81ebaf97fa27f2961553bd8002b1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549300, "uuid": "74836764-93e7-4f8c-9064-d985b16f4ff0", "comment": "Malware payload (RemcosRAT)", "value": "3071411dac99c5f616d0f7b0f6ffc3e49bc03a69", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549300, "uuid": "9ff7a284-a89b-4db6-8365-fea68c6eac71", "comment": "Malware payload (RemcosRAT)", "value": "cf29c9d52bd1fc095b334a43550ca5d551dd1cba0f61a0f79cd20643c174ac4302a037ece8237e7c8e5a7a530472d5a1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549300, "uuid": "7f6977c7-ff64-43da-b028-77cfdb0ea172", "value": "T1AE05AED1C7E2C53AC3653C7E8C0B2DA6455CFD942D48648D66F8BE481F3AB41A46738B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549300, "uuid": "0432a58e-de82-4f7e-bf27-266182e7f639", "value": "9d6254f1666ec7df9c70515cf5807dca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549300, "uuid": "6292e866-f701-47da-80fc-e4183d048a5c", "value": "12288:ngXbE33TJYei20w6R5ghlWIWeeP5fzqzqyjFPKncY:ngXozJzix84eePwH56c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549300, "uuid": "7d44f36e-6a98-4ce6-9eaa-c2b0c13a7f30", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549300, "uuid": "93e6f3f7-3a28-4f67-8705-c65b451e7c5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549300, "uuid": "3b93200c-eb50-4e19-83c1-ed68e51da364", "value": "DHL_101821 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ec939f-3007-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634556771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556771, "uuid": "35e735f0-2ab0-4e49-bd00-066c4a4f564d", "comment": "Malware payload (Loki)", "value": "30dbc7342a021fbf1f85b6471b857007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556771, "uuid": "36945049-ee77-4e5e-810e-06362bb52c7c", "comment": "Malware payload (Loki)", "value": "638b7a24c7fa7fd0a3198c814de97b3c37b9477e8d349bac98672afc7d8f8954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556771, "uuid": "a0d27bfe-ffa9-4d33-b978-6211a3605d3e", "comment": "Malware payload (Loki)", "value": "b97902849786a321cdcc0c2ac93e606d668c2f83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556771, "uuid": "9bf43af5-cefc-41c6-81f8-cc8d4a123334", "comment": "Malware payload (Loki)", "value": "013186aa17c2535134a02cd3f5445a20204e015eaa96690796bd1dcd0a08bf17cb90d3a5443408220bd726132510efb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556771, "uuid": "c42fceb9-27ea-448d-bb1b-5889cf800718", "value": "T12C7401117B84C227CB2D06B4A4E2E3591774A1313F55CB2B5ECA38DE5E73B846E906B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556771, "uuid": "22e73292-30c3-4e0f-8136-10a1f0074b00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556771, "uuid": "a1a282f5-70a9-43be-80fe-3668dc36de87", "value": "6144:jkFmha/bTs8r5Djg+pFO1UITWw3zJL3fY:oFKaDTs8rJDcTWUFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556771, "uuid": "6839cb37-6d04-4e51-9ad9-707f3a5405ab", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556771, "uuid": "2bf29f81-2dcd-4f20-aeaa-633ad3f81fa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556771, "uuid": "fc08cf58-1d41-4f49-841a-fe455a91830b", "value": "Request For Offer 18-10-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939e78fc-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561259, "uuid": "2be740fb-400d-4f67-8736-1cb3ecf08a08", "comment": "Malware payload", "value": "a06afb86be845f9d8d7535431763bc9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561259, "uuid": "90cb4cc3-5643-4d3b-a8c9-cf3db98c5f33", "comment": "Malware payload", "value": "65b227a9a6fe8ab2cd7468ec0c593f540ac48a3a5e794f09a5bf4e5455ab6143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561259, "uuid": "477d1c2a-b699-4de7-a4bc-daecfe7fb60b", "comment": "Malware payload", "value": "f4d1ad7189da9a67d358e3b1bac4f079ad3805ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561259, "uuid": "4bf1c966-ea3e-4fd2-b2f1-32f191d2e37b", "comment": "Malware payload", "value": "e55d4a4e653746eb3711e5ece40da6f81ced8e1a490abd13abdcef4118b471d4695cf37e47cb1365b5e22d5dad711acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561259, "uuid": "d1965cfc-8593-494d-9a82-30f385850263", "value": "T11494F00572798F21C8B857F84078A1A347765D2381A1E18B5ED17CCB3EBDF83856AE27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561259, "uuid": "cb2c6cb5-f92c-48e3-b7bd-5a7a63333b9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561259, "uuid": "9b197abc-ba62-4e08-8d51-c0703bfec4be", "value": "6144:ZRTSDZ1G/9LhE4Tvd6sypxZ/2ujUjIK6er260EjbwlC1Cxa7vlssJlowL/wONZDH:ZmjG/97wvpxZGc7yfT8+dssX5/hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561259, "uuid": "fef0123d-9560-415e-8688-e11dff28c4fd", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561259, "uuid": "fcb7d64b-2751-4b28-a45c-2a39a8f35f26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561259, "uuid": "e8cd9218-586f-43e0-8ba4-07c94aee1f4c", "value": "INQUIRY FROM_THANH NGUYEN TECHNOLOGY PRODUCT_LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b51f45-2fea-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634544374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544374, "uuid": "57d8da03-fd0a-456f-aada-7cb736fd5521", "comment": "Malware payload (Mirai)", "value": "24e31cca39797e826333b74a83dc617e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544374, "uuid": "f33904ed-3503-4be0-b1f7-d162c57cfa21", "comment": "Malware payload (Mirai)", "value": "65c27d6a0c75f9cf81d93dd78ec744d29dfcbe72ddaa108e678ce52680b5c94d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544374, "uuid": "4762bdcb-525c-42fd-b44f-849d12808465", "comment": "Malware payload (Mirai)", "value": "8e6c79c54cc47170a3d5b342f20e78f037de06c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544374, "uuid": "cd7a6518-af26-484c-841b-ebe698ff8d65", "comment": "Malware payload (Mirai)", "value": "63cc62ae369408275af9b4081dd2dbc6fbdecbf0b479ad0358f1410b5d1ed801c3065eee7d1c984fdf7a526e4517ec70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544374, "uuid": "1c30b2e8-37d5-4cb0-a401-aa48f0cecd1a", "value": "T147E2E1647B9AC031C3B0B8B0C869944E6A984BB8D09DE973F6589D3C76476CF8A331C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544374, "uuid": "952f5a36-a651-4675-96e8-aa580725022b", "value": "768:RO03tZGaNx07aMHCu8mdYEcDB4lFDReZ9q3UELa4:ROV7aJu3JcqlFD9LN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634544374, "uuid": "e879b8a3-1ae3-4600-af97-f3fb3af16e6e", "value": 31676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634544374, "uuid": "19b5928a-8397-42ea-a8ea-449d11e7bd3e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544374, "uuid": "5e22b71f-e64d-463e-b84c-6faa6decd985", "value": "24e31cca39797e826333b74a83dc617e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f49ef3-303f-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634581097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581097, "uuid": "19ff21ad-e064-4c5f-8bf3-ab761cb56e2d", "comment": "Malware payload (Metamorfo)", "value": "235330c027f151c8dd93d7ce570fa1fb", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581097, "uuid": "4160a80b-9b5d-4f02-b1f4-bd3cf692ce6b", "comment": "Malware payload (Metamorfo)", "value": "671d5954a17da18cd6e425feeb6f7ddaaf18b8d5a670ece9d5355476e366b467", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581097, "uuid": "7770897b-5c1d-4afc-8d82-2b97f16a5ba7", "comment": "Malware payload (Metamorfo)", "value": "aa01ed023051d7de222610fd6464faa7e9344a54", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581097, "uuid": "4d386ca3-548b-4244-99c3-36bc253c14ea", "comment": "Malware payload (Metamorfo)", "value": "62e0275d49c712f05dbd78f56a44669101e58e6b6ba46fba698e6b52a886d7f33aed09b4a46d79c4f8e2879db9a94175", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581097, "uuid": "436067ce-bf0d-4b6d-8753-b32dde427cd3", "value": "T1D341EF052AE70325C3B3CF7A28FAA2968DAEBD51AD535F9E408057CB1861590EC31D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581097, "uuid": "9c9e0822-f0bd-4e84-98e3-676e276dbe85", "value": "48:8+uH+M+LMinzTa2Hy7Ge1cIXv3KaIqiHkb6NS6:8+ueFLMkm2S7x1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634581097, "uuid": "a3e6ac5e-1c80-4aec-9a5f-5003d185f2f5", "value": 2054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634581097, "uuid": "55f01f4b-0e5b-4311-87d6-ce68e33f8cda", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581097, "uuid": "e0f03d5a-7519-4daf-8689-281096a1acda", "value": "Foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c9becc-303d-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634580001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580001, "uuid": "01149032-e7f1-4ac7-8157-feecec33efb9", "comment": "Malware payload (Dridex)", "value": "12e2b3b7496802dc7e43d1f33c7d49f7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580001, "uuid": "a9c25f91-c19f-47b6-b4e8-f651ab64ac2e", "comment": "Malware payload (Dridex)", "value": "674ea6b589e099d7016e6a0819c93c40635dad688c56bbe88864b17f8c2aba6a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580001, "uuid": "830ab85f-fa4d-4216-a426-14c5743cd9a5", "comment": "Malware payload (Dridex)", "value": "464558590e747b94ed79104e0f96fe3d8c183638", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580001, "uuid": "c2fb1f29-876e-4432-81b0-0697083c15ce", "comment": "Malware payload (Dridex)", "value": "59052a926415b85c119d88cfa7b3ad8c3ef669b4f95542c2c890547f3c7d4f6ec836096f985bd59ffc9b794e2356a7be", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580001, "uuid": "7898a384-a7c6-49d0-b686-16f181983d98", "value": "T17304D128E76600C5EDDF0D7A130DF32ED4BA1D066341C5BDE90CE762A224F29A97E365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580001, "uuid": "923cd5ad-95ca-4c89-8877-d14886b9011c", "value": "adb0dd6ace4ae202db9532637ae1959a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580001, "uuid": "8413d2ae-0ff7-4fe8-b9bd-3a94d29f779c", "value": "3072:12E9O68ciPs9BrcOgPqT7nWLTkpv0W270f0muemESm4:ME9/QMcvPaSLTkp/5uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580001, "uuid": "858a5dc4-ce81-417d-b359-1fd71acd4571", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580001, "uuid": "b21e2493-3c47-4837-beae-131db54e7264", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580001, "uuid": "715ab72c-aa4f-4898-a24e-97767b5d724d", "value": "1_FXSMON.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bda7029-302a-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634571902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571902, "uuid": "c63b7f52-fccf-4669-bdf5-5a08835c5a46", "comment": "Malware payload (SilentBuilder)", "value": "4510526f1bce9aca03b9d6cc37817da6", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571902, "uuid": "1ba1c663-e737-4a65-a730-19ddacebab5e", "comment": "Malware payload (SilentBuilder)", "value": "67beb6d8f498fc4dd9ed1c8c2313af9b3ec72d23a1abf683308b15fd49791e0f", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571902, "uuid": "7b6dcb15-0236-4e2f-b139-f41802f62a48", "comment": "Malware payload (SilentBuilder)", "value": "180cadfc28d01d044bf1666a3b657a032f3c49a6", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571902, "uuid": "32802bd0-09c2-48cc-b9c8-beda71ceba07", "comment": "Malware payload (SilentBuilder)", "value": "1b4895986bf27ae0a8dd669f21f7412481a0cf6bcbeec70449d9d60a44f84e4e69dd4cc84aed75ca824e3b8a8a1761a4", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571902, "uuid": "02cd89df-74c1-4e57-b7bc-7c357135de04", "value": "T11544E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571902, "uuid": "e0875f87-5634-4bec-8ac0-1d8c8e0bd7a4", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7o:U9jFrjmkD7IvLDK3vLvfn1+2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571902, "uuid": "f5e08d7e-dea2-434b-acd0-2fc62b6cc2f3", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571902, "uuid": "8f82d878-81fe-4c59-81d0-38194606c473", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571902, "uuid": "9c8b0486-a4c6-4ad8-9dc9-a4fd91a61145", "value": "4510526f1bce9aca03b9d6cc37817da6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a738811a-3030-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634574606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574606, "uuid": "b0be5d32-13b3-44f4-a758-89c742b73856", "comment": "Malware payload (SnakeKeylogger)", "value": "41347ab5d177516699a95664c9af347f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574606, "uuid": "db899a10-0c7d-48e7-8944-ca7059ecdd21", "comment": "Malware payload (SnakeKeylogger)", "value": "67d0b08c6cf36abee6b895c90773663a21131e4bc36ff46726e8ba9a53ed0497", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574606, "uuid": "52b74b05-f191-4b51-8cf1-3976aa5e3058", "comment": "Malware payload (SnakeKeylogger)", "value": "ed91314e9da6cbb4564b94e2abc151f29daa9f69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574606, "uuid": "f2db5a0d-9991-465b-9b20-9d8cf6815afb", "comment": "Malware payload (SnakeKeylogger)", "value": "e0a0e081b63fd67765cfabdd6c014466c5119ef240da706f3fa232504457d48f40638208adb58ffa8778867e4acd3226", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574606, "uuid": "7db50443-7aad-47e6-8390-73333d7a48c9", "value": "T1CC83E9017E04668AC4D20CBA01B259D193B84DDF8E9ACE7779E1B73E78736249F07939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574606, "uuid": "672c9a0a-ae1c-4a0c-9459-141a882cfd11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574606, "uuid": "196417aa-53cb-4d66-94e4-27be0bc42eb2", "value": "768:AeriujPB4SJL9kIULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0cE:BFcIULFMAAiu6JL6oNsgFAyox0cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634574606, "uuid": "aefb15eb-da38-47ee-8e65-92556469c349", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634574606, "uuid": "e8865ed0-1cc0-4646-8f55-640a022708b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574606, "uuid": "d3f1be56-3832-46e7-9e72-a60732517e94", "value": "41347ab5d177516699a95664c9af347f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010f774d-2fee-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634545980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545980, "uuid": "6663afa4-1e3e-4d1a-976b-63102fdc57b1", "comment": "Malware payload (Loki)", "value": "f7ac33fb4f5e0e571365a8bec2e0507d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545980, "uuid": "23e26ab4-db22-4e51-9b78-3cdd56f05048", "comment": "Malware payload (Loki)", "value": "6814750712cecb00b5e5328615f9c9bd10d05506c9090fc5a02f5e004bb80880", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545980, "uuid": "ec0effff-b51b-4800-8d65-37f4a2c7c6ea", "comment": "Malware payload (Loki)", "value": "0da0e98e3cbb3937695552df54d5e2f0fb23870f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545980, "uuid": "151ccc35-fdc0-40f9-b301-51660820ef2f", "comment": "Malware payload (Loki)", "value": "b5a588a8cb4008db845d69745e59e62e8bae5f1e85af335bb7caf88f4e0e5b756d6e9c4fe1c9d0cd309fa5733202c532", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545980, "uuid": "09b8f9bb-6c78-40e5-b02d-e6e334796e26", "value": "T1EF227D3CC69CE51AE112183DD01952F6F76D006AE653B86F2046B3CD4FA17D383CAA7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545980, "uuid": "76db485d-525c-458f-ba89-3233549c706e", "value": "192:ScIMmtPWQjG/b+rcafbOZ25SEzBC4vNqH9Rcm3fJJl5:SPXlGT+OZEhlqHtfJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634545980, "uuid": "d0ab247a-6f03-4692-9133-aebfe1206c5a", "value": 10351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634545980, "uuid": "6853aa53-bc27-486f-8b74-86da3e985bf0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545980, "uuid": "6a35767f-21c1-4ee3-8ad1-a9a813693552", "value": "Shipment_ Quotation.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6a180e-2fef-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634546806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546806, "uuid": "85597637-e02d-404e-8057-96d3933836c7", "comment": "Malware payload (Loki)", "value": "7f092cc4b4eed56b3af2686351f7402e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546806, "uuid": "8241b978-7ef4-4a93-ad57-c62ffd63c717", "comment": "Malware payload (Loki)", "value": "685da0bbd46c865caebc6d3a5ac631ec46cf8655a4531553f56336e89ca6463c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546806, "uuid": "7a3c2f6d-fbec-40fe-8177-413832792ee4", "comment": "Malware payload (Loki)", "value": "a9361c3e5440c85d79af60ed110d8798013b6b49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546806, "uuid": "a098b4a3-b596-440a-bbf6-1127f12ac682", "comment": "Malware payload (Loki)", "value": "0a5426af774f8528d3e58cbdf4654d7d2286cbdd554b2f069d6758d7d9724a803066cf22e320bf7d57b856cc3554211b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546806, "uuid": "29aaa0eb-e59d-4659-80fe-bea43e9f4c7d", "value": "T1D27402027784C527C73D027664F6E3642B78EA262E19D71BADDA30DF8EB77405E9012B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546806, "uuid": "40929289-b20b-4d44-a078-d12f71a64d73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546806, "uuid": "1b8fb26f-8c97-42fc-ac41-3d7891307272", "value": "6144:63YdZV2YdagKMm0SAeHlj/oLJNvUxfPSZeKfcc:zjV1MrMm0SAyzmJqxOfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546806, "uuid": "d9c02a9e-85c0-4ce5-ac35-c174fc7004d1", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546806, "uuid": "bb2f1c21-1525-4883-967a-12741f28e427", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546806, "uuid": "cf46b8de-d695-4d8e-969c-dd1509858aec", "value": "7f092cc4b4eed56b3af2686351f7402e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2968a8d3-2fec-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634545189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545189, "uuid": "9ef7b189-ae1c-4efc-9d4d-35d96a8a7265", "comment": "Malware payload (AgentTesla)", "value": "5cceefb23aa8805a7d5320fac133b4b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545189, "uuid": "84a4f890-f639-401b-a122-1f0b47c55197", "comment": "Malware payload (AgentTesla)", "value": "687a1d2494d31819195e196dbedb77debab11b228bf8ce58dddff6857c7a22e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545189, "uuid": "ec1e7224-d455-4050-a26e-ec6ccb6e99dd", "comment": "Malware payload (AgentTesla)", "value": "e02218a4886cf5f954d6c6fa5704c2d72fad7fd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545189, "uuid": "cc68a93d-0554-4282-b9d4-72c41cd1f88f", "comment": "Malware payload (AgentTesla)", "value": "80960264335eec0bd54a63e9dfb5402ffe12bd6e4188e8c0136ec027ac0f378c0b0ce45c9369ee400f34924c967e6edb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545189, "uuid": "e617142b-ee83-4dc4-b7ec-5ae059e72af8", "value": "T106550815B342B80FD55B463380E058F3910629E7D649C326EAB37EAB48AD7854F4C7EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545189, "uuid": "4d1acefa-2d33-436a-93d1-7d78bffc4eaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545189, "uuid": "f5f2a629-51e4-482c-a3db-19d4f0907eb7", "value": "12288:wVD6KN0eq6efBSkkkkkkkkkkkkkkx9L+kIkkvkkkkkkkk7ZLxWePfU+S9mDBy834:wV+ueklI5PfU+S9mtJn+T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634545189, "uuid": "fa5a7f7e-fb7d-438c-ba4b-621e1d016cbc", "value": 1344512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634545189, "uuid": "c12ce1e2-582c-4df5-9a15-b4884ea34682", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545189, "uuid": "554bcad0-5728-41e0-bb97-5190b7bf71c3", "value": "RFQ W-1802-1889.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf72ce43-3010-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634560929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560929, "uuid": "9aad50e8-ce9e-4469-869d-01a245b31d00", "comment": "Malware payload (GuLoader)", "value": "d123553bafeb8829abec88b2e5454c77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560929, "uuid": "6b09b059-a39d-428d-9df5-8bba4f666c9d", "comment": "Malware payload (GuLoader)", "value": "68d2f4e2dc973bca07cb1e79a53a8d4583f0d717592343e57906c537ff298ecb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560929, "uuid": "6b5a250d-61ce-4679-ba47-720f6db007f0", "comment": "Malware payload (GuLoader)", "value": "47839f702826ae7babd3850c9dabcc59f1ffbccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560929, "uuid": "a79f938d-3776-4cee-99f2-1483b23a4410", "comment": "Malware payload (GuLoader)", "value": "438843c1a86acaa0fed5221c4ddf6858f9c0060378f834980022e36513f33df4ad4048f90b1ce206a7bbef251f53af10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560929, "uuid": "4301a4cb-df26-453f-a9b5-aae026b8227d", "value": "T1C0936DD2258C98A2D855CABE437F59AB071EFE338994922763901B1BD43BF81D87170F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560929, "uuid": "47a84510-5e3b-4800-8e21-7f54419d879a", "value": "6cda8b61dc739fa685b0a1af3300013c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560929, "uuid": "cbbceb00-3bc2-4e5f-9746-1b956bb7db17", "value": "1536:tywDYZaGa2AdL0kmqOzGOpA5snugMQlUszrPED:tywkda2iHz/gvRrPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560929, "uuid": "438bd431-f617-4d87-8299-cf7fa57fb443", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560929, "uuid": "178a41a0-939c-4785-ac10-591059cbf51b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560929, "uuid": "9b07f87f-6c44-451c-981c-95ffa8097be4", "value": "N\u00ba 210000483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8688dd-304c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634586589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586589, "uuid": "e5a2d92d-f0d0-405e-a523-e82442c1ef4c", "comment": "Malware payload", "value": "2516ddd5fa7daa5858b34da7147bab10", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphon", "colour": "#235EE0", "exportable": true, "hide_tag": false }, { "name": "Harvester", "colour": "#0E3708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586589, "uuid": "54a80a48-9475-47c5-94f3-6edac492ad3a", "comment": "Malware payload", "value": "691e170c5e42dd7d488b9d47396b633a981640f8ab890032246bf37704d4d865", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphon", "colour": "#235EE0", "exportable": true, "hide_tag": false }, { "name": "Harvester", "colour": "#0E3708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586589, "uuid": "9c260e56-8124-4d29-8aa8-d0e456890626", "comment": "Malware payload", "value": "e2ae356072a5de051aa55cc1fdd7eac20e5e5aad", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphon", "colour": "#235EE0", "exportable": true, "hide_tag": false }, { "name": "Harvester", "colour": "#0E3708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586589, "uuid": "5f4d1f66-e317-4983-8667-eaf6774d3ef7", "comment": "Malware payload", "value": "c937d6ac066fb7fee7ae151a8cfbb6ded2ac5053414d336c62f2e28368dcd67308959565f44ba8aa7174a82c3cadcc2b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Graphon", "colour": "#235EE0", "exportable": true, "hide_tag": false }, { "name": "Harvester", "colour": "#0E3708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586589, "uuid": "12277466-29a5-4033-9751-4b6bf3016238", "value": "T181D4232733845431E6FC5F72D4614ECC36BA72A3D9BADB4C4B4CC00829B6B6D5E70A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586589, "uuid": "17cc6127-4a6f-4997-9301-fb538208906d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586589, "uuid": "f93b83fd-90bd-4824-b368-16cf68d584b2", "value": "12288:+L6hD2x/HAWbR2zS4sisO1A83u2BSDoCqKcSD+dkwvE2TPLCTYqYB:Y6uHAW92zt/sWu2BSMCqD9DL5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586589, "uuid": "99a46479-1fa4-4863-868b-edae3a3d5809", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586589, "uuid": "e78c4b49-df41-41c2-a0cb-924ba17805da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586589, "uuid": "d2b94fe8-5281-4c7f-9372-b8d5f772c291", "value": "691e170c5e42dd7d488b9d47396b633a981640f8ab890032246bf37704d4d865.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d2365f-300f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634560511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560511, "uuid": "9cfab2a7-e693-45e0-b534-95c0d3acc025", "comment": "Malware payload (RaccoonStealer)", "value": "571f637afe8e7d1402b448ba00b1b3fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560511, "uuid": "c09971a6-98d8-4d5f-a0e2-7c51ce75dfe3", "comment": "Malware payload (RaccoonStealer)", "value": "6943d2f55c80903c850383bbc29c43b8b004d322a4b91dab60e1a863c23ad306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560511, "uuid": "33e4435e-caac-44c9-b1cf-7567e59cf308", "comment": "Malware payload (RaccoonStealer)", "value": "70b802e5ca335cca7b5ca465b2d5655e3b7b4ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560511, "uuid": "a9c614dc-0cd5-4702-b3fc-9ed954783b0e", "comment": "Malware payload (RaccoonStealer)", "value": "ef871388fd38b1834180962a1a5255743d7976a88ec85b6335c2a35657120566804d27c6cac982643ab8b3553d0f6b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560511, "uuid": "7e99939f-39c4-4fc1-b742-c41077a2d144", "value": "T1050612137A4001A1E0F6C0359A2FBED1B2F1911E5F82A479759EE6CD2F725E0DB13A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560511, "uuid": "dd86cd7f-3879-4d81-9378-255ca05d9f98", "value": "a85a77af497812caca8f46826b5e3a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560511, "uuid": "ce6d6590-acda-4a40-89b6-5f24f5ede4e1", "value": "49152:KZSPiv5LcSyKsJt6kMxtvzBVYps3X62v/I6u4CCN/BuCsIP7u/erR6lSwptodGF:Mv5RPsJEk43IK/p1hpPAcStp2dGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560511, "uuid": "270087aa-7161-4e14-bbba-e0ffa6cd8fff", "value": 3924992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560511, "uuid": "53cac7bd-5d00-408c-8099-6e1cf8760260", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560511, "uuid": "1a8dd130-3002-474a-8cfd-3b49b26f0bd6", "value": "571f637afe8e7d1402b448ba00b1b3fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2164d36c-3012-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561496, "uuid": "6ace7ed5-6d18-483e-afdf-8051fb5c7dfd", "comment": "Malware payload", "value": "2c24b5f39493b5b353baed4f24b87ca1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561496, "uuid": "ec520595-4961-485f-8dfd-fef39953fa28", "comment": "Malware payload", "value": "694d3fdb5b5bcc9f4b522c5cb32bce02dbf522b2d82bd32c100d59ecc8e9ba57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561496, "uuid": "0a1271d2-5688-4767-89d9-d8e5e506f7a2", "comment": "Malware payload", "value": "3e45ace59919dbfab32d04f6015324f45e83e637", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561496, "uuid": "248cb083-e396-4155-bd2b-3183010e0b10", "comment": "Malware payload", "value": "f716d7be2d50314d25d3aae4823a547c02a05d00054e07e4b629d7f2ba8fc76d83d3ba9c2699ff729d6168c6a66dc6e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561496, "uuid": "4c15f8d2-a68a-458f-aefc-9386c91eda45", "value": "T162034B93F4A2E030D79749F2B7856925CABDBD367C32CD97E361250A0961492FB2A343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561496, "uuid": "9a5f7e70-4438-4d23-ad39-8367316824d5", "value": "768:ML5R55hwc+mdlRmSHTlpHmXOyGl7W/9BWGA6dKrPYGBLb:czvQSZpGS4/31A6mQgLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561496, "uuid": "520c4ca3-1050-4ef4-93af-99c8919e06c6", "value": 40737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561496, "uuid": "7bb9b7fe-4688-4393-9164-49958e748783", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561496, "uuid": "50fb9bd4-473c-41ba-a1f9-121bb66b28c8", "value": "2c24b5f39493b5b353baed4f24b87ca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344cfaec-3047-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634584291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584291, "uuid": "6fad5733-c6ae-4f0e-b5c7-be6aeaece09d", "comment": "Malware payload (AgentTesla)", "value": "b4bf9d3bda738a3d6794dfb47a85f011", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584291, "uuid": "f0400f5d-2f26-406f-8863-7367938a849f", "comment": "Malware payload (AgentTesla)", "value": "695d9cd287ce5ee85681b570ee37daa421550dc4b25101240bba64245a729bd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584291, "uuid": "2b946600-fad9-468f-b002-b52ff49c11ea", "comment": "Malware payload (AgentTesla)", "value": "b81cfd36eed1b54cc8dd3001f1c3f6e007b3748b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634584291, "uuid": "7bf5f615-1871-423c-ae44-9cfe7c63fcda", "comment": "Malware payload (AgentTesla)", "value": "8c3cc9864a26ba31c7f6ab24db61bd28c01932ef5c6596ef36935ebef10aeb6fe56ca062cc0952621ad16d7b202fdab6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584291, "uuid": "51b72a54-89d6-4587-876c-5694055813f2", "value": "T1C6A4F1167124CD12C16283BEC8FE911207FAB8179152D6867EE93ECF39357E24919B8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584291, "uuid": "e1c95580-cf46-4b78-b818-976188cc67c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584291, "uuid": "aa4f1526-3fa5-4780-8f09-a726fc13e43f", "value": "12288:fGgS6Dg4R80vRL7Q7JpgvQIG1rqiQ4qIZDJMxUB5/xU3pnaOUg7A72:eIYFrhQR8Mx2pxgpaOZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634584291, "uuid": "d30b58fd-0c69-4ba7-a7a5-19605fa17764", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634584291, "uuid": "1fb2b5dc-34a0-466f-87df-3578a33a8a67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634584291, "uuid": "c871c19a-c1fd-41bd-a488-326f522e2c1e", "value": "SHIPPING DOCUMENT & PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a2e5a4-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634542044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542044, "uuid": "f0851c4b-553f-4d33-81d6-7f59c310a461", "comment": "Malware payload", "value": "cc2c4c1f83ed182f0708291690b4531d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542044, "uuid": "465a84b4-8e83-4083-854b-ab5029f34f90", "comment": "Malware payload", "value": "6986a726f1cce6d7ec22799bda2788bee17c1d2b46739f1b62c3ff20b65c4a3a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542044, "uuid": "254ad3f2-cc8b-4f09-8fe0-0846637a2d54", "comment": "Malware payload", "value": "1bbcf2d22342bfa761ead060117e4b2b43246133", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542044, "uuid": "8d5d8a61-2f5b-4118-98ff-36dd733e4258", "comment": "Malware payload", "value": "efeb2136301fa372447c3e9317d1c82ac9448468aee65015e22971e08653ee4ba518fb33a73b15922589db0fc3f412c4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542044, "uuid": "382b008b-f45d-4269-a8ec-cbe61e2d5b3d", "value": "T11D45BFB876047DD6266F576BDA96ACDD03B61B229ECBA4CC8064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542044, "uuid": "a88a7bc9-f4d5-4240-916b-ae0dd27ce87e", "value": "24576:r54T7/s683/EZpl8TG5vqJ2Ox/A3RjrA6nbts3oCom9q+o8BQ1ZRAxRKolpC202o:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542044, "uuid": "b36649cf-550d-4b7f-975a-afc5975361d8", "value": 1241470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542044, "uuid": "b306cad5-9a36-4d20-904d-bb6dd426ebbc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542044, "uuid": "c1f5636a-ec72-4927-984d-ee4d295bd6d8", "value": "PO-33120.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664a6224-3009-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634557747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557747, "uuid": "402058ae-394b-4d96-a117-6f3dc4037594", "comment": "Malware payload (Loki)", "value": "745564d9a64c26b0f64e6c164c82440d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557747, "uuid": "ce1e313e-fbee-4b7f-ba5d-dfc2d683f328", "comment": "Malware payload (Loki)", "value": "69e8a7c05d1c336f32d92faffc8835c10074c2a9aa3e1a58dfeb1862c93a95d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557747, "uuid": "3d583f5c-59b6-4f09-ab83-6c81369e41b8", "comment": "Malware payload (Loki)", "value": "cfaa226d0ae32523f0d9b13b32172ae4f2b732d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557747, "uuid": "ee0b618d-6daf-49e8-a94a-a9ccc02a9fb9", "comment": "Malware payload (Loki)", "value": "d40cae3a8736c955ec9122a9c9701d58d12b2607e71849aa40441f39e989348a63df05c5db5d4c1df053e70a172ebc25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557747, "uuid": "a0d9e97c-4a38-4052-95ea-129fbeeda8a7", "value": "T18D648E00B7E1C034F1B616F889B993B9A92E7AA1AB2590CF52D117EF56757E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557747, "uuid": "b36ca626-629b-44d2-9d10-969487f05a25", "value": "aa28841a98fbdef9684f8dac2b470256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557747, "uuid": "1fbd5567-d4a1-44e0-a409-819bff57b4d8", "value": "6144:cNvM44skGZQ8Wt/LEdK3QgxRW0nMxDBqYEk2LIVf:cNvWsdelt/Ig3QgxRTMxDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634557747, "uuid": "57d31a22-2553-4cdf-addc-5b16c29ca233", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634557747, "uuid": "0e2daaaf-dced-491a-8612-dc72ea5dc021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557747, "uuid": "3dec4c4e-fbff-4f57-a315-2f9ae6360c94", "value": "745564d9a64c26b0f64e6c164c82440d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c130baff-3040-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634581521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581521, "uuid": "2d8815a9-0b0e-4943-9f8a-6101f22f5884", "comment": "Malware payload (Mirai)", "value": "9732779bef5fb45af30a42a2f30aa858", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581521, "uuid": "10fe5911-a3d9-4cc4-a44d-ffd89523ac12", "comment": "Malware payload (Mirai)", "value": "6a53d21367c7dd1d8cc9670bd7ee860483ce33e133e9024033179273002da011", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581521, "uuid": "da50d3bb-6b04-4af5-a12f-63258ec60f20", "comment": "Malware payload (Mirai)", "value": "385e813d93eb8743f7ed4bf86bc97380138c1bcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581521, "uuid": "777dfc4a-1fb8-42e6-8fe7-30104dacaa01", "comment": "Malware payload (Mirai)", "value": "8cf7e34623e093ad19ab64d1a253783f07626a2210dd8a8db2535b525ac237e6198e080647c78d641811b6ac521a0451", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581521, "uuid": "4e171c07-338d-454e-bccf-fe118527886c", "value": "T1EB332902771D1B53C16BAEF019F757F087A6FD511AA39580F11DBEC86332AB02A26F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581521, "uuid": "0b98eaf1-04eb-4ce8-b96e-2b00e76a97b8", "value": "768:6Ht89ZHuJe5GDqiqI56sFNVtUsn9If20Z+XBoSuNtdgLQWePLr:6HQZOJe5rrIksV2IqkFuPdYfePLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634581521, "uuid": "a6e0da67-a2ba-4c1e-b160-f701711ef69d", "value": 52563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634581521, "uuid": "9a4237f9-a5ea-4930-9dc0-5a5d1a17ee98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581521, "uuid": "344b10fe-310a-4871-827f-5bb7bb6a5cf5", "value": "9732779bef5fb45af30a42a2f30aa858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9bb841-2fab-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634517435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517435, "uuid": "3f623bf1-3da2-4f2a-bf9f-4dcd076bb814", "comment": "Malware payload (Mirai)", "value": "e02765f081aafaf507a6ef6261271ec5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517435, "uuid": "4ce4a3de-f7a6-42c3-acf5-0a4d34f2bda4", "comment": "Malware payload (Mirai)", "value": "6ac20eccfa12c8060d97dc3941b43ff9e868c712af287d20e30d4c3f6feaa455", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517435, "uuid": "6bff7836-bded-4906-b2cd-ba7a2c968506", "comment": "Malware payload (Mirai)", "value": "6c9cfe6068196ddc7c52ccc27e99c4fec2926693", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517435, "uuid": "0b5bf512-a865-4e27-aee8-c0ca686037b8", "comment": "Malware payload (Mirai)", "value": "e593711333c4867fb13d527d10c4d73614f6c3f1416b894cdbeaad43c1c96f0e29aa082d1de16a1135906f7ec885fa0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517435, "uuid": "09a32d0f-0bd4-478f-a763-51d60c32f63a", "value": "T1D973B309BFA50FB7EC9BCC374AA92712248D651A35A93F35BD34D418F25B21F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517435, "uuid": "88d4f79c-ba8e-4b0a-8170-20e318334807", "value": "1536:aHJtIFGq1QDT+uDEQhKvt191Yi8ZNFDGd:aHJtIMZT+UEQPi8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634517435, "uuid": "fba73908-0dd0-4fe8-bd94-5aef4c15f588", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634517435, "uuid": "93a359b3-150a-47ee-a512-5e377fd36223", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517435, "uuid": "67ec87dc-0956-42d3-b8d5-e00da024c509", "value": "e02765f081aafaf507a6ef6261271ec5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ec323f-302f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634574040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574040, "uuid": "7e2a1289-cb13-400c-a121-b66ee65d6fdb", "comment": "Malware payload (Mirai)", "value": "b6c85cec85a163c61eca70c5e671d0c6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574040, "uuid": "8e6a0ec6-c3bf-4b5b-b0da-c9fae3d9d213", "comment": "Malware payload (Mirai)", "value": "6ae38c3d6e6de1e8bc66bdccb2bf1cba75d60c4ddb04337ddc1d5978b922b22d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574040, "uuid": "b9679edb-b2f5-4174-8be9-5238f7ea5705", "comment": "Malware payload (Mirai)", "value": "31d951c8d5934984c8782e736d89264e781e26f2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634574040, "uuid": "6cea2b58-ff2b-435a-a3bf-c34bb1cec76e", "comment": "Malware payload (Mirai)", "value": "66fe0216c1c055ec625e22a98383731ad05ea28718ccc7eed27db40ccb0f7ac01577c3cf29bb571c7a1e9c62eae23448", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574040, "uuid": "d577c00b-5c4d-4709-89d3-568719910ebf", "value": "T1FD732947B98189FDC089D130477FB93AD821B5AD2238B6E337C9BF161C4AE604D5BC95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574040, "uuid": "90ce44e3-0d67-4703-be8f-b53df51bac09", "value": "1536:1/MJlhaMJgJAUEUbC+O1rA+mXTvn4jzvnWskN7Y9mXYUYTJL9mTs:eJlhaMJgJAUEiC+OlBYTvn4jzPg4mXYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634574040, "uuid": "ae77eff8-19a7-48eb-80be-21208fc04980", "value": 79104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634574040, "uuid": "c0ad0af1-4af5-4ca2-91c1-f9d83ec33336", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634574040, "uuid": "a9b3432c-e554-49fe-acdc-d4aab0188717", "value": "b6c85cec85a163c61eca70c5e671d0c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d7852e-304b-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1634586277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586277, "uuid": "305907bb-6a23-460a-bcd5-a7a5feed756f", "comment": "Malware payload (Vjw0rm)", "value": "e86024bc35002c13c653555802ad2ece", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586277, "uuid": "025c50ff-2fbf-4721-ae5b-00663842f7bb", "comment": "Malware payload (Vjw0rm)", "value": "6af2616970680def8dc9f6f6af83fbf68c96a95fec6638216dc303d02bd8476e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586277, "uuid": "56cec115-1bf3-45c2-9e4f-c100e0648993", "comment": "Malware payload (Vjw0rm)", "value": "6a40601e1e11cf7c9dbd815040211d75e73c0e6a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586277, "uuid": "8ad7dae2-c3ed-4061-8c00-7cffe41c0157", "comment": "Malware payload (Vjw0rm)", "value": "101810d8efc25e790ab8660495a8a15349d9e5faa834c152143048002cb5618446ae57ee9f9406ce4ee59ab51df19232", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586277, "uuid": "d61c613f-68a0-4c9a-8a48-4e2324e22f0b", "value": "T1ADB26BDD6D41BE99D630A220B5AD7EC8AFF8931B9401038D3C2DB7409F32549D5AEE5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586277, "uuid": "eff73cab-5134-415a-a0c0-6ade39b1400d", "value": "384:Jm3uw3bALvAysBkJs0l8BuqbO0EQ/DOwEqsekccLI9yJAmD72KlXO7W/AFIRChfP:klrAr/36oAOUDOrqq1LI9yqmD722+g8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586277, "uuid": "784a6c00-88b5-4c9e-be8f-dd6d9f405d5d", "value": 24156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586277, "uuid": "53c1015d-7e6c-4f82-9677-216a401d7015", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586277, "uuid": "667dcf5d-b17d-4858-ad50-36e86b7edb12", "value": "eReceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b910fcd1-302c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634572918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572918, "uuid": "aae1e108-4481-4ddc-9373-ca224953a1ad", "comment": "Malware payload (Dridex)", "value": "21187c4bfcd9fd36f9543feb063427c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572918, "uuid": "883c6d00-0505-47c0-9218-d5b5367ad9cd", "comment": "Malware payload (Dridex)", "value": "6baba00a0fe93619aa35d3aac856b7a063134ee57565a36ac3aa6a1bbdc54d57", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572918, "uuid": "988b6920-9771-48a2-96c7-893e18590e97", "comment": "Malware payload (Dridex)", "value": "9cd287cdc9d005455e5c79791626d97cf14a1849", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572918, "uuid": "a7f738d2-d049-4f81-9145-1996d373e372", "comment": "Malware payload (Dridex)", "value": "f6066bc593799d649cdd9203e3ed528ab5db072bf806253559e2204e185d5cfabb1abd5b6cc4e395908f2fbb2858a5b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572918, "uuid": "a8d9f197-32a0-4c17-a673-a9fad61b4211", "value": "T1F004D128E76600C5EDDF0D7A130DF32ED4BA1D066341C5BDE90CE762A224F29A97E365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572918, "uuid": "c9f9e1a2-c47c-4651-adb6-5f7dcd200960", "value": "adb0dd6ace4ae202db9532637ae1959a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572918, "uuid": "71d272b3-4805-4c8d-bba7-5eb1aa44f498", "value": "3072:TuE9O68ciPs9BrcOgPqT7nWLTkpv0W270f0muemES24:6E9/QMcvPaSLTkp/5uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634572918, "uuid": "bc458b40-dcb7-4cf5-ae79-2d5b17972063", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634572918, "uuid": "5902ce69-3655-424b-bed3-c07477002b47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572918, "uuid": "b25111c5-e697-4182-834c-fc0e5de795ee", "value": "8_GrooveAudio.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f7779a-303e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634580420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580420, "uuid": "bf1de7ff-6739-4ebe-bd59-5936d78a0abe", "comment": "Malware payload", "value": "a2ddc282508fce71ed7f6c8db3e26f2e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580420, "uuid": "054f25a5-bfc0-458a-9561-5695e50dea47", "comment": "Malware payload", "value": "6cc12dfea6cb56664ffe532065778cb8b4e8bccb4d7bf796c0d8a008702aceda", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580420, "uuid": "62aa3d5d-a561-48fe-8e56-1e448a5b2f01", "comment": "Malware payload", "value": "9bdee9c760d71ab094250703ed750bfb28425ccf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580420, "uuid": "085e09fd-efc9-46d9-9020-693c41a7fe93", "comment": "Malware payload", "value": "a06dd0026449346cf82723d59d33871fdeb9cdc78dcf15603fc57fc1f3d75e17f91812c1b19282d0579b56079822e12f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580420, "uuid": "805e8502-aa05-427a-8052-7ad3d5a93f50", "value": "T1FC458D23F6C18437D1732A799D9BA3A4AC39BD105E24684B3BE42E4C5F396C139362D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580420, "uuid": "f3f40c26-495e-4f8a-bb8b-872a388bf1d9", "value": "24576:pITSUCEYUW5AtsKAsup9HohIv5xnb9CCAmUmpV9TU+ne5wYSASA:pI2QDMTHohAlPTP6wYS3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580420, "uuid": "9824b583-9582-4f75-9e0c-6bf41abbe29d", "value": 1214976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580420, "uuid": "076a76eb-cbbc-4f33-bdad-33b17615d873", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580420, "uuid": "9cf72ed0-50a5-44d4-ad63-e86c70740e43", "value": "Archive-099884.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f79d0e-2fd4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634534894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534894, "uuid": "7025bd05-28f6-4337-ab68-408817877f54", "comment": "Malware payload (Formbook)", "value": "3b77846a9994bac7c3608df6ca04d036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534894, "uuid": "16446728-b8cc-4fd1-a8ee-dbd04720acf0", "comment": "Malware payload (Formbook)", "value": "6d2abaaa61c35b3bc1cf8ae531dd9505406379b70f414f806974d0202365d14e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534894, "uuid": "0e09d8fc-947e-442e-8631-4ea767c8a0c4", "comment": "Malware payload (Formbook)", "value": "04e3c629e5b3cb7f9473019496cfe8016a2d0c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534894, "uuid": "3d5a2cee-82c7-4958-a467-da17d8279bcc", "comment": "Malware payload (Formbook)", "value": "1bf8a7ccb0a54fe6fee6addf10283f7fe91c985cefde614dfbcaa9e52876d0a18d97c64e487fcb1e81e0b3f94e93df16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534894, "uuid": "9feabf27-bd40-4374-8156-cfe758e1422f", "value": "T1393512087A25AA8FC17F4D368C921C546B70A5B79613F3477CC326ED898D79A8B063D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534894, "uuid": "5f559692-cbd9-497b-af5b-49465eb9fbdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534894, "uuid": "4ff6619e-428d-4fcf-9dd2-9428656ed838", "value": "24576:cLEHFWFOBofuOs14lNyRUsKCvhYKyxyaOIGrjB:coHtBDN4mysLvhRyxBO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534894, "uuid": "313a9c39-f2a7-4d04-b43d-ca4a9a47c02f", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534894, "uuid": "30da7559-c2a6-4b0d-8858-78052b7eccf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534894, "uuid": "9b57e4e1-7b2c-4710-97e5-d7ea169235c5", "value": "3b77846a9994bac7c3608df6ca04d036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d460ae-3005-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634556241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556241, "uuid": "c08f9c3c-5e79-4834-9fcc-c634b481ca2b", "comment": "Malware payload (AgentTesla)", "value": "dfeab6c2910012eba15a7b4dc56b80f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556241, "uuid": "ad3928a6-9fbc-4d3b-8fba-c2bcfe7187ea", "comment": "Malware payload (AgentTesla)", "value": "6db5f541f73470c314a570b21d90f78e91af21bbf5851660118566ffca9a1140", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556241, "uuid": "cae18934-daa6-4fa1-b758-dfc11930de22", "comment": "Malware payload (AgentTesla)", "value": "262560445a9f351cc2a1535fbf6857a9eb1eef0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556241, "uuid": "3c5c93b5-5639-45b6-b3fe-69ce8094d191", "comment": "Malware payload (AgentTesla)", "value": "28ca874e8ab812bf6ab2c464a35558d749394e6c79355af6a9e1544434152d03826f5c29b7b46987a99e805d4e28e96a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556241, "uuid": "c4ebb541-0adf-4bc0-bfac-df6ad9ac9b11", "value": "T1DE81AF0BB3B16F1BB5F3829AC2915ADC591630621222D1EBDB172215CBC52F32E7539A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556241, "uuid": "ad12e8f2-0c03-4bc1-a466-980de94d4261", "value": "48:8n2GeHBjBjBjBjBjBjBjBjBjBjBjBjBjBvBjBjBjBjBjBjBjBjBjBjBjBjBjBjq7:c2G8YLTZ5KgnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556241, "uuid": "5b180a52-2395-4395-8861-b0862ff8bf5f", "value": 4151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556241, "uuid": "0f362385-f881-4aac-8100-879dbbc9cc36", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556241, "uuid": "29125df6-34ee-484c-a29e-68defd253be8", "value": "FATTURA_46082_ELEPHANTSCAVI-scan.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7638c028-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634555626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555626, "uuid": "58a77451-1abe-4396-9f78-f566aa2f519c", "comment": "Malware payload (TrickBot)", "value": "8154f344dab87a406aac9fe091d5a61f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555626, "uuid": "e75ee221-8eec-4bd3-80ca-b771e26447f9", "comment": "Malware payload (TrickBot)", "value": "6db7642e42467842b97947426d78418e58c1e0b25f125ce0faa8bfa6436a70b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555626, "uuid": "635dd9d3-5a7f-4e8a-b210-11806de6ac51", "comment": "Malware payload (TrickBot)", "value": "c03501927695449f8088585112f37c21dce0a2b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555626, "uuid": "7a40c8c2-8702-416e-84ef-b0cdd41bf96a", "comment": "Malware payload (TrickBot)", "value": "708ba6d344874cee5b26b951839f2fc783ff0a58e019c056c52d6d1e910121a75716883a1eb49c68e18286305974a822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555626, "uuid": "b1502425-f938-4c59-973c-92f23f35d85a", "value": "T11215C01A3AF1C076C5A291700FF67B6AB6F9ED605B378AC753804E4D6D31DC1463A23A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555626, "uuid": "e8a2e575-255f-48fd-8c43-91760fd7e397", "value": "d3d730d77f19513c17bee56cad3fbfd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555626, "uuid": "b1ade6fb-49ac-4f19-b54e-4a49a64ec999", "value": "12288:DEMkCMMFkUED6ANs4ZD9V63Az2hPmy+khUzJUw/:m+ED6+xZzkmiiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555626, "uuid": "d0467dae-6dd8-4374-ba41-76320b8f2891", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555626, "uuid": "bd7f3785-53ab-4ef2-a952-b5970c3df99c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555626, "uuid": "a1cf3e10-28a4-433f-b3be-062b3697fd08", "value": "8154f344dab87a406aac9fe091d5a61f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae8d9c4-305f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634594557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594557, "uuid": "ab54dc70-3e85-4bb5-8b24-62879f9fca6e", "comment": "Malware payload", "value": "11d26a6eed0722ecbda86f35dd0eb3b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594557, "uuid": "97f40f4a-9d17-4829-acc6-548cde832037", "comment": "Malware payload", "value": "6e7c03c32c1b2166ef09c72da941842263b4902af026154162bf5972146f7048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594557, "uuid": "318460b4-105b-4d14-b894-0e2509cc6e73", "comment": "Malware payload", "value": "742838be8b8841e6235ea869e8903bfd0376573e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594557, "uuid": "9bb2243e-195e-40cd-8c5e-5bc184003706", "comment": "Malware payload", "value": "d0f5a8229839b0b050650a3596e6a5755346703ade697f4a57df0cdc55b78c445d9e0af50897d9b101cc76157faed9fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594557, "uuid": "9f834571-2fa7-4ed1-b47f-0de117a0b357", "value": "T193552B5363AC8ED4C06792B4DFC1C4B96C19D9EE421A53B4AB12AB60F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594557, "uuid": "5066097b-9dcb-48a1-b7fb-16eea3c05265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594557, "uuid": "1241c9e1-9170-4dbf-b6e7-6a361b79c371", "value": "24576:TUMb6ctz3lPm7r6nYieEoZHgsI3XC/8vwe/f1:TUMbtplO7r6nYiaZAsI3XC/8vwe/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634594557, "uuid": "2f85d9b6-9a02-463a-b95a-307655c0c421", "value": 1387008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634594557, "uuid": "d24ded90-b7b4-478e-a0ff-7c2f256c884e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594557, "uuid": "e08fecfc-c00b-48b2-9cca-e07e18274457", "value": "55BBzC2lMpuhtSn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bb8005-3023-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568757, "uuid": "dffc4a40-e192-45dd-87b7-b61a4e3d0740", "comment": "Malware payload (Mirai)", "value": "1f7ca446bfbba028417f56b2f2f1763e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568757, "uuid": "6ed787a4-e07c-4187-a13b-d9aa1a44b80a", "comment": "Malware payload (Mirai)", "value": "6f498d3858a9d030493f973a7268b23cefbfc0c30a7f991814a760ca9c22e4ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568757, "uuid": "35d792ed-f19c-46b4-b474-57d8d4b9051e", "comment": "Malware payload (Mirai)", "value": "36c6ffa64f6a789d707fdac27989a9d21f48637c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568757, "uuid": "03515750-40b7-440c-a494-723bc09fb072", "comment": "Malware payload (Mirai)", "value": "cc0b4c257d8829afe0b091dd5adc329960ea3454a92a4aaf4dd6a83b31a1c08b5bc7d109c43eed18b887353a059cede9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568757, "uuid": "164ec697-8fe7-404c-9961-a1ed83754482", "value": "T121B3C40ABF610FF7E8ABEC3745A92B05249D510B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568757, "uuid": "ac157a1a-4461-49d8-911c-ad56f1ff4c16", "value": "1536:g9DYWFx+xx+AaEPi/MR2jk2EkZ+BzYojKoOvDBgplbngVZ14hvG:gqWFx+xUA0kR2hEkZ+BlpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568757, "uuid": "3b7be558-3f2a-4412-8d3b-792c771c4544", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568757, "uuid": "8d5d255c-3156-491a-ac80-e52c39cb14b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568757, "uuid": "d3f63b8b-8702-4c26-830e-919119013d04", "value": "1f7ca446bfbba028417f56b2f2f1763e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325fbca0-2ffd-11ec-843c-42010a9c0014", "comment": "Malware payload (FickerStealer)", "timestamp": 1634552506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634552506, "uuid": "f24b17ab-9c95-4fcf-a4c3-849c6852eefa", "comment": "Malware payload (FickerStealer)", "value": "0e7d5f23ce2fdc3320d257a952444609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ficker", "colour": "#3F8AC8", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634552506, "uuid": "4c5cd30c-5b81-454f-bfe9-880732047479", "comment": "Malware payload (FickerStealer)", "value": "6fc629fbf3a2155e080a6c65fde3db4fe84c3e818c20a3b4b9fb39242cbb2361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ficker", "colour": "#3F8AC8", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634552506, "uuid": "8460dd1f-8aa0-45bb-8f7d-fb408e0117ae", "comment": "Malware payload (FickerStealer)", "value": "2b421eb8c9e27b5bdd113d1f45054d8eafa48726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ficker", "colour": "#3F8AC8", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634552506, "uuid": "525730a7-1ff4-4f81-9725-f924fe4ee148", "comment": "Malware payload (FickerStealer)", "value": "e3c6631dba4000b5574e20652b8bbf46b9ac2936505fb300b835a3bf4567667b7816ee3c89c3e1d047b7e951b82f7a68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ficker", "colour": "#3F8AC8", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634552506, "uuid": "68a84f40-b398-4320-bd49-cf85555c47a3", "value": "T196C47D1055F45C29FAA622BC89AB735AA73E3EA09736C3C7417265F58B235D2EC70343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634552506, "uuid": "09000d37-fa89-46ad-a16c-8214fc0f5a37", "value": "aa28841a98fbdef9684f8dac2b470256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634552506, "uuid": "6179c74b-9a14-4648-9e79-5539109fcf47", "value": "6144:IaqPFf30Cjo4qbLoa3+iAn9z/ax02ngRlyMnx1CByTqsV90MW0rLAb56dpLN4XQq:BqVjZq/ow+DnoS2ngRlh1CByTQMW0rw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634552506, "uuid": "493d13bd-6adb-4140-8f87-e7c7f9c3e259", "value": 569356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634552506, "uuid": "01ce8b99-f0e7-4ca4-9183-dd6985052155", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634552506, "uuid": "9bc9a1cb-3a3f-4503-97bf-e82828ebb205", "value": "mixsix_20211018-121016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fdedb9-2fab-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634517452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517452, "uuid": "3a092ea3-bf9e-44dd-a0d6-1ee8387893e6", "comment": "Malware payload (Mirai)", "value": "6ff029e20f977d8b328a901c12798292", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517452, "uuid": "cf0bbfaf-14f8-4e76-afe0-2fb670d07b11", "comment": "Malware payload (Mirai)", "value": "70e813dee203e4be84975d59e3478f72aba0c93622b4b2d64e55c17a3ab30ce3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517452, "uuid": "a0b64f19-5064-4890-9633-b2e476310016", "comment": "Malware payload (Mirai)", "value": "dbae683fe92f9f445a56b87477228833f366818d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517452, "uuid": "a4ccd7dc-107c-4a4a-bb33-7fc7b809dfae", "comment": "Malware payload (Mirai)", "value": "5834c1556771b783e579d2111681844e2dbdd411fd4e58873c2b173e432eb00ef1782b186cef6d0104cb69b4bcd12a19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517452, "uuid": "edac28b8-841c-4f48-a7c0-5e747b2dac33", "value": "T1A1432BD6B801AD7CF94FE6BE8423090DF661335151930B2B67ABFDD36D321A86E12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517452, "uuid": "0d99259e-50a3-4834-85fb-5c43da11727e", "value": "1536:uc4QFpUZAJIwvgjYjD1yIo8Wh6fBqozr2:XfFpUZGIwvdjD1fO3oH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634517452, "uuid": "e634a1a3-8306-4efe-ab8e-dfbc8ae5419c", "value": 57092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634517452, "uuid": "ae5024cb-ce62-4014-bac3-8f62cd586bf0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517452, "uuid": "145a4ba5-a2ed-4208-9830-5f3edd1c52d8", "value": "6ff029e20f977d8b328a901c12798292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b52a83-3060-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634595080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595080, "uuid": "99c5317f-c2cc-43ae-b885-4a869403330d", "comment": "Malware payload (SilentBuilder)", "value": "9e42010b96e10163af02ecf16503703c", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595080, "uuid": "1b689b05-8339-4286-868c-8c4feae852aa", "comment": "Malware payload (SilentBuilder)", "value": "70f68a33c92e5845d8c33cc3382c264aa8cb1deb6a30379e4d5167197267c73d", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595080, "uuid": "08027fd3-6f01-47a9-892a-f80aee9cde29", "comment": "Malware payload (SilentBuilder)", "value": "735c687fce7cb6cda7ed2c79283387b52c88ec9c", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595080, "uuid": "4aaa2f70-7725-42ef-bcaa-94ed828f1493", "comment": "Malware payload (SilentBuilder)", "value": "e476b9b1fc455dbaae7f24db59729a97c3898e215b79b5dcf4d5f0d0969398d19216d7817281ebb2d732fc1021055ab1", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595080, "uuid": "69e3f6d5-da6d-49b5-81bd-69b1b9f2c148", "value": "T11A44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595080, "uuid": "2206e3de-130a-4ad3-84b3-459a9656b975", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw76:U9jFrjmkD7IvLDK3vLvfn1+2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595080, "uuid": "bca2ce65-c943-467c-a8dd-bb6d225f3a52", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595080, "uuid": "50b681bf-48f6-4232-a257-df91cace054e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595080, "uuid": "ee33625a-6674-4bde-892c-ee02321499f4", "value": "9e42010b96e10163af02ecf16503703c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f66b34-2fc5-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528403, "uuid": "1565d2e4-0b1f-42bc-b3df-b69b1ef8f031", "comment": "Malware payload (Gafgyt)", "value": "42da82a9e4d328e260ee6a2875d125a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528403, "uuid": "becf66f9-cfbf-4ffb-bc72-8f83b136de38", "comment": "Malware payload (Gafgyt)", "value": "7114dbc49bfc010b8cc183e392985fc65911bffe2094ebd65b7a8ce9decce2a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528403, "uuid": "8284dbaa-fb50-4ffa-9b68-f48ce4363eda", "comment": "Malware payload (Gafgyt)", "value": "e8e4e9aca2061f338df8118964b9593ce17baaec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528403, "uuid": "8667be2f-c13c-4766-bcfe-03f2ab5d6960", "comment": "Malware payload (Gafgyt)", "value": "084574059912f45af7a468b8f9e3fa76c0bbab2171d04c1329bd124dd70a6f457f62d6b0ea105e5ac9ef9d40293079df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528403, "uuid": "5258ce19-45cc-4156-abf9-2f0e0f5143e9", "value": "T19AC3093B6B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528403, "uuid": "f23fab14-1c9f-4210-9ad0-4f154f773b3b", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtARRdc0sfm7ypwYujl3IdnuW:ZP0DNPAk5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528403, "uuid": "12ec2043-16e5-4a54-8ccd-1e10fe38ed45", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528403, "uuid": "6f3085ad-a5cd-4494-8ed4-3e57b3e02037", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528403, "uuid": "4fb0a294-2697-4bdb-b3c9-f46a7ea63631", "value": "42da82a9e4d328e260ee6a2875d125a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df0fa7d-2fbf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634526003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526003, "uuid": "a5024350-acf3-4756-ac89-af34360f4972", "comment": "Malware payload", "value": "bedc5713b9c34ba1b0191ec7f98d486b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526003, "uuid": "50dab22c-1f45-464c-971b-1555f490c608", "comment": "Malware payload", "value": "72d511ab01b1979034a0e4161cd785cf5dc71b2c313d24f5dcbcf680df29a16d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526003, "uuid": "c869d89f-3f2f-4741-a6e9-30ec3417c718", "comment": "Malware payload", "value": "481e5809aad515f49daf7017e674d834cd40cf0a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526003, "uuid": "2f218b84-178f-4525-9f4f-118ae2087ca0", "comment": "Malware payload", "value": "ff2d75976c8c0c714a5d548f036dd4140571ffe65cc84fdd99f7ed32d6bd41d920796fb3c21cd84afdc9d599d026a05d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634526003, "uuid": "adba6c8d-700a-4f7f-b9a9-47c199653e7d", "value": "T1F1530243C38136B0FAD1757993A89B03737E52D9A02FF2F115E3AE05E0F66718560B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634526003, "uuid": "3550b0fc-928a-48bd-b9b7-2c95f350db11", "value": "1536:AwLv4vTQIqeAsERbMLyb15ZQv0MxS9eYGGJK0Nfbvq0/:AQ47QVzsERIex5Gp73Erqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634526003, "uuid": "60d30a37-1f97-47b6-8a13-bb2a64b65fcc", "value": 64652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634526003, "uuid": "27582922-b88c-4c77-9818-16b22c3c14cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634526003, "uuid": "451d4dcb-a310-4673-8f3f-a9dec866a9da", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b660a3-300c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634559175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559175, "uuid": "27ab4afd-5ca2-46fd-ad40-014a522e65d8", "comment": "Malware payload", "value": "ed733d50002d20e73144ea6dc1cf5078", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559175, "uuid": "9e7085c2-5a59-4484-b895-7ce555c4b5e9", "comment": "Malware payload", "value": "7320ba07df9cd7477e9860bda406461350e5bec8199b6f1a97a5ec9aad851653", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559175, "uuid": "7ad37c63-95ac-4a34-8f00-840348f3d79d", "comment": "Malware payload", "value": "7e1a9319a048c0f7ef808bd1435ff5473b0c9f67", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559175, "uuid": "eb436abe-d9ea-42c6-8629-16f881d277e1", "comment": "Malware payload", "value": "a26dbae54bd56fac1b6e4228cc48ce2c87120e16ff4f8a8c1eb977020b3b40515ba968f506723c5cb0435fa5c04cf060", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559175, "uuid": "7e4e6ae9-293d-4cf3-964c-b54e671873c7", "value": "T1734302A3E0661C2DDF956036558403AC62AA18578AEB18C2D7508BC98EB5E056BCFE78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559175, "uuid": "0c51a8df-d791-4911-ae88-dd85253f1d8f", "value": "1536:SHVESOgVYSfdCXzovqPgW4Roh49HaM2nw:U+STVYmkXzJI9omdaM2nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634559175, "uuid": "9aa7db2c-3fde-4130-9ebb-4edb35c73caa", "value": 55376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634559175, "uuid": "73b57199-922d-422c-a20b-e219b25537d6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559175, "uuid": "a5b196be-8e95-4d52-8dce-17bc160142fa", "value": "Order LT-39-SSMC-2021.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e20180-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561375, "uuid": "b9d3e903-e431-4957-9a53-226f242a2c58", "comment": "Malware payload", "value": "dc578fbf139e22fe0a52cd2e6129743b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561375, "uuid": "6cdd82b6-e620-42e6-8a05-76af7d8d5724", "comment": "Malware payload", "value": "748bf430132af621a285d9de3b18765ebc8ddfb67e35dbfd4d3a7d7c9d1c033a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561375, "uuid": "34acbd25-ca74-4634-afb7-91065ed1b750", "comment": "Malware payload", "value": "50de4edde579bf45290adb254e4d6e16b18fea48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561375, "uuid": "72e8bb69-de68-49e8-ba15-f42c706ae6c4", "comment": "Malware payload", "value": "77ae432ebf21abd6dcb8b1bd03472c05251bc901278ca23b0477770cef2200f73bcc91da7cbcfc1ff0c507fec1237bf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561375, "uuid": "d073eced-a90b-4e1b-99a8-4e228af33a99", "value": "T147B4F15E9EDCC015D24CA2F06F27463392B48B52E179DB8CDEDDE55B9228F139B00EA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561375, "uuid": "8bc957a5-7aa5-4bd3-8e68-05fd2b450b74", "value": "9c0050334da711b5147027326c52827d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561375, "uuid": "ef160a48-7379-48db-9a9f-4022c068eb9b", "value": "6144:UmEOTRF7j3Wp/AUm3WpToV0cgZ3Wp/AUm3WphvHYZaTnEr83Wp/AUm3WpToV0cga:UmVe5xoT5bYZ6Ex5xoT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561375, "uuid": "30fd2605-b932-4961-b783-809157f78254", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561375, "uuid": "d061ce41-adf4-4801-872e-72ece2342552", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561375, "uuid": "d7578aa4-892b-4925-816f-5e30afa733b6", "value": "prv__phot.gif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9860e0ff-2ff1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1634547523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547523, "uuid": "921f2ee8-042e-481f-9d79-96e96d9a2ffb", "comment": "Malware payload (Gozi)", "value": "b1f62b99b296f46ec8fff477511be8fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547523, "uuid": "0883959e-1050-4a0c-be54-1916cb4f882d", "comment": "Malware payload (Gozi)", "value": "76b320b608f6d6066d73a0bea48af74d28f95c752dfe2cfb475078f7eb7baf52", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547523, "uuid": "7ef1bcc8-9a58-4117-b0e3-decfde91ec84", "comment": "Malware payload (Gozi)", "value": "ee7c8938e89580847217d8a97cb9e76f2311cab5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547523, "uuid": "d9b32451-9bbd-4185-861b-f22db3c27bc1", "comment": "Malware payload (Gozi)", "value": "dd1b86f87c4d1eeb754d2388b40a58c0195639bd63c1061ea274d88744d38de7e7837ee46516c77481015fadb548b17e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547523, "uuid": "3364b54e-3516-48d5-99f9-3050cc2a99f9", "value": "T196D49E2032A18032E177163584F5D1F05FADBC225D74AD8F72C52A7F0A7B6D29A29B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547523, "uuid": "347494ac-9380-406a-a302-571ae8e5c57a", "value": "5d7c21acb216092a102403a32ccc6d15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547523, "uuid": "a578d950-d3a1-44a7-aa83-f4f82b942b2d", "value": "12288:68dajLSIFcqRfyo4T489UtoM+YD3h0QYDpnynKZ0febiL+eMq6FiIa9zrg:Goqpyo4T4mUtoMapy60feKQiIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634547523, "uuid": "4164c8cb-d052-4409-92c5-366bb08cfbd8", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634547523, "uuid": "65489263-61fd-47f0-96dc-a9062a2883ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547523, "uuid": "61f1b59e-a9fe-46ae-8d41-abe0354eba61", "value": "6.tiff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ecab8d-3027-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634570814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570814, "uuid": "a4362f22-34ae-4510-a859-5503da5c6d98", "comment": "Malware payload (SilentBuilder)", "value": "7271ee15b399bac71f6319dcea23421c", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570814, "uuid": "bfaf18ac-1224-4646-b4fb-653a46ed3d94", "comment": "Malware payload (SilentBuilder)", "value": "774c805cc186133b0de250085da60ab848f6c81d414bdbef9479bf31620ef66e", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570814, "uuid": "65f8369f-77f9-4638-b045-d02f681f83ea", "comment": "Malware payload (SilentBuilder)", "value": "ecc9308dd9421918c47d07ac6680e91b7783a4cf", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570814, "uuid": "fe608d53-42a9-4d09-93f2-2ada63ddd345", "comment": "Malware payload (SilentBuilder)", "value": "868b4b86bb536f25f58948a0110a77f5db63d53a5adc20e1805a1b768965d8d8a6b8c2334620d5154569dc221194f889", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570814, "uuid": "43c66e79-2986-4882-aebf-bf31420ca1d8", "value": "T1DB44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570814, "uuid": "45d96800-7042-447f-9a45-32ad3a7bc58f", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw72:U9jFrjmkD7IvLDK3vLvfn1+20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634570814, "uuid": "5daef7a6-b056-49fc-b1c9-44f1440d3a85", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634570814, "uuid": "1b36d737-5d26-41fc-ba10-b17647ec26b0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570814, "uuid": "0a4bc03f-5ba8-4c7f-9239-c068e8275ae8", "value": "7271ee15b399bac71f6319dcea23421c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d347c6e6-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634542038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542038, "uuid": "32c75a76-a004-402e-a810-fe09a0ce7e2d", "comment": "Malware payload", "value": "bb961899188d824f8d71b05a0c0ec75e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542038, "uuid": "97eb4a7d-99b9-4a00-823c-b0e5abda5e91", "comment": "Malware payload", "value": "78d354f664a174f905080bc2e5b6477715d4e36171be240ee9c5beac38424b7e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542038, "uuid": "f5f134ea-0e9f-458d-b90a-e4a81f471e26", "comment": "Malware payload", "value": "640366efe302738d1ffdb77d690a8ebf0dc1861f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542038, "uuid": "b3983af8-c2d2-4986-9177-d6fec1637bfa", "comment": "Malware payload", "value": "b4d459ff79b2875b1504dda186d57711fc91af38998b74af3b8d31f95cd4755143e1b8c22a899f592bfe557bed5dd5e8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542038, "uuid": "c6be4e99-48c0-4c72-ba7d-8cf6e7e119f3", "value": "T143D58D23F2D18437C1732A389D5B9768A929BE102E78984B3BF83D4C5F3979079252D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542038, "uuid": "7e14064b-de93-4910-91f8-dde5f6b44a50", "value": "24576:oxO/K4GQWbqW5Aw6rCILAtDo+vZVqJA9lCLpe8as1xYTU+Ke3e5OYLnA:oxWRCILAtrVmA9lhTPKeKOYLnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542038, "uuid": "4c92b246-ea39-4b43-9e0f-792f5970fc5e", "value": 2809344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542038, "uuid": "3f9189f6-a3b0-40b1-bedb-8a691d4434df", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542038, "uuid": "4268f86f-4d62-4478-aefc-fbd189e603b9", "value": "_mjovxjwnrxzeucfopnmlligppggqbopqkmsersij.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3895ad-3023-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634568786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568786, "uuid": "b3786bb7-0467-4680-8f84-a97d073d8126", "comment": "Malware payload (Formbook)", "value": "f3512395f5dc2b8bfa0bbca4bedfe15f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568786, "uuid": "8c0ea2d7-fe3c-44cc-bc64-cc34b52da699", "comment": "Malware payload (Formbook)", "value": "79bcbfe90332fe976229f75f64723adcf0db4a0df4a088b1370fef38f20a6630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568786, "uuid": "b61d0f80-fc31-42ab-ae41-9146ce4a19b1", "comment": "Malware payload (Formbook)", "value": "a81f400dd105d3041fef6a84c42874b216b68162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568786, "uuid": "53eeccfc-dde4-4908-8cf2-940e38c508dd", "comment": "Malware payload (Formbook)", "value": "e19d4ce28539d635b51e224c1f96481e029766e0c73b85c8b609c1e5027533fd1fb6b9cb17042177496bc2649f3c2b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568786, "uuid": "3c3ec3a1-2f81-4108-b6a7-1f9b686d8084", "value": "T18E441265B1DE52EBCB11897507B79BA3C3F6C2208538E7ABA7210D76A0303DB6635742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568786, "uuid": "8a85d5d6-0143-4068-88a6-cd1a99f33251", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568786, "uuid": "ef61423f-3ee5-4a81-98d1-f65664f330eb", "value": "6144:wBlL/c2QY/Wpo6H/uvspndzM3Q4WRPngKawZbjW:CeUepB/1pndzlLRPgKtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568786, "uuid": "fd818301-5d35-41bb-a9df-f1c592253ff5", "value": 258281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568786, "uuid": "ca3fd4af-da1f-4658-a42f-ccbf3c903cd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568786, "uuid": "2cb05eee-6763-48f9-bcd4-b85f1967a9a6", "value": "order_doc.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a123d9cd-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634555698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555698, "uuid": "b976fa72-59a0-4e11-8072-7e45018de4b1", "comment": "Malware payload (DanaBot)", "value": "1fb696816a41af9bb6d2de969437eeab", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555698, "uuid": "7f992811-c686-4f8d-8e62-6adfaacdce4d", "comment": "Malware payload (DanaBot)", "value": "7b28129eaa03d71ef87389dbeef37817fce2607c5fb2833b6803d92795bb79bf", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555698, "uuid": "596e5d5d-dedb-437e-8a3e-6c33c4d62161", "comment": "Malware payload (DanaBot)", "value": "7309694fa4a9625351d4fa307a6ccd2e01e31791", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555698, "uuid": "0c12bf3a-b7db-49fd-a8d3-925c10dd1808", "comment": "Malware payload (DanaBot)", "value": "ecc6ad350f5b15f5534091727b1cb40b75d212db3038807af5d050c047e6b57f136383cb475fcdeb602e81b2642583e7", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555698, "uuid": "61eb5b32-901c-4495-ba57-e907ab344644", "value": "T169450110E651C039F4BBD2F489BA126BA93E7FA06B1490CB53D91AEE57745E0ED3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555698, "uuid": "b845db3b-05e8-445c-9323-61b672108ddd", "value": "d29112deebad1bc2847e7571006fa346", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555698, "uuid": "747a5cc0-7de4-434f-8ea9-ff972115ace8", "value": "24576:IBWjhERO2Q2PxbUsCKULdHN8ME7SVstG1de7ld8UiFPZz:ANQ2Px4RKULRmlOsyg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555698, "uuid": "eb93c299-dfad-40e2-aa8d-ee5041b5e098", "value": 1269760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555698, "uuid": "6a011086-47b0-49dc-8dcd-4fa0be6c855b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555698, "uuid": "25fee30e-094e-4874-85fd-2fd121e91f6c", "value": "1fb696816a41af9bb6d2de969437eeab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc586b13-2fd6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634536040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536040, "uuid": "a3e3e46d-b8a0-4fab-9f4b-8ddd0abdb54c", "comment": "Malware payload", "value": "2a46b7ff70e61702878336c0bbb5c7f3", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536040, "uuid": "f8bc93fb-a741-431d-b280-c1a75b43279e", "comment": "Malware payload", "value": "7d0280aef581c9dc1232615c7c3586e13dc9115862af18a0acf0fafd77c6a75f", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536040, "uuid": "5e083f70-1f68-4f25-a7b1-1304e1ded826", "comment": "Malware payload", "value": "81ba20b79fabc766f1cbdaa2b24f7ac08e7961bd", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536040, "uuid": "fb610327-baa7-49df-9830-edd575de489f", "comment": "Malware payload", "value": "cfaf0285a4954f7ed5da9df5179711594ba4921540fcb366efe5155252608f27aafc5d18219edfe7d7b9c4a5eb9351ef", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536040, "uuid": "c1b77f30-d325-4d7c-94c1-1be388740ace", "value": "T1A4D412A6D352F4D4CE1B697502950BE15219294782C2FA1E3DCCF6AC0F52BD30FAF686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536040, "uuid": "f63ffa2b-4054-40d6-bdff-15cda12ab2d1", "value": "12288:Mn+8U4fABBjZruVkGcCI0jvSijb//3yuBbt3EwsDYlmuFN:q+8U4fABBjZrvT0bSi//iuptUwc+DP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634536040, "uuid": "dc1e6138-92a4-44f7-81e0-e03a15e57b12", "value": 650335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634536040, "uuid": "8e7d3933-2c00-4f61-934c-8098dbc2c15c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536040, "uuid": "83624a7f-07f4-4ab8-acff-cba0a4b0a0b3", "value": "Purchase Order.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f007e14-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634555641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555641, "uuid": "de7bf33d-4e7d-4a84-9a7e-a3225893fa5d", "comment": "Malware payload (RedLineStealer)", "value": "be034f3e34a6c86d61dc394ea5f3631c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555641, "uuid": "dc6ac91d-f9a6-40f3-9669-47e8abe0bf43", "comment": "Malware payload (RedLineStealer)", "value": "7d4e73b135bce46a872bbd001daca00156d66a28b809be50c56a468d90f15092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555641, "uuid": "9760221e-3d9b-444e-b81f-6c98f7f4fcdc", "comment": "Malware payload (RedLineStealer)", "value": "8497724caf3e18572a51531717148d6a565ed2ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555641, "uuid": "9cf2a7b5-77a7-42b7-9637-3c9b9c188b4f", "comment": "Malware payload (RedLineStealer)", "value": "9dabfdf92e8ecef6de8a9794bf9898e5613a56e796ff0124d08c8153b836ed51fd045898a5852c04fd4f58e792e45f6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555641, "uuid": "f3a280aa-4290-46f7-b525-6e3d5d10188e", "value": "T1F9949E00A660C039F5F261F5BDB993B8A52E7FE16B2450CB52D916EE97356E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555641, "uuid": "d90e3198-773d-495c-8544-ea03b9c2eaba", "value": "b4cda15a674ef12000829b9be50880b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555641, "uuid": "6859ddf2-8481-4183-ae57-02ad4fa4ca09", "value": "12288:F0eoAnoGQPPYEPGDJSGfIdLcKQ1SAc1GyqB:F0EoGlEPwS/Q1SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555641, "uuid": "478b4f94-2484-4c51-8bcd-f667d9f960f3", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555641, "uuid": "e787cde5-36af-465e-a51a-2dc093076937", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555641, "uuid": "35bcba09-ecf3-422a-a82e-958d610dfd1c", "value": "be034f3e34a6c86d61dc394ea5f3631c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03e26f9-3014-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634562649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634562649, "uuid": "b0fe78fb-23aa-474f-97af-5730df0f5b25", "comment": "Malware payload", "value": "ebd96a20f2bff571ebd235289352ea3b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634562649, "uuid": "c1d2aa38-fdec-4e95-86ea-5e7c6b56af78", "comment": "Malware payload", "value": "7dc34a2e0374ab5d4e82d2f9314cab11a682e74c023cbb5eadf90f51d72ca546", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634562649, "uuid": "b14c8b61-8525-456e-a7e6-2a2fac26bb90", "comment": "Malware payload", "value": "d86d342df91a262a8b73c12c16ec29d151bbf1a1", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634562649, "uuid": "d2c2ad83-35e2-4e76-8f6f-258e2002cc8e", "comment": "Malware payload", "value": "419c30fc4522fe8ec85445c6583a9e9a8b49e02a8f57788f709fc026c505675649fb954b42efc56ff0a51afe87a1163f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634562649, "uuid": "98754ced-a3e1-42c7-925d-b4b23418ea12", "value": "T18C532A55B666D99AE69517364CE2CAEE7336FC50AF9B43073204B32E1EB92C0C913707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634562649, "uuid": "1976ccf4-7828-4323-be89-468b78b6f898", "value": "1536:9sQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0jCoyp6p2UUayqI3J/msik:9hlYkEIuPm3fNRZmbaoFhZhR0cixIHmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634562649, "uuid": "a064c801-82e0-4981-8c8c-bd7bb4726a58", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634562649, "uuid": "65674ae6-f417-49d0-9e6d-13718a4b04ff", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634562649, "uuid": "1723db60-d400-4bc5-8c7f-fec263979af5", "value": "004198998263_4.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb416dd-2ff7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634549870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549870, "uuid": "0bac6e43-62e2-419d-9c8e-149aa8523438", "comment": "Malware payload", "value": "46e1d2fdaadd9432956dfd11592f2043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549870, "uuid": "e58aa517-89b9-42d2-8d61-bd7c3d2444c1", "comment": "Malware payload", "value": "7efa518fb8b809689b8c93d66de21762f7c22654a65fb055a7866dd74fc6175e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549870, "uuid": "495f5c43-e780-4e56-a144-99062014213b", "comment": "Malware payload", "value": "874dd8ea62d06ab2d5b7ed16d1ff939f73141fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549870, "uuid": "090a52df-a830-49ad-8548-6319f6170a5d", "comment": "Malware payload", "value": "1047a93179528d3962333b92c9b76f40e39374f3d50b18989daf68224eba0b650b092a8faf16bcea7535158b2269765a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549870, "uuid": "bea7f955-c933-457f-9826-34b15456932b", "value": "T1E1058D2BF2246837E6B7A4BA5C2693F6DC356EC03960F8816AFC3D5D0BB97427136051", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549870, "uuid": "b9683d5b-a263-48e9-85e2-c08e421de270", "value": "9d6254f1666ec7df9c70515cf5807dca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549870, "uuid": "115817cd-85c2-4128-83a2-e53e2ef12a2c", "value": "12288:ngXbE33TJYei20w6R5ghlWIWeePRfzqzqyjFPKncY:ngXozJzix84eePIH56c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549870, "uuid": "7f9a6c38-1e93-4a69-a764-1783243c60b6", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549870, "uuid": "4e10037b-e9ff-4770-924c-6956fcb6573a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549870, "uuid": "53de8916-a630-4241-8b70-ed90a493996b", "value": "Email Correspondence _873839330-2-Notification from SARS_2737398336_39373993373_83737383939_373736363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7dcc8e-2fd7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634536203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536203, "uuid": "b80cc900-f546-45c5-a6b4-3c87418526db", "comment": "Malware payload (Mirai)", "value": "6d17db658550fe459a515f5db5ab3d1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536203, "uuid": "d1fd5e93-2a4b-4f37-83e8-b2f5a1e5fe1f", "comment": "Malware payload (Mirai)", "value": "7f8c0191a1ea81b018c668d7ba37832b75ecdfb07135cbb768c7137646dbe1eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536203, "uuid": "d33b49ea-604a-42cd-8580-a0edebc8724b", "comment": "Malware payload (Mirai)", "value": "868e9fecc0cb050f221664978299529c0ee1271c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536203, "uuid": "acedfefc-3a31-441b-a236-cee7f1b2f4d1", "comment": "Malware payload (Mirai)", "value": "64c868e9280a5bbc94feda0c9f66828008bdc0d94ef86c3c9436fc5aede8b7c4c5faed93ae7c6c54989b132a9d0addef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536203, "uuid": "78b0fedb-3ee6-48ba-b715-44f96ca6c425", "value": "T1D1F2E169A4FB8B07D67F003B0E6EA61C1142CB06D535D219E9E05272DDADF9DEC382C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536203, "uuid": "340f0bcc-4ccc-448f-ae58-6124fe9753e8", "value": "768:XkJ7XGW5xN2nw4FW/c9yqIJWBeiZtBO12WKWCUYIKCrsmHZC+pQnbcuyD7UHQRjD:XkkW5aw4FEtqIJWBBc2WKWCUY/UsYgc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634536203, "uuid": "814734d4-952f-4e1b-b46b-d30594f75060", "value": 36152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634536203, "uuid": "5cefc54d-aa19-4bd9-8ef2-e7fee3ec28f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536203, "uuid": "556d5116-2a31-4065-bdb0-a9db01137c41", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d351ebdc-2fad-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1634518416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634518416, "uuid": "2c25a82a-da7b-4b79-b4f6-2ff131e4ea81", "comment": "Malware payload (AveMariaRAT)", "value": "09ae20363ba78b58024de5f5a477c4d7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634518416, "uuid": "423999a5-850c-4120-b9ec-779ce792fbc9", "comment": "Malware payload (AveMariaRAT)", "value": "7fd5f95861a30bd4232f76b5041a55cfcaf7debdf6efc79b6adaddf4aabb8f29", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634518416, "uuid": "a5a6f931-0fea-4291-99f0-61d1784cc933", "comment": "Malware payload (AveMariaRAT)", "value": "d8cedaa9f45e72efcd4a79486d9d544479876c2b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634518416, "uuid": "de8dce3b-64fc-442b-bab1-62f59c09a0c8", "comment": "Malware payload (AveMariaRAT)", "value": "017dcead642d58069d884627f15136ff98a3ec93dcdfc316199eaafb674a831f0acdce1cad78c422418ce24125b57857", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634518416, "uuid": "e87bf15c-956b-40d6-b25c-3c021e21634c", "value": "T130258D2DB78DCA95C71A8973C137C2B013B08D6EA25AE22F34C57FD678F2342461E596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634518416, "uuid": "7ae2612e-499e-4877-864b-ad74060694b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634518416, "uuid": "de1ee112-82e5-4053-90b6-e9563c89f7c6", "value": "12288:HCyhPc4hbmOwD71tJha6QSGYlrVs8tBnqRrfgwNaSctMX:HCak8bmOKhtPUY8bxsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634518416, "uuid": "454db093-37f1-4a34-9654-0946af55c84c", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634518416, "uuid": "98c5faff-937a-436e-b6d3-5c9859c09798", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634518416, "uuid": "bf7462a5-fceb-4e40-a6c0-df5b5a474d11", "value": "Order18102021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6305a3c6-3024-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569337, "uuid": "d8066830-530b-4069-9c00-c2037300fbc9", "comment": "Malware payload (Mirai)", "value": "f3daa8bd2ecba6ddbde6614d407b8c25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569337, "uuid": "c73c70b9-6872-4520-aa05-26e234617cf2", "comment": "Malware payload (Mirai)", "value": "8077bb4ec400dca540d14eff742b3da14d709b0b9f49dc2968ee527a87c383d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569337, "uuid": "034ac751-e46a-4660-9f1f-bd460abd78f2", "comment": "Malware payload (Mirai)", "value": "fd0aee1cf4428c3b35625116ac79babd4baf4ed7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569337, "uuid": "4aa6a3b3-6369-44f9-967f-9ad761953a61", "comment": "Malware payload (Mirai)", "value": "abdc7437aef61f5115c3a3591d4c3a1b671ef7b42a9d03b5ddd4ff21ddc0fddf48057890d7dad28d0947ece703a6c389", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569337, "uuid": "a6be15d0-3fa1-4444-b39d-dda7eecf3cd8", "value": "T11AA3840E2E619F7DFFAC823887B79B219249339A36E1C585D15CEA011E7034E741FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569337, "uuid": "b7d00312-b46e-48b8-898a-9c21fe47a467", "value": "3072:XDIkiGgcsQoeJP0r01ed6WP0qNuCd4aRP9:iU2Rd6WP0qNuCuMP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569337, "uuid": "93121ea3-fd45-4399-989b-490b123eeed8", "value": 100332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569337, "uuid": "03409bc8-1226-4fd1-a785-c0da67062873", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569337, "uuid": "4bca1a31-9c43-4260-99b7-5711190bae04", "value": "f3daa8bd2ecba6ddbde6614d407b8c25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f9696e-3029-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634571570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571570, "uuid": "84a01f4a-c85f-402c-9d57-a5126aea5283", "comment": "Malware payload (SilentBuilder)", "value": "0341a7206dcd4ca9e016d4df29aa1cc1", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571570, "uuid": "d7c4662b-c963-46fb-81a5-523e8ee6590a", "comment": "Malware payload (SilentBuilder)", "value": "8090d0e1b63f724997e71409aeb561dde7745b07f22ce166f628f780e495c31b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571570, "uuid": "1db80f96-0754-4e48-988c-9c6c539dfc61", "comment": "Malware payload (SilentBuilder)", "value": "8fdae892f3b20e3aa7aaea6cb6d51b9e521a6ee7", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571570, "uuid": "f4418ad3-15ca-4eae-b858-b19b89f09b26", "comment": "Malware payload (SilentBuilder)", "value": "7accd213aac81d67af76f40251169d5cf874c1bd1b6ed732df8fac97873c017db00b561b952c5ae2092e2dd76b7db0fd", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571570, "uuid": "61c58a1c-20b1-4bab-ab2a-0f0651dff4d6", "value": "T1DE44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571570, "uuid": "f2dfd5b5-1014-474a-a31d-4a667d5dfb10", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7I:U9jFrjmkD7IvLDK3vLvfn1+2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571570, "uuid": "c3fcc43f-7aa2-4f73-b382-fa1103d7271e", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571570, "uuid": "bc9f5fd2-8d8f-474f-8513-94396096d351", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571570, "uuid": "03348548-962f-41fc-95ad-95c9b39494c8", "value": "0341a7206dcd4ca9e016d4df29aa1cc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755678e5-3007-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634556913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556913, "uuid": "6caf261a-393d-4f67-8f66-8718a4034804", "comment": "Malware payload", "value": "b6978455357d7a83efd04f0ea146dcef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556913, "uuid": "e6aac636-47a5-4221-9946-7a1b2cd586d4", "comment": "Malware payload", "value": "80fe865d3c2c12bc4cbc1404e9e428f44b4056dbb86180089968998d0494d819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556913, "uuid": "da6663fb-46c6-43b5-a88d-c7e58604fc2f", "comment": "Malware payload", "value": "4978bb4e4d7e2bdcc8a6db6a191ea70b17dc720d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556913, "uuid": "f169b5ae-788c-4152-9395-c4b23620a22c", "comment": "Malware payload", "value": "1ae0c215a497b334063cb8fb3c84e762c9e7ec141e8b5f5119d3490dd8a12394670cfc3bcd6165e16862662743db933e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556913, "uuid": "3daca787-a2c4-4ca9-bb64-be9d5f508b76", "value": "T1E0F533966BC4BDFEF3BD5C70242DAE8193B6A1667C08412EFE1E1ED76482704E331A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556913, "uuid": "7acf2900-c42d-4553-b30c-954e25ac1781", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556913, "uuid": "593ef7d2-39c1-4e63-93ff-888997f93e1d", "value": "49152:YQMK1G8p4yncQyRbTLU+sbCcNVFv+TCJQRZSeJeMNLoq68bYs2QB:7MKlOe0rsTNVFvgIQRgeJeMNVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556913, "uuid": "894b0c3a-c90d-4495-8aa0-8ec08fb0bfe4", "value": 3406848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556913, "uuid": "336d4578-7215-409a-b2b0-5017bc40329b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556913, "uuid": "ead4c8ff-8205-4247-bc37-ea3f17751535", "value": "b6978455357d7a83efd04f0ea146dcef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9708c3ec-300b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634558687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558687, "uuid": "b1bc32f6-fe48-4722-9bd9-c47ee889f3fe", "comment": "Malware payload (SnakeKeylogger)", "value": "dbc86fb7bb8ff78aa755b835af1cea43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558687, "uuid": "6de70cba-6320-45bd-915c-1a25ffd48111", "comment": "Malware payload (SnakeKeylogger)", "value": "8194267924b10c3df2ea10dc1d56f9365effe18125b9197dfcc720db3e3e5f48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558687, "uuid": "644853ff-d854-4a97-99f4-d2b4174a9218", "comment": "Malware payload (SnakeKeylogger)", "value": "ef3dded98b53181472f2f76bd56640e78441c094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558687, "uuid": "33e5c180-8208-42d3-9ee2-311bb0e16a4c", "comment": "Malware payload (SnakeKeylogger)", "value": "8946cf9d8e67a7f3d919df15d34e7c1765a186e38595fa435fa20fc94739475dea8e5d5dac2460050b1f5fd84104e8c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558687, "uuid": "60640896-afd0-4e7a-a88a-b9cb3655a3c9", "value": "T11E73D8013E046689C4920C7901F25AD1A3788DDF8E9ACE3779E5B73E7873664AE0793D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558687, "uuid": "01b1f6f0-c18b-4608-a7ef-09bb4a039304", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558687, "uuid": "cc49145d-afae-4447-90fc-9b03df78e934", "value": "768:WIcB9i3IULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0ct:W9HyIULFMAAiu6JL6oNsgFAyox0ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558687, "uuid": "45a92cdb-626e-4904-8e8e-bcaa80c22066", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558687, "uuid": "bf1e95c4-f908-4dad-a165-4a4c45c586b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558687, "uuid": "f15a88e4-701d-4d34-bf13-de4b658655a5", "value": "dbc86fb7bb8ff78aa755b835af1cea43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3e8f5e-300a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634558317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558317, "uuid": "03cc6433-eb53-4ce8-9568-1570ab711f16", "comment": "Malware payload (RedLineStealer)", "value": "4ac64b6c5fd04153003420db6f9c6263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558317, "uuid": "99adaf57-5f1a-4950-8dd5-c0e3e1c29977", "comment": "Malware payload (RedLineStealer)", "value": "81eeeaf4e0190f6229bb7c76dffa6c5e8b1566f595ed796735415e0b8132e7d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558317, "uuid": "23817cb3-9692-45db-844c-4a37994fe519", "comment": "Malware payload (RedLineStealer)", "value": "f6a764c2c3788c90f70c8d73901e8d50fe0bc3c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558317, "uuid": "627ef7c3-07e9-4eaf-8991-5f6dbf903666", "comment": "Malware payload (RedLineStealer)", "value": "561af7d753a009554237f98532665f80f4de51777fc8f6e1e7562cb5d61c792520068143b83ec85294bdf4dfcd670026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558317, "uuid": "03ce8c79-7912-4f17-8b64-eb57257a3358", "value": "T10ED523878A645812DDDF987032EDE6136E78BF914B61D9DB106DF00C1E73FE06A6432A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558317, "uuid": "0812fdbd-3277-498e-81a0-df0536f593ec", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558317, "uuid": "50beaa46-526d-49aa-a8c5-83ff21fdfc1b", "value": "49152:qQyuTQPWf7DuibsIHHBvLBYlZdbaBRjUzny7JMWVgOmht:qQyL+zT7HhDuKRjUzny6tht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558317, "uuid": "4a18d2f8-58ec-4600-9017-b4d1d3efa9d8", "value": 2806800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558317, "uuid": "2ecf20ad-1469-4d62-bfe6-0dda2b4c3a40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558317, "uuid": "49c3a0fb-1985-4d09-bee2-ae63f12b3955", "value": "4ac64b6c5fd04153003420db6f9c6263.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36658c5b-2ff7-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634549935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549935, "uuid": "0e719889-9c9e-4de7-a10f-d801063114f8", "comment": "Malware payload (Loki)", "value": "dbd2b86c7533b2f70feb439664eb266e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549935, "uuid": "79b1151c-4959-4107-a586-2698c9ba3d98", "comment": "Malware payload (Loki)", "value": "8273dac0332cd80b9d834b63118d5e171eea1d12b81c1bb2fa43a423ab173ca1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549935, "uuid": "3f5e9b8c-a675-4bdc-8d00-97d7401b4e0e", "comment": "Malware payload (Loki)", "value": "1109de3e62374be0c1f5a78bebfffe41918bb44a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549935, "uuid": "99460e74-49f7-41c8-a355-2f5314ce7e28", "comment": "Malware payload (Loki)", "value": "6f31cc0b684650b3b6940f8594d3d7c76c5ff09767961388e839bf89f236622bf782d7113b6a38032eaa08b065ebbc7f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549935, "uuid": "91f6d984-fd31-444a-849b-6a7799f433e4", "value": "T17FE3DF167281CA2AF29199315DC7CBFE36787E15BE46120732843B3E7D7AAB4CB01794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549935, "uuid": "4ae28fcc-ad99-4847-abb3-c9f33003ced8", "value": "3072:dIKVe7D9YD98IiikHyNjWuDlr8eGS16D:Be7CD9riikHyNjbDlrbLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549935, "uuid": "91f61159-b75c-4d8f-a286-b603e189ef1f", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549935, "uuid": "ac45e21e-b12b-401b-b0ce-5e1de1ffd4cb", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549935, "uuid": "e5f71e37-849a-4b32-a4d8-80c89fdfc788", "value": "Dekont.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03686bc-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634542033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542033, "uuid": "3fce419e-23b9-4f7b-a35e-095a6504a890", "comment": "Malware payload (SnakeKeylogger)", "value": "1a403d5b4db5509524bfd552afbc96f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542033, "uuid": "b6d03292-a2c8-4b27-8fd8-107cbbd6b13c", "comment": "Malware payload (SnakeKeylogger)", "value": "82b5be618f705ff7761c43590eb7dc89a2387512757dcc0df9290f29801b8f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542033, "uuid": "7dcaceaa-eff7-4b0d-8226-98567f903901", "comment": "Malware payload (SnakeKeylogger)", "value": "39a3ca238648f4f86741d6b94a190e0379aa7307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542033, "uuid": "6337f05b-db0a-44ea-8ff0-ec5f424ac7a2", "comment": "Malware payload (SnakeKeylogger)", "value": "651d3936f47289c27c69b6d0d6828e984f08e670917d981745482181ef98426ad2719343dc3a8ab645d4b51a9073d3fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542033, "uuid": "6df8efa0-5eff-417e-83e8-a6c0706700bc", "value": "T1EEA4E5392CCA6236E537B632CBF6541FFDA67A623615084C60C7078A8E13F166EC517E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542033, "uuid": "fa9c24ef-9f45-4292-b30f-6b8424df30b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542033, "uuid": "d22ff3d0-11b2-49d6-a68f-9536563eaa94", "value": "6144:GySkF/Kuq5K1GRVNXjEuZFkLMk/lOF4E91cQCwZ:/SkFMo1CNzEusLMkdOFh9/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542033, "uuid": "fc23bef6-a29d-4bba-aeca-a5210db148d7", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542033, "uuid": "60d11781-f4ba-4501-8a58-917df8fcc23b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542033, "uuid": "f1da534f-38ca-4dd9-9dd5-a6c704dcb7fb", "value": "2BABA new file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7815e9a7-3016-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634563360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563360, "uuid": "dbc5d43e-1178-4e4f-ad50-c46f10dea628", "comment": "Malware payload (AgentTesla)", "value": "8009c4fb49af5159865a87a097f916dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563360, "uuid": "c26abdda-f85e-44bf-b7f7-b1c45f892ba0", "comment": "Malware payload (AgentTesla)", "value": "82f9c09823864e90054131095deec5a93914bdb3ea5c11a4bc1ee05d7e0fed72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563360, "uuid": "c20aac66-f081-4ba8-9255-b1624f92adfe", "comment": "Malware payload (AgentTesla)", "value": "6009bca1181a026363ee23822fb2933b0fd8380f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563360, "uuid": "9f4f4ef0-5f4f-4383-92ef-94581c4abef7", "comment": "Malware payload (AgentTesla)", "value": "bd16cb9a19f96a93d958dcdb720bae9743aad2e0ee77c19fd644c7f9ef3d6e964518cc7cea0b3ad52f17a1536229abaa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563360, "uuid": "c35c0249-87c7-4d15-b67d-bea783f04393", "value": "T1B4841297871CA22ECA3E0DBC941E510D73728A39BAC1F7AB9467F65B01B67D349016C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563360, "uuid": "cd7f9bcc-6b75-443e-b23f-3a6b1737a545", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563360, "uuid": "4bcb51ad-fe09-40e7-a1ea-1f91087eeda6", "value": "12288:fQSBUfDQDMN+pbTFmrX8tbAkNdQdZ1ffyuphtW:VBYD3NSbT0rstbAkbQdZ1ffyanW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634563360, "uuid": "4ffdd1f4-0801-4fc9-b1c7-b580d25ba306", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634563360, "uuid": "65089ac9-510a-4b1c-8e69-0176be1bcae7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563360, "uuid": "7e4903fb-afa6-4684-ac5e-53ca04eb140b", "value": "4AyNBr3uasL1KdM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51754cc9-2fef-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634546545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546545, "uuid": "594aaf52-ad84-440b-bef8-5f170ba0587e", "comment": "Malware payload (NanoCore)", "value": "ad5f9a2799a236471266dca0d97e72ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546545, "uuid": "26a9aaa0-699f-4f27-a724-ce99a0d3b002", "comment": "Malware payload (NanoCore)", "value": "830729ddd326d2f43d99ecf2cf5aef7d6ff9a6cc4de8b61a2b19c62a5d27bd5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546545, "uuid": "5d9f87ec-f62c-40d1-becd-321a46a6f71a", "comment": "Malware payload (NanoCore)", "value": "45196bf8c7231582f25588e5a56f0fb6d8efd6e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546545, "uuid": "e95454c0-a4d0-4769-b13d-21a4a1edadb9", "comment": "Malware payload (NanoCore)", "value": "316b2bab9836c178027a5338d0819ec2da6700876c55a6d5e462e4edf538be44f780fcaeb15ffdbb73eeb4ceb3196555", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546545, "uuid": "f1beb704-c0c0-4736-8964-8adcb8a1c8dc", "value": "T12F9412853B4AC623CA2A03F150F2E3642B34D5762E41EB8B5DA134FB5D76FC88E41967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546545, "uuid": "663a4e59-3376-4ac5-82cc-f141e78dfd0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546545, "uuid": "cdbefd1a-f0b3-49b7-a4b8-93ecf2522a9e", "value": "6144:it6iTDWnUw3u/S/QUNQDpKmYZwrhvKnZoV7WImYKyn9hkUGIVCY:eTDKzq8mBrhinK7WImYVvkYVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546545, "uuid": "c6e46dbf-1a6e-4894-b3bc-8165e0194622", "value": 446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546545, "uuid": "e92384ba-3d56-41f2-842e-5990d2819d11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546545, "uuid": "6331160b-1110-4ced-92df-fabd651d1255", "value": "ad5f9a2799a236471266dca0d97e72ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb00136-3005-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634556256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556256, "uuid": "3e917409-b089-4523-baa0-996b12972dca", "comment": "Malware payload (GuLoader)", "value": "9f50a3c304f9d3b4924e219816a2200c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556256, "uuid": "9093569e-cf64-46ad-9895-44275c53c9f2", "comment": "Malware payload (GuLoader)", "value": "83885a76ecd052ac356b0465d146a23c59cca84e268834028d61e43aae870cdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556256, "uuid": "b5bcb008-e5aa-467e-938f-9ca58c6851d8", "comment": "Malware payload (GuLoader)", "value": "ed2327cb83097c996089f190e734d16b11599b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556256, "uuid": "157da32c-2a43-46f2-b491-3b13338739fa", "comment": "Malware payload (GuLoader)", "value": "47668b0e65cfa488747b39ffdc1e8fb181e86503aeabe875775701c8021d36a230e3f32f39820e11d0a4f6875be803e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556256, "uuid": "ca99b574-1029-4b49-b96a-3099836fbeae", "value": "T19F935AE51A9CBC60E982C9BD0B3F887B031E7C336595532712C4171BE9327C899B672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556256, "uuid": "cbf8b204-1f73-478d-9638-37084af8a785", "value": "6cda8b61dc739fa685b0a1af3300013c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556256, "uuid": "5d03ecaf-a16b-4cf9-99f9-a4f9f3ebd3f8", "value": "1536:t6ID02v7vJefTWsGdl4f3YKHiIEzuvzVD:t6IQ2TBmTZ3YcUEzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556256, "uuid": "6e5e3afb-f9ea-480a-8693-c8b46bd037ff", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556256, "uuid": "8a2752d8-e0e4-4bea-ac0b-ad75444f28b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556256, "uuid": "4eec6e58-245f-440c-947d-60fb1cf21185", "value": "N\u00ba 27210000483.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c30664-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568611, "uuid": "7c2d095b-5103-4d56-b0d8-0d7542fa62a1", "comment": "Malware payload (Mirai)", "value": "9f6a883882e42f8c77e3408b828bde40", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568611, "uuid": "2bc6aa1d-7a5f-40e3-a1c6-4645c406e2b0", "comment": "Malware payload (Mirai)", "value": "8457ba3d3c60871c958451c39e8851ac27d04ee78d7587482e22130750a83f8c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568611, "uuid": "b18a795c-d251-48b0-977a-51586538281d", "comment": "Malware payload (Mirai)", "value": "f435d1270e323eb5f3f9efdaa2b0bf4bcf32e791", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568611, "uuid": "a94ce44e-1606-45ae-adf0-020e43957806", "comment": "Malware payload (Mirai)", "value": "1eb0c1fb5a10a8db65f6dddd1b6389f01f7c2e188099ee8aa0082e44a167e9b4ee8856b1ecad22af9db63647b7b43957", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568611, "uuid": "06309dbf-f99b-47fc-8f22-c1fe628f74af", "value": "T1A513E19357A0D272DBB00436DD72C4CE7AB77AF1B8F27A0321721DB4CAC09598477995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568611, "uuid": "a404c032-6687-4fe3-8fa7-7fe6a692ab08", "value": "768:D+/zc+cVPBIey87RTZp72zH9HjlHr7RU7e+M0TqjCd7egK4ks3Uoz3:677cVRr7O9HpHraeaTNAgxz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568611, "uuid": "80671f0d-0f99-4ea8-b180-5e954495fd42", "value": 42036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568611, "uuid": "597b6b06-3b58-4f7f-b41c-2a9cd14055e2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568611, "uuid": "a452e1ad-c838-449d-8982-e20987aabb86", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1387cb1-3027-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634570838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570838, "uuid": "e7c61557-b26c-4795-bd6e-c01bee0f3d82", "comment": "Malware payload (SilentBuilder)", "value": "33ef31d0fe0c6d655461a94ee28cef35", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570838, "uuid": "a2650331-c3d3-43b0-84b5-af07a5c91b86", "comment": "Malware payload (SilentBuilder)", "value": "84d66860a16a1245884089e35bde4ae3a60449aef1f63aa0afa67008605e1c12", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570838, "uuid": "86e1150c-37c0-4898-a8ca-956c7b09852e", "comment": "Malware payload (SilentBuilder)", "value": "01a9389c6fcba71d3954c763cc0024c4d111dc40", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570838, "uuid": "ced8a852-3589-4702-b01b-f10ec63c73f0", "comment": "Malware payload (SilentBuilder)", "value": "fda8ae687acff248ccfed535672e0735e3bc4d7e69839c8ff86c93b7368f60d304eaa271057b563c56966a8453cc5cc2", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570838, "uuid": "6ce90676-05bb-4a25-8ead-ad984c27b450", "value": "T1C144E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570838, "uuid": "66df7eb9-13e7-411b-b882-cfb2ca0bbd7d", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7S:U9jFrjmkD7IvLDK3vLvfn1+2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634570838, "uuid": "a9541554-c2df-4c8b-b2c5-9c8f8d4fdf8e", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634570838, "uuid": "366ad452-ab52-4e3d-97b3-ab33def7e983", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570838, "uuid": "061b4436-8ed0-4fea-865c-5bd517926e82", "value": "33ef31d0fe0c6d655461a94ee28cef35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae447b43-305a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634592657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592657, "uuid": "08848366-6ebf-47d6-8e47-1ab1cc68c921", "comment": "Malware payload", "value": "323d21339db2a03eadae4469411133e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592657, "uuid": "4fe740fe-89a1-4d3b-a184-bcf4ea6aadf7", "comment": "Malware payload", "value": "85806d3e26019b05358fae664754f98b1a5c4a19ace2c555ede0cd99177fa516", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592657, "uuid": "09b8f426-39e8-4fb6-8a79-2365e0c6b54a", "comment": "Malware payload", "value": "d2d092e7e5642a50b17e22c05dd9cee6df9c4d35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592657, "uuid": "6590a6f8-2bd6-430f-8497-0b7d602e9b7a", "comment": "Malware payload", "value": "00aaf3a9ceca63a4f27c6ec7cace6873d33dd5caca132573e7687a557ce4022cf28b8be4e4cab5b6711bdfdc53921265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592657, "uuid": "7dde0a94-df7c-4437-a75a-605121cf2d6a", "value": "T11C33F15E09017BEDFB174EF66AD20FA403B38BAB4622D8064B55B5CB8931C146852EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592657, "uuid": "8efbb21b-cef1-4f16-82b4-ac78e0c8de0e", "value": "768:tKyT0lVRAZ1abdskygJoMcwhbkxmpH1JHfFeTzIxIUYJgGlzDpxYsL2v77U5HCR4:oY07+rabdAgJoMcnwVxdMIoVrYK2HxR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592657, "uuid": "54cfbe08-c9cd-44d4-a94b-1166dd5abeb8", "value": 50396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592657, "uuid": "098e14e2-5336-4a9e-b67b-0623d3badbc1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592657, "uuid": "ba3f29af-5dc8-46ae-96f1-7bab2800b08b", "value": "323d21339db2a03eadae4469411133e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155727c3-303e-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634580374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580374, "uuid": "a97440e9-3fb2-415a-b502-d952a397abf0", "comment": "Malware payload (Dridex)", "value": "f155110bf587807b6d48d7bb5e5fe9df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580374, "uuid": "ce6b5111-a7e2-4fba-a9eb-b69e9ab6162a", "comment": "Malware payload (Dridex)", "value": "8615c5641633bba4b8dfd015caa044a6c19b92f148cde66a5e9420ca2b7ba7bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580374, "uuid": "a62ddfa2-23ff-4148-a0a1-700b38cdc069", "comment": "Malware payload (Dridex)", "value": "dfa048b22148f4255f4da4ba0c75fbaaa2da09b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580374, "uuid": "6bcfee76-1f07-4b68-ae03-45d1a29d67f4", "comment": "Malware payload (Dridex)", "value": "337e95672b426bd25a44840428e48fbb66f695ebaeeabcaebfbe446d01e4f541b4d4f3612a4352bc7bee9921a4120f59", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580374, "uuid": "327a266a-caeb-4718-96c1-8fcb879283ba", "value": "T12904D128E76600C5EDDF0D7A130DF32ED4BA1D066341C5BDE90CEB52A224F29A97E365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580374, "uuid": "37a740cd-7b93-4e6a-8706-d39bd449b534", "value": "adb0dd6ace4ae202db9532637ae1959a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580374, "uuid": "bb46b18e-dc82-4ee7-b1e8-d22025313c46", "value": "3072:xgE9O68ciPs9BrcOgPqT7nWLTkpv0W270f0muemESf4:+E9/QMcvPaSLTkp/5uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580374, "uuid": "102bd22c-a27b-4c31-87cb-0e1dc97be8ed", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580374, "uuid": "eb7ab094-7250-437b-8f5d-9db40c6d548a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580374, "uuid": "5d786b9e-a237-42cf-ba55-0b396e0ece66", "value": "4_SyncInfrastructureps.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcfd6ef-2ff5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634549196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549196, "uuid": "919528ca-ef1f-449e-a593-9879c299a099", "comment": "Malware payload", "value": "d09641c3bab58edd18dba57ff818875a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549196, "uuid": "6dfaf58f-4907-4cc8-afac-7f947fa5c89f", "comment": "Malware payload", "value": "868489393f2c3139ec012b8773cbb7af309e177302e55599648a65365710712a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549196, "uuid": "2c46a0f6-0e8c-405b-b098-04c9e0c2fcc0", "comment": "Malware payload", "value": "bfa1e457afbb1f160094f65b456503b64832d249", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549196, "uuid": "d80e45ca-32a9-4a11-9f8a-033f4979671a", "comment": "Malware payload", "value": "e57edf1a3bc6a99432e15c3b2b6b514d08a714a543fec7f12e23cf21ed9f5b9ef04f5875128598ef13e558d127887d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549196, "uuid": "02a45dd6-318c-4f77-9ca8-1157950f9101", "value": "T17F354953AB5412E6D9B7C138A4738227FBB0B85403B0DBDBDA9466790F63FD5627A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549196, "uuid": "8c993646-70ec-481e-9a67-8da01369ec6e", "value": "bbd2f3a5795866d7ac25199e662a6dd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549196, "uuid": "c4a5f1cd-167e-47a2-87ab-215010ae7281", "value": "24576:v6A2tYHe1mDgrZemaveQc201Qos80rTnjw:vHmYHe1WKZkeWZw0rT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549196, "uuid": "50c32d7b-3f10-4926-9904-752512effc1c", "value": 1126912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549196, "uuid": "4d6fcfad-9343-4ce6-8634-60b283b7a03a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549196, "uuid": "ac9aef74-999a-478f-9816-b55287e800bb", "value": "868489393f2c3139ec012b8773cbb7af309e177302e55599648a65365710712a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f5ea3f-2fd6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634535813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535813, "uuid": "cff077df-4a69-4713-9efa-6192b0a880c4", "comment": "Malware payload (AgentTesla)", "value": "df149dd69ac46dbfafd8194e3d10a6ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535813, "uuid": "f3a91f53-ba38-4f5d-bee9-82bf3551150e", "comment": "Malware payload (AgentTesla)", "value": "8715b90fdea709f60563d5cfad92a81de645f3241e25804e6b58e891a11e6192", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535813, "uuid": "6cb00eef-506f-420d-8461-af0359de1371", "comment": "Malware payload (AgentTesla)", "value": "f15fae56c94c46576e7b656ea34d5eb42bd8fda4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535813, "uuid": "bebc12c8-76f8-41a9-8044-c3b15d0ba949", "comment": "Malware payload (AgentTesla)", "value": "a68196a15eb97f4efa3f009aaa375cb7f433743597a4026aca863e903644289f5e015368ad8e3964d686c4fea1c041bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535813, "uuid": "3d3e62b0-e08d-4c44-8e9a-d1de3ce122dd", "value": "T199A412523798CA6FDF6D05B670F3E3A0177096A13E45D78A8EDA34DE0AF2B410D50267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535813, "uuid": "65f3c395-7f2b-4b84-9461-c55a8fc8b10f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535813, "uuid": "d93be0b7-4d6e-4f4b-b4d2-d5a3254adff0", "value": "12288:x3C3Qkn33IdB33333333s331IMGz8W2ogp2FR+OPpA7vx/SpDKdVmoD:x3C3Qkn33IdB33333333s336MW2ogpc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634535813, "uuid": "0f832cc0-9cee-4cc6-94ef-f04b8b982510", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634535813, "uuid": "1e9be017-5f50-488b-bdda-abddfdfd461c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535813, "uuid": "77a1e5a6-c743-4477-820e-95d67686b05c", "value": "7HCYDW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d786e446-300f-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634560514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560514, "uuid": "e8864091-40c5-4fc4-b791-f619a7498ea7", "comment": "Malware payload (Smoke Loader)", "value": "d8c17d8c7ca799fe434174b292115685", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560514, "uuid": "3ecc87a4-3788-42cb-8a75-33c33110b033", "comment": "Malware payload (Smoke Loader)", "value": "874646ae5e48bcb2e0f85adf92ba4a8e7a91a3124f7c35ec9228dda6fa568678", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560514, "uuid": "8771a513-5bc0-46a9-85d7-63ced6dce1f9", "comment": "Malware payload (Smoke Loader)", "value": "933bf284ae175f9b8667014c58ced7c25dc4be9d", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560514, "uuid": "321fc671-6c74-4feb-b884-071cbd704b44", "comment": "Malware payload (Smoke Loader)", "value": "ee078cfb3b5a67bd4ca52056d54498a6b1121109fc79a5a03dfc967e19f369d143dd75835171035300570d61d457cb03", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560514, "uuid": "6b0b8900-ff9b-4e09-8674-45036aecd9f6", "value": "T1B3448D14A7A0C035F5F612F849BA93A8AB3F7AA16B2494CF52D512EE46F57D0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560514, "uuid": "411ae9dc-c453-4f87-9865-3ae952feb27c", "value": "b2b1ce057c4a3ad8c1ee685e46521866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560514, "uuid": "78fe715b-eaff-4387-8a5d-b2c61e16cfb5", "value": "6144:986dFAbFhxPhdGQqrB2eH9A3iaiA4reIna7:6hxjGQqrB2e+/iA48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560514, "uuid": "3c38312e-ca96-4957-9471-082ab495f243", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560514, "uuid": "de4c550e-dfbd-4afb-a170-2b0c19902ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560514, "uuid": "e61bf94b-deeb-4c78-83f1-d8a32c33dfaa", "value": "d8c17d8c7ca799fe434174b292115685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34aefe16-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568401, "uuid": "86786be9-6665-450f-bc81-f15baecb4561", "comment": "Malware payload (Mirai)", "value": "6be12f547964d788b5eb92652e4748ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568401, "uuid": "d4d7a541-1d99-403b-9215-63c1da18c39b", "comment": "Malware payload (Mirai)", "value": "875d70e1320a0b6c97ec00980457d3ff98babd7a90cbe06e58db215d39b07bcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568401, "uuid": "11cc0e5c-d72c-4fa8-b9f9-15a503c3518e", "comment": "Malware payload (Mirai)", "value": "9aa90ee19f79f7a03b77ea86003fbc447fa6e150", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568401, "uuid": "4277397a-d062-4250-b8b4-eedddacb1c46", "comment": "Malware payload (Mirai)", "value": "fa32e4d88470bc1e4f2ce84f051107319c4eb1af5660669b6f705a7e968af20eb99b5a6774da8a9fbc8b50c1166cd1ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568401, "uuid": "1f9fd7b9-99ca-4e49-aa7b-e9f7a256dd3b", "value": "T1A8932986BC419A11C6C21677FE2F118E331257ECE2ED73138D245B707B8B91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568401, "uuid": "18f7a708-70b2-4531-9f3a-e8a16e2cedbe", "value": "1536:XhnRcUWoXufJ4Au8YKzvb/J5zVMcOLaUl9aFmLbRMIiEg188Qxc/5SYG:EUW+lAuGfhMRu0awg188Qxc/E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568401, "uuid": "9eba0210-bdef-41e2-a506-1a5d388951a0", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568401, "uuid": "b0706288-d961-4bc7-a60e-c09801fda052", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568401, "uuid": "69f56f4d-827d-4f34-b407-155ae70fbe63", "value": "6be12f547964d788b5eb92652e4748ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4815ce4-3063-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634596506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596506, "uuid": "25f9435e-41cc-4031-96d1-d91f50ff39ce", "comment": "Malware payload (Mirai)", "value": "337390fc9d845cb3b8c42af188de5139", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596506, "uuid": "bff836fd-ffe8-491a-b8d8-8bfa3969a0ae", "comment": "Malware payload (Mirai)", "value": "87ab21a11bac65be212b451453bb1360bef33b28148ca4689fc71758580cb104", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596506, "uuid": "e444482b-3304-4cf5-a0c8-b8be8d53cb55", "comment": "Malware payload (Mirai)", "value": "6fe94b76f992fef7e378a461c27bfa9e638e140a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596506, "uuid": "08dab5ba-c019-4267-b4b3-cfaba8fb52df", "comment": "Malware payload (Mirai)", "value": "1ca26e6074b86348a536c338e8b16392ea3a9df39d1b3747b2df37a2539f7f9a4284d74ccb09bdf49a0f0f7af5b4590b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596506, "uuid": "ca4e2009-a039-4810-941c-93136c131151", "value": "T144F3736B6E509F2CF75857340AFBAD24834A23E726E5DA4AD18FD6001E3131E5C0FAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596506, "uuid": "34db971b-a138-4666-9314-6eefe5c410a1", "value": "3072:jCQ1WnOiiwibiYiwH0fGZjBjIYgrUugV0GeKgMVFb1l2GLpwWdlTie:mcH7jBjIYgrU1d/Fb1l2GLpwW7ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634596506, "uuid": "90afd59c-a731-4842-bb24-04b4841a5a2d", "value": 161592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634596506, "uuid": "8ad5b9e9-0234-4e69-8950-f34583448248", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596506, "uuid": "bd4c5535-1c32-4830-9d6a-1122396624ae", "value": "337390fc9d845cb3b8c42af188de5139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e6a911-2fee-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634546386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546386, "uuid": "6df4110c-a0b8-4905-be86-7df82f0e136e", "comment": "Malware payload", "value": "87b2f6337fbea5ee3f10eb1b210dd795", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546386, "uuid": "733ad0c3-817f-4b05-93b3-e00eacdce68c", "comment": "Malware payload", "value": "8811a7bfc8b36649308ae32e37c3cfcd0e1bf700f34988bb9c7028a7d367d894", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546386, "uuid": "af9c896a-e5ae-432c-bb29-302726fbe05d", "comment": "Malware payload", "value": "200a86d5e4527e072ffe7a2059b762253289ae69", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546386, "uuid": "324c1f34-31d3-47ae-bbe7-35c64ed632e4", "comment": "Malware payload", "value": "c554b7940a4a1a704a169468ec1470454dc8cc8c4d71603d9e0710a12ee5ec31853eea9f8ef2846538af5bab6715595f", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546386, "uuid": "2847490d-8aff-465b-952a-80f78a506eef", "value": "T1EF53D714B7A5C563E195AF324EE2E6CA7730BC21EE11C7073188735F2E37A909D16749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546386, "uuid": "be685bde-235f-4841-95d1-159cd620f5fd", "value": "192:EKX63qOaEfhODL4k5yx2eyViSgXruCv8pT+GLFaMMQZxN4Z7LlVQw/Sf:K6gf8DL4SwpXrLv85+GRhMQvN4xJ/Sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546386, "uuid": "b8b9d876-30ba-44d0-94e3-6c50da5445d4", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546386, "uuid": "6bab01b0-c900-4965-a509-3c038ba76a2f", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546386, "uuid": "c46c0132-b5c3-4160-b7d5-8da6e6bb20ca", "value": "Purchase orders with bank details.ppa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b886adf-3057-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634591122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591122, "uuid": "905e250b-b9e0-4d28-b449-c641a0091da6", "comment": "Malware payload", "value": "a892236d3147787a8093010c68968431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591122, "uuid": "72378be5-0160-4c31-855b-ca600a331d7c", "comment": "Malware payload", "value": "881c029fe27b35357331ea4df7079ea1b24fd1044c81329395200485ba172644", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591122, "uuid": "48d7bea6-5102-434c-a56a-fa3b5639dae1", "comment": "Malware payload", "value": "241b8f88544b614a30e463ba94d0bd95fa116f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591122, "uuid": "c0e3ed20-c397-411c-bf84-74d916d0790a", "comment": "Malware payload", "value": "c6841c887523d0d8a3c3872c1637fda0ec8743685dac2692d8094e384b6c92cc4a5170d2dc36a2f8e093afe93bcf27b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591122, "uuid": "4f2bbe34-1249-41ea-a3ce-48c2f17d80c5", "value": "T17905F885E9B3608EF397B2780B0955810A421C77DB1396FE5FBDB95A31F26D18A93303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591122, "uuid": "b96138b2-55ed-402d-bfe2-33d2d5448aa8", "value": "4aa82b91dfdd0eea976043de209425e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591122, "uuid": "0e9f5a92-e08c-41de-b83d-156530404654", "value": "12288:U5C5ndEs+qFgvaxHlS7JrVVzoxolt4RWAxoIgXXjR6XKmpPHe7IIGD38K3Rqwoce:d5nx+sgu2YxolQxEDUagPHe87R3WT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634591122, "uuid": "61d265c8-8887-4a47-9222-944f22658e54", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634591122, "uuid": "626111ae-8498-4e3d-9448-7fb4ce3f6ac9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591122, "uuid": "32a8c26b-e1ae-4632-bbdf-dd6b25be14ce", "value": "ValorantHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d105f16a-2fd3-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634534733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534733, "uuid": "14839da1-b389-4e30-b3c2-2c27df273fd5", "comment": "Malware payload (TrickBot)", "value": "e3662af08d134e933c56c9c84fb62686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534733, "uuid": "0a1a6455-a9d4-4479-9c9b-cf8a9b566d32", "comment": "Malware payload (TrickBot)", "value": "8862d2bf6ac21cae36860cee8dcc0ca5c2de17349b03ff6e309edb967b3cefb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534733, "uuid": "e258b6c0-8f76-486a-9f7c-d2bb3929c8b1", "comment": "Malware payload (TrickBot)", "value": "521f2fbccf9b3aaecdd2be54327c6d6fe391932f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534733, "uuid": "0db73e9a-8702-4387-923f-a69cbf75852f", "comment": "Malware payload (TrickBot)", "value": "5a6abd732145296e952e4c131da40d400709d5d986dd2effbe74536e36fbd3785efed82c404c3aeb14ea860a91dac66d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534733, "uuid": "3153ce94-42f8-462d-93a2-71182e814ccf", "value": "T17E15C01A3AF1C076C5A291700FF67B6AB6F9ED605B378AC753804E4D6D31DC1463A23A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534733, "uuid": "ac704f36-8436-49fb-a85d-83eb59602c15", "value": "d3d730d77f19513c17bee56cad3fbfd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534733, "uuid": "20320f18-96a8-49b2-a70f-4dfc441155e0", "value": "12288:DEMkCMMFkUED6ANs4ZD9V63Az2hPmy+khUzJUZ/:m+ED6+xZzkmiiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534733, "uuid": "b8cce345-0b57-4676-b681-31088e924e8d", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534733, "uuid": "417625ac-bf0e-46d3-96d1-1b250fdd4b9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534733, "uuid": "f3b240e6-2982-4360-b057-597116035049", "value": "e3662af08d134e933c56c9c84fb62686.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c22d248-301a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634565004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565004, "uuid": "73c9e6ce-3544-4167-82f3-5849ce088e55", "comment": "Malware payload (Mirai)", "value": "d55e08ab0c05e6a5440b9e9d76cdf63e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565004, "uuid": "efadb2f1-7d2d-4064-9e91-e7e7a91d778f", "comment": "Malware payload (Mirai)", "value": "892c6998ec5cf7f2f6974557bcb67652972b15ad4c4278d3253bc0f918927bed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565004, "uuid": "740eb532-8613-48a8-bbc3-767bc2d700f0", "comment": "Malware payload (Mirai)", "value": "f6feeb0ebea441d3ba5e5e006e07a27b2e03159e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565004, "uuid": "584478f1-4975-47e3-8489-60fab0838d87", "comment": "Malware payload (Mirai)", "value": "9bbb20dc2a49cfb888aca5c055e2b0c51c7a5541c1a491c13f4e929234a8382c8ac8a3145101ce1c79f75d79777bb1d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565004, "uuid": "5ebff2e2-ced5-45d9-917f-2fded696221a", "value": "T171D34D46EB818F03C4D5277ABAAF41453323E75493DB73069928AFB43F86B9E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565004, "uuid": "19b0a0d4-1eea-48ed-8c34-088b420c8c03", "value": "3072:kyUqcUV06w1DdVH4Fj/2mSvLxOYHnMN4FxvFvmOvH/FlM/96AGZA:dUqcUfw1Dv4FSmSvLxOiMNIFvxvH/vMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565004, "uuid": "fc97f5e2-fc2b-4613-9051-683f20bbb402", "value": 135869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565004, "uuid": "66e222dc-21c8-479f-862f-45a30626b556", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565004, "uuid": "50edb4d8-12d5-4d3c-8236-f507d75eaa07", "value": "arm7.light", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4bc611-300b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634558612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558612, "uuid": "447affeb-4a0f-45f8-bc52-deb287d1f698", "comment": "Malware payload (SnakeKeylogger)", "value": "998da072875302919b2819e018eacf6f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558612, "uuid": "9dbe2fdd-ceb4-4015-9f70-0572cfbcac18", "comment": "Malware payload (SnakeKeylogger)", "value": "8aa3e1396cd5802e840d87a5a0b370e28102cbe41669124981aa3d38738099a7", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558612, "uuid": "626191c4-a3e8-4460-b885-80dfd463ea9d", "comment": "Malware payload (SnakeKeylogger)", "value": "4bcb248983c0a37842cfae2bb13dcd1e6bc98c87", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558612, "uuid": "2f5df909-2cff-4bae-bfcb-8e22070b83a4", "comment": "Malware payload (SnakeKeylogger)", "value": "7a8a69d404b7af65f15f8920d6cc9006b27cc3549e39d750d6e61326fa79a7df0f38d9d9568eec1425d628220b0669ec", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558612, "uuid": "9fda0caa-20eb-4dce-b889-cc862d806762", "value": "T1048423749B6C58E646CD35BBC488129DF221F5239786FB8A09EC9879D40324C4BFE78D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558612, "uuid": "aeb1c2fb-b5fa-488e-aa1e-fe79ecffcc50", "value": "6144:nQ+RqiI9rPYvKW88hNdgZKoJzHN0/5DC5GHvvxU99oCnlAyPPyuUTuc9r33Yaa:n/I9rgy583oJzeOcHvG99oep3B6uc9TY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558612, "uuid": "ebd27afa-44f2-45f3-800b-46ea75df8e50", "value": 372637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558612, "uuid": "1ba2fb38-ccb1-49a7-a510-1a1729f18299", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558612, "uuid": "e3fc8b44-f3da-4059-bb7a-67fff8b7e563", "value": "70016103621110.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7744cf7-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634542045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542045, "uuid": "51dbc13b-6995-4ebc-9558-42eec12b2c32", "comment": "Malware payload (Loki)", "value": "5081bdbc31569879c1794764dc087844", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542045, "uuid": "ae0260cc-d2ef-4718-b76b-d3a947d5d989", "comment": "Malware payload (Loki)", "value": "8af1a7bb2d7b22b53733fc535c4f7f23505f93bbc088e7d671a444ee9f72be29", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542045, "uuid": "05ad89e0-42c1-44dc-a850-bdab40843633", "comment": "Malware payload (Loki)", "value": "bb95d6a91754881ca49b553f1fdbc3da29671b57", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542045, "uuid": "d88da9d9-df0d-4639-91e4-c34b346320d9", "comment": "Malware payload (Loki)", "value": "fc72e1702db0fb3dec5a8dad78caf5ee97727aa86591f1bbcbc9cdfccae418eb921a7a20ac2a33463e606bc3bede0232", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542045, "uuid": "15fb0f82-398f-45a9-909b-b49e368a5836", "value": "T18B74D0BB513C4947E6B7EB72661667404BE8CD25B9894A07538C31F2A4F3B33C9A0379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542045, "uuid": "ccf4cfab-d483-48e0-93ca-9bbfe8155f7b", "value": "6144:osH3cvmtfMPRs5w1k3j6o5YEKH8keoDeGppguaxaHWhmuxaW9X1I:osH3cvYfMPRs5uYj6ouE/doDeTuZmmoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542045, "uuid": "1c4fb56f-5e01-4413-908b-b148d2041f23", "value": 340920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542045, "uuid": "e89a7b10-0b33-4cbc-8468-3b8341348934", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542045, "uuid": "0a8ffbfc-dbf8-47b2-a023-a1a44f1fc7db", "value": "INV-42092859-4.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d172fd-3024-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634569292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569292, "uuid": "a80967a4-cf17-4f5a-9d6f-6d004a21d559", "comment": "Malware payload (GuLoader)", "value": "2f28386519c5b64bf942f7818b795cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569292, "uuid": "30b81edf-fe9b-48c7-99ab-f5b88a608c19", "comment": "Malware payload (GuLoader)", "value": "8b0c40bf66d99936dc9ad7903ffecfea0a1f7d59a1123cdac13ff4cd1434ecf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569292, "uuid": "2d03b2bc-c500-4f26-855f-aeccf7811290", "comment": "Malware payload (GuLoader)", "value": "7ea385effaed704daba0c7dc29a3d7f8049d862f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569292, "uuid": "d38af813-7490-4849-ab15-5eb8634246b3", "comment": "Malware payload (GuLoader)", "value": "73dffc91404c2bec0ac911c0a4804bab209a344f67b15e601b3c44dc53f7c0634df33fde372937a54be2b0ae32bab34e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569292, "uuid": "aa6b73b5-c7fc-498c-b04d-21ab5fd94614", "value": "T159937BD1268C6C71E84488FD573F056B232E6C33A6D5AB0321992B2BE837786D97075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569292, "uuid": "0189e3ef-9bfc-4de6-9a4a-1b3462bfe218", "value": "6cda8b61dc739fa685b0a1af3300013c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569292, "uuid": "cd8919b3-d401-4635-9338-a0256ff22827", "value": "1536:t7DUK9/GrR2uRLXIx8QNrn1qB8Lbq3wZlD:t7AKBGVR4rx1Nbq3wZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569292, "uuid": "e77162d5-526e-46ba-9b54-5e7eedb4ff28", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569292, "uuid": "432793a2-c35c-4bdd-902a-31127000cbeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569292, "uuid": "ac712460-6f23-4f9b-b8fb-ff30a7b3d8f4", "value": "Albar\u00e1n de entrega 6414934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f53223-2fc5-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528668, "uuid": "30fd90be-4ee6-4c0f-936f-0e28a25fadc3", "comment": "Malware payload (Gafgyt)", "value": "701f14604d5f9c6f58b8192fe4c2358b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528668, "uuid": "314c3584-194f-4065-ab06-e9e153c6fe4c", "comment": "Malware payload (Gafgyt)", "value": "8c6d1acfdabb5baa02ac660ece6b63765ab0b874e9e2ef1aab379b2cbfb0fec3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528668, "uuid": "4f82181d-f037-436f-9a02-179a6631e3cc", "comment": "Malware payload (Gafgyt)", "value": "41652b8d38509042d05853058bbb9781d0cbf304", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528668, "uuid": "b935dd1c-9353-4b72-b44a-eda4893e4782", "comment": "Malware payload (Gafgyt)", "value": "0d9f77a912641a9008cfa1ad89b0404a0c7a62a928aeec45f17ce7d9937d322a176e8a1159a2675d086cdedee94b3746", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528668, "uuid": "3cf0f986-900b-4286-9a2c-bd9ba31f9093", "value": "T174B33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528668, "uuid": "0d91635c-f818-408f-9563-6642b6c391d6", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCoB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2MjP0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528668, "uuid": "ef2bde76-6022-4f8d-afc8-28fadf17f3a4", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528668, "uuid": "87eaaf3a-bf3e-46e2-bc49-4fbc31f21fdd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528668, "uuid": "c3a9f1a2-4061-4cc9-bf74-88956ae863de", "value": "701f14604d5f9c6f58b8192fe4c2358b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c979dccb-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634561349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561349, "uuid": "30ae75c6-22a2-4da7-8cc7-eed2eb7c4725", "comment": "Malware payload (Formbook)", "value": "b3580fc99e1418bfff88a27476bff8d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561349, "uuid": "f25d55d0-a3cf-4e61-b962-ff49f44a5db9", "comment": "Malware payload (Formbook)", "value": "8c813fa41f5f1341dac70ff4c3473d6447c0bd0eb6c87cf77ab62a864dcd2674", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561349, "uuid": "a34a13cf-90f1-4381-865e-b2877f3cb0c8", "comment": "Malware payload (Formbook)", "value": "18545c7e2f533945c6c5113686a1e8f049500020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561349, "uuid": "0881de6b-d94d-4489-ac95-f195779c5c51", "comment": "Malware payload (Formbook)", "value": "9f82cf7fd93dd44de8fb30a626c9cf24283da10f59cae61cb509d21024262240c47d13f2fc6c0ecd81a45be6fcbfe3e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561349, "uuid": "cfe7702f-7979-4abe-bd45-c46efae054b1", "value": "T105940214B789822FCF1805B470D2E3996774EC233A83D79B4D8631FE9AB7BC55E80166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561349, "uuid": "b6640ab3-3dca-4549-b7a6-9b9b5bfe02db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561349, "uuid": "801a5008-a5e5-46d3-bb8e-acf668c823fa", "value": "6144:p3M+/sYvqQ0WFmrkFib5uMuNXqvmwGc7kcFVpNB+aUkpETmQB+OGWRt9TS/Ks3JU:p3ZRCfXrgi1qVSGc7fNB1pKB+cOKs5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561349, "uuid": "23d8dc18-631d-45da-ad51-4482bd05c1f1", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561349, "uuid": "71f8919a-649e-4f32-a8e6-ba62c580ac93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561349, "uuid": "eee02964-1445-41ea-b10a-35b1fd1b0847", "value": "GDs-#09283 DIAGRAM AND PRODUCT SPECIFICATIONS.pdl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0600fd-2ff7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634549864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549864, "uuid": "82b33195-53e2-4c66-885e-b28e838cab2a", "comment": "Malware payload (AgentTesla)", "value": "90f4d9e81cacc66a96e5396ed8babea1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549864, "uuid": "6a2bad6a-9cd6-4d74-b92f-7886a5b68576", "comment": "Malware payload (AgentTesla)", "value": "8d02222e6f9b9aaeab088794ab03d1e75c8eb3637437d431cc681629f59c3ab4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549864, "uuid": "3a825010-c2c2-4fe8-8d29-103440fadb98", "comment": "Malware payload (AgentTesla)", "value": "d13b83737e0e0eb24ef2674140a3815e5026ae1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549864, "uuid": "7f293dd1-d48d-47a9-8926-be74d39f4b07", "comment": "Malware payload (AgentTesla)", "value": "a661ae91ef3cef35867f97a1c8f82a15e17186c770f4e9d5c89f735af48e686fac19cad0c6cb10ac9dfa04cecd2917c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549864, "uuid": "4f0d98e1-4078-4ce5-973b-a82806f85eed", "value": "T1E2745CD3630C9521CB5F50BE873F4143237D9E339716D26E1A918BEAAF802CEF825995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549864, "uuid": "32c39dc3-780f-4ac6-90de-3c6664141b8c", "value": "6cda8b61dc739fa685b0a1af3300013c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549864, "uuid": "e16ee958-f021-414d-922e-1c71830fe62b", "value": "6144:tLDhZvDEF/q3NUGKn+xZfMlvZ0mVxPjlm43R/1k9:tLjvgF/u1K6UlvtVxR/R/1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549864, "uuid": "5cc15537-82e4-49ec-95e5-e3fa0675b140", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549864, "uuid": "4dfb28d0-c2e4-4b3b-b31e-af6b149deef0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549864, "uuid": "8408cfce-0df8-48fb-8cde-67e2fd09b2cd", "value": "N\u00ba 210000483.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a95e7a-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634561067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561067, "uuid": "d5bdf836-099d-4835-9a9a-7b39ed430ca3", "comment": "Malware payload (Formbook)", "value": "f0d9fd1759390103fd73294e3d64bcca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561067, "uuid": "057c6c50-8bbe-4756-8a62-fc9506dc4f7e", "comment": "Malware payload (Formbook)", "value": "8d0324a03b747f8fc1c0f4050b9464a676e5d566f5bcbcecaa8c574faeea6b72", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561067, "uuid": "5f1b8fd7-48cf-464c-9617-240ac66803ff", "comment": "Malware payload (Formbook)", "value": "b7f363f265a15e3b6fe97f12922f0c04a7371d9d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561067, "uuid": "6b3a4c84-6c10-4acf-a172-368b3059e125", "comment": "Malware payload (Formbook)", "value": "bcd54bcfe5f9d13e8fe0163ec488d3f5e4acb5df0a3c3dd829810f57679f3212b39e441c16410298dfd64f2b2a9b25a9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561067, "uuid": "b4fd96a0-a945-4c33-9188-780c8aa33dd2", "value": "T1A274D12E526262C7F3635871AA473DFCE017CD0BBD10317B1A323E5FE476588A85A17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561067, "uuid": "f3ca7802-c7c1-4b31-b931-75929d4ee6c9", "value": "6144:/Zqkw18JkLtGr+bOwnfIcNtXgjPxvCtgd85y2j04lUqMYnnUR/Q:Bqj8uGrgtXMIGC5Xo4lUnYnUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561067, "uuid": "8346598b-476e-463f-aae8-69775fde254a", "value": 340712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561067, "uuid": "b251dc21-5fbc-420b-a40e-a558afedf0b5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561067, "uuid": "d69f59b7-1d6b-40a5-98a9-91464308ec6a", "value": "INVOICE707.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b52a06f-3007-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634556815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556815, "uuid": "6ec64f86-5e1b-4f33-bd97-60c12007be0f", "comment": "Malware payload", "value": "bfbbb8571fc1d4dbd8053e5154cda305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556815, "uuid": "4db474e8-4b77-48a5-878d-3d3dca0879df", "comment": "Malware payload", "value": "8d3acf2f0ec215aa77026016f145230bf44a3a6c411349f1e49f86561380bb60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556815, "uuid": "4d5e2283-af53-48f0-bd80-d37e56289610", "comment": "Malware payload", "value": "1864c0d96ad1ea1c10db82b1613d68e9016e771c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556815, "uuid": "7c3c9f00-2f1a-4ecf-9cba-1523ff606b56", "comment": "Malware payload", "value": "726ed9c45c71d991c6b1540bdd20dfc950daa3f71e1598d285955d7ad5bbdc9d5d650363180a8545c0ef49f042c05d89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556815, "uuid": "3052e119-7dcf-4fb3-b770-a330cfcc1729", "value": "T17416123352263D06F8E6CC3185377FE671F1126F5AF2A878A6CE69C325250A1E20F957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556815, "uuid": "dd1dd2f9-56b9-43c6-8d88-ea2ae886fee7", "value": "2c58ba983cbcad8b3c06c5b4f999bb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556815, "uuid": "a587fb02-ab2c-4ddc-b4ef-eb1d62d8ec74", "value": "98304:mEzyXcTqaJ9IyyPc2iBZ83hHla+FOuWyVO5mo8/xCV:NzlTq742iBIHllFOhyxXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556815, "uuid": "8063c81b-e2b2-4e9d-a065-55586ec04ce1", "value": 4336128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556815, "uuid": "ec3bf1a3-91ee-42a5-ab9a-bb0abb7a38d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556815, "uuid": "01d88c1c-fb5a-4758-9068-006137df72a1", "value": "bfbbb8571fc1d4dbd8053e5154cda305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb26231-304b-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1634586190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586190, "uuid": "20a0d8b2-2d57-4160-808f-37a1a1e0bd77", "comment": "Malware payload (Vjw0rm)", "value": "16fd0d1a92c42595ec8f23280b4fad7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586190, "uuid": "94c4391e-50aa-4813-92ce-6f09740f66e6", "comment": "Malware payload (Vjw0rm)", "value": "8e019a20811f084e9fc63ef36a746b051e9b27292292110917f66f5f98e5cc20", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586190, "uuid": "27db670f-ac55-458d-8238-f6fd1044f6a6", "comment": "Malware payload (Vjw0rm)", "value": "1bd1e26a23a877c7f7c3e7afe6ffc877562ca83d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586190, "uuid": "428e8653-3f5f-4cd7-b232-4f378d756461", "comment": "Malware payload (Vjw0rm)", "value": "528c177c98e18e90af5f4cdedb5baf77c51fc8979dcfdc337cb7c30a66490fbfa5c13e77ac5c87ea6c2e7b2dc427fbd9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586190, "uuid": "c3626cd5-431e-4854-887a-6f54761cf6cc", "value": "T1CF8381459E401C4BB9B4D693109D0428DD15A6F4CF2E686AD1C1C9FC3EEF24BA78FEA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586190, "uuid": "1314e39b-bcaf-43c0-b294-c8dd4476ca46", "value": "384:t6/Hai4Vw4DrBwpJWfuwO7Cr5JfAf2fGfgffqfdkkzP8fACvWKw0wf:tdjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586190, "uuid": "ec7a80a6-b973-42d6-b26e-2b176ba7f4f5", "value": 83988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586190, "uuid": "83f7906b-4d49-40ae-a346-e84669a8660c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586190, "uuid": "09b71cc0-e07a-47fa-8c92-115cdca93ea9", "value": "H7C5A4CM38A.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2e4f6e-2fd7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634536204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536204, "uuid": "b5cb931b-50bd-4581-8292-b7609495bd2b", "comment": "Malware payload (Mirai)", "value": "5b47968bf0982460d6d2613745b95863", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536204, "uuid": "58113702-0fcc-4978-a59a-d0f8f9af1223", "comment": "Malware payload (Mirai)", "value": "8e8908eda4382980acbe22aea8a9ae57fd74c2229eb3787286e1655c257a7b28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536204, "uuid": "8306627b-a09f-4be0-b7bb-11a97fe0b048", "comment": "Malware payload (Mirai)", "value": "51109bff7510bfc7056ebaa0b53a4310bb67a900", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536204, "uuid": "aa50977b-a36f-4625-a2f2-d1906645e2af", "comment": "Malware payload (Mirai)", "value": "938c6cc6fe4062eae7fc390613a61649cc6133483672c5da1440448476b6ba7da8a01b4014b4eb53f85c46c651175f1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536204, "uuid": "baf2a51c-1d89-4947-b9d7-a94a5d123498", "value": "T1A963027006ED91267814EA758F3AC28CBE8C67F9A5E9324F05534D6C4E89D1646ECCC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536204, "uuid": "4e444f31-f425-416a-9799-9939b17f64b2", "value": "1536:0djEVr8f0T7ETrwhg9sk4gDOSx1BLtsCEhi0clhBGKlt:YEaO7MrJ+cVBL+CDnlrGKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634536204, "uuid": "92215644-cb19-46f3-bef3-08f963140b68", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634536204, "uuid": "ac36357e-4895-4b49-97cd-78d0796f1eea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536204, "uuid": "24ba9db1-3326-42b1-9ba4-06281219eded", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7857485e-3007-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634556918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556918, "uuid": "9ce2876e-7463-4188-84c8-0a9dfe369a6c", "comment": "Malware payload (Loki)", "value": "5507731070ebf3b3bb9e93ffccf03624", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556918, "uuid": "3054eafb-2712-4018-b9b7-61bd251ea518", "comment": "Malware payload (Loki)", "value": "8ee299b5cb422c1b4ef7abe32d84a659741fa344423638008bfd57b8a4e1a2c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556918, "uuid": "cc56b150-f4ae-4bf9-ac46-22b4ffa795f1", "comment": "Malware payload (Loki)", "value": "a255566fb9d102a1351eb36fc86b9f2f1203dd45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556918, "uuid": "3ce4e634-aa2e-43b3-9335-6f9eb64f567c", "comment": "Malware payload (Loki)", "value": "34c5b338e88cfee47c6eea531ea943d2aec1563aa0d65d2428739b56f4fa79606b6a77823a41d98675e28605ee95c4fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556918, "uuid": "9c3833ea-ae0d-41a0-bb2d-426ec863b812", "value": "T12FA40106B69FDE2AC57E13FC84655AFB83B4792055CADB0A7DC039BFA9523410FCA106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556918, "uuid": "aed6677e-ec8d-4148-8ac5-18de3d427b6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556918, "uuid": "87dcc681-d0d4-4a70-9f28-a241d436ce2b", "value": "6144:nnrSSRjQRllkQQ+PbnZEpMs3lC7H03EgidVOu4CPd6TtWrCBmCLi8uq8oWJ4EvXg:tMLrFk193bu4CFuEmBmCPNyJl7SB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556918, "uuid": "57ac9f49-a53b-4382-8ddb-d014d3d36ac0", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556918, "uuid": "53b888ca-1036-461d-8a3e-a83e2035a349", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556918, "uuid": "52f4055b-9a39-4bf0-82a8-12b34ac33042", "value": "5507731070ebf3b3bb9e93ffccf03624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001c14ef-3023-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568742, "uuid": "994fc1b2-7170-400f-a259-b447d695d20c", "comment": "Malware payload (Mirai)", "value": "25339c176867e75647e0e9e4c35a0c7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568742, "uuid": "801f306c-519d-48fa-bad2-be7f91e63f5b", "comment": "Malware payload (Mirai)", "value": "8ffae5a0c531bea76e98c68212ea16a52123a1fdd169ce6f21de835ed75541ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568742, "uuid": "dbdec720-52d6-4a4a-af3b-4cb03033c389", "comment": "Malware payload (Mirai)", "value": "353a874bfd3c63d5fba9f858f9b39c1a6e0d0ba2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568742, "uuid": "65ff4586-698d-4e88-8fc6-98fb04524699", "comment": "Malware payload (Mirai)", "value": "1a09eca365e60807ad8d0e5095067c478f1da01a86e89214845769dbfbf5e653b6a50b6483314f1fae48fdb7f892748c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568742, "uuid": "68dd4046-3367-4081-ba36-53333e2a8e33", "value": "T1DD631AC4A953D9F5EC12067031B7EB329A36F1BE211AFA47E39C56729F82B12D40764C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568742, "uuid": "4c4a78ee-7558-4cff-87ef-580ff5f4e093", "value": "1536:+Ccr1oiGTX31PmItIKErNlt9tmYt4sjXXoLeBtqg7dLR01BHFb:OJoiGr31PmIuVrNlt9tmYtHoSCUal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568742, "uuid": "5661253e-b1b9-47b8-b559-9ef2b3558fbd", "value": 71920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568742, "uuid": "a0e546d3-4735-4d41-9522-586e75402f20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568742, "uuid": "e956017c-71fb-41dd-b9c3-3c469a226168", "value": "25339c176867e75647e0e9e4c35a0c7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca997df-2fe6-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634542564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542564, "uuid": "41adb9c2-25f4-48f6-96d3-3243df18c1fe", "comment": "Malware payload (Loki)", "value": "f769e91b05ea8c5cd73c26b2c047fb50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542564, "uuid": "99179252-76c6-4f7e-8436-234bcd524630", "comment": "Malware payload (Loki)", "value": "9149dc6a1571916bf7077d6bed5b4758613b5a4cba36349dfd3433e1bbafae5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542564, "uuid": "b68b5a44-7295-4d97-a572-0b822bf48100", "comment": "Malware payload (Loki)", "value": "3585995af6b82149cbc2b190207b441f528d505c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542564, "uuid": "b97091be-20ce-490d-af3c-8061061fa4dd", "comment": "Malware payload (Loki)", "value": "457ba6b4ee5f98ccedefa3b83b02dec64d62219830802262d97cd988925c0317f06cdb33b8a636abe3e715039277bd16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542564, "uuid": "2e37a100-43cd-4662-ac5d-8d0bffc27825", "value": "T1386402053788C257DB5C0BB864F3E3A417B0AA213E05D75B5F8A34CB5E77B416E216A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542564, "uuid": "fb07dc13-8384-4856-a9cb-5520e480846b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542564, "uuid": "c0dac7bf-82b3-417c-8aa2-c41ba2ba2595", "value": "6144:cYdctSOvIaXXPsZxbNSSofCluJUskeDMgazqvk:pitS8XXMffzu0eDGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542564, "uuid": "9daabbcc-9bf0-42a6-bdc7-b2562a21f078", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542564, "uuid": "e413bc4e-ee6a-47c8-802b-d449394ec6fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542564, "uuid": "dad003d1-da7a-4cea-a662-cd346c8d74d9", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6fe2e4-2fea-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634544359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544359, "uuid": "412dc708-8a05-42ac-908d-19c8b3f3b813", "comment": "Malware payload (Mirai)", "value": "36badbdecf0135976ff93f8f4b8bbbef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544359, "uuid": "a7bcd1bf-c776-43d3-90a7-575d746580b5", "comment": "Malware payload (Mirai)", "value": "916258c0dec867d39d671bbb47bdff2ad46385cef7cc85c8f7d11284369595e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544359, "uuid": "4507905b-5e15-4dd1-b7c7-ad7eb08a2617", "comment": "Malware payload (Mirai)", "value": "6af5bb0a21afb7417ce1145445013cd6283144df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544359, "uuid": "d6f31f7b-628b-45b3-a063-9ec94b1d5e78", "comment": "Malware payload (Mirai)", "value": "e42cebbe469e42e71c2eac8e17d996ba4771b4b3d785d869e1ef6f5c4f5f65cd894862e2426aa7a2b4ed3408e59bd63e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544359, "uuid": "aabffedd-1afa-4293-9f5c-bde8489d0f65", "value": "T1A6C2D0D4C5885D42EEF5E8703CA5B6C233B6CA8F93F9CD8162806621F91A427F5093DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544359, "uuid": "34388473-afeb-4834-9a0c-3d3b7dce0c4e", "value": "768:Zj6vmRcmRqyLav4tvdLjs4Q44uVcqgw095:Zjfcc1L6O4u+qgw095", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634544359, "uuid": "1f687396-7ff2-41d0-9e8c-7dc2e13511b9", "value": 26296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634544359, "uuid": "f2a0d1cc-fc8f-4008-a0ef-936f4b5a84e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544359, "uuid": "a303eb61-0139-4d13-9a71-b8681baf050b", "value": "36badbdecf0135976ff93f8f4b8bbbef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937e003c-300e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634559970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559970, "uuid": "3ff5fc81-1d83-4a0a-bb58-26953eb103f8", "comment": "Malware payload (AgentTesla)", "value": "52cd71bde1c747ac5eef94c0a71ffe70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559970, "uuid": "d5ee7c6c-a263-4e15-b42a-db5aaf2f9ff6", "comment": "Malware payload (AgentTesla)", "value": "916b446b19717fe163480a61d7de015fa27b4a06e352bb0b15b38ff87ce62665", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559970, "uuid": "4d44b496-09cd-4abe-8076-7651860b1fc1", "comment": "Malware payload (AgentTesla)", "value": "6d10a726bf14496b320851421a60cd4da5837adc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559970, "uuid": "7478895c-0bf3-40f9-bdb8-fa2c7574d716", "comment": "Malware payload (AgentTesla)", "value": "16c6ca55ff9161b31027db9f696fe461a77f0bd8b036d9a0407c6ea15f7fbe018552dfcc8b803453cd7dc30f202aa619", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559970, "uuid": "c790e99c-6079-4f70-b2b8-1fd45b439be0", "value": "T1C8E45B67F502A18DC43286FDC6663E5267102C66D6BAC61F502331984B3DFD2AE7F263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559970, "uuid": "4e2f175f-7546-42a7-a6a0-a8e2bec3c951", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559970, "uuid": "711f9dca-d2f1-4812-a3ec-1c869a54fca4", "value": "12288:/TtP4YJ9KCkS9Xfl8Vvm2sA9gPhbSxSz05DIkQocYnKrUEm6fdJ4qm4SO:/RQeK5S9PA9eh+htTQochK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634559970, "uuid": "056e8ab8-5a9d-4da2-91bb-021860e66428", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634559970, "uuid": "7d50b5ed-7339-4954-88b8-6cc257557129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559970, "uuid": "e8455e7d-81b4-488e-a6b3-c347c82e7297", "value": "52cd71bde1c747ac5eef94c0a71ffe70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7cc985-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568392, "uuid": "8b996786-c732-44f6-8468-85b8b22d6745", "comment": "Malware payload (Mirai)", "value": "7b4c0e83e46cc0acc78616ce283b54eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568392, "uuid": "c8d53feb-fc60-4be8-a039-b7e3bcc4a56d", "comment": "Malware payload (Mirai)", "value": "92110d10fc06a69ea3942c07c8f30ea68db15640542e7889183c5c5e6cd471a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568392, "uuid": "c866bc9c-974b-495a-8677-7ca08389a145", "comment": "Malware payload (Mirai)", "value": "7f7d4c85be89ca4dca2439960ce77c52666f140b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568392, "uuid": "653cdfe3-2ce0-4d14-aea8-4dea9fa7ce38", "comment": "Malware payload (Mirai)", "value": "63b3979013416fa89b8055d9f418e32dc34c073ace3288bafd79ff543b637f52b9e67b5bdc702a048071c697f5a980ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568392, "uuid": "c0f4c196-08d0-4f90-874b-1be9d1ea17b8", "value": "T1D7734A0276284E4BEAD70AF1253F5BE483BEED8025E4B584680FD7464635E37498EF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568392, "uuid": "f91701b2-a8c9-441d-960e-50f556490889", "value": "768:x0zlipKQt/M9Kr902YECVNoIdgxI+B5vTemF6m3PpT5v99/sllk5MCs7/nLDJQ04:6iYQtO6VCbWFdT1ik5kvm04/V5yDOoub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568392, "uuid": "a6222d7f-3269-467a-84cd-62e9f44c36ef", "value": 74660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568392, "uuid": "9d92ba14-b2c1-4eb1-adc1-53a458af0069", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568392, "uuid": "edc578cb-e313-45cb-9fe8-10a6595232bd", "value": "7b4c0e83e46cc0acc78616ce283b54eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4279da7-2fe3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634541556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541556, "uuid": "cd8f5aa6-f194-4784-8f7c-0083c30547da", "comment": "Malware payload (AgentTesla)", "value": "e8ae8fe8fa5d7c83e3ebe26389eae1f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541556, "uuid": "8f7aff30-4d53-4f33-bc67-2c18664d50d2", "comment": "Malware payload (AgentTesla)", "value": "92175af7571463e2114e8c8cd62de70ce9dd6757b67c77a051b0f6f2e52e30fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541556, "uuid": "2a63b6ba-43c4-40da-b767-f1cffe58354f", "comment": "Malware payload (AgentTesla)", "value": "6fc0dd32bb26b5b85e4ae4b81a86bb80a1fd414b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541556, "uuid": "bdc1f956-2a26-49ef-94b7-b9c1457daf45", "comment": "Malware payload (AgentTesla)", "value": "08056d35add0252dd7aeef6dae30aa324c52b1e2a3726c752a15a61caca3f17ca2fc824bd0c0dd33ae14de5e2ecb500b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541556, "uuid": "c8adf602-d1d0-48c4-becf-2680bd945f00", "value": "T161A41200B7A8CA27CB3A0675A0F2D3A53BB0E8B52F05CF579ECA34AE19B77415E50553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541556, "uuid": "f0bdd514-98a6-4f8b-94d7-7cd5da812f99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541556, "uuid": "fd510c56-e2f0-43e4-847e-a52981289951", "value": "6144:WQGLpbDaj4MJF5Z6saGA33vNd+kVccYt+T0N2gfk/dP+rFXYbaJXS7zmKr0Y:995IsJA3/NBTs+Qdf2+q6UrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634541556, "uuid": "f12242fc-1c57-45b6-99bd-1c3cfdb04bd5", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634541556, "uuid": "e75f3a26-a2d9-4d60-9e47-8627bf07a512", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541556, "uuid": "b4bf9e50-39b2-4da1-ad6b-c4cd754011ab", "value": "DOCU6309491220 Telex release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e09b0d-303e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634580664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580664, "uuid": "d42e9cc9-d252-4d98-b499-4f73645b4410", "comment": "Malware payload", "value": "dc40e380a5749ea8a190cdfffc28c022", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580664, "uuid": "bc7af49d-721e-488c-a907-3e9b8eecf49e", "comment": "Malware payload", "value": "92a70868c12b412994f66a764bda6682afac05ff212151de277ddfe9f28c9b00", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580664, "uuid": "eb6e27f4-9531-4a75-94ed-ad92365adb41", "comment": "Malware payload", "value": "7a4520c05521389c3863138b0c2aed014023c6e2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580664, "uuid": "911d1eaa-b04d-4f4d-84d3-ea825ccbcfd3", "comment": "Malware payload", "value": "f644a578269240813cebe7db68484dd95225c8263e7e2dd2172feebbbffbee84ad9bfb7c033ef199e01b01f81119913f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580664, "uuid": "1c302c49-955c-4da0-b1a4-4e61b9f435d5", "value": "T13EF28A7DF1970A88CF8693B8171B2F41158CF50CF3D995B636A8DB3866D0D7A922293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580664, "uuid": "6156bdfb-a0dd-4e72-8967-4b02a3b1a05a", "value": "768:E0IUITKd0bMIULpGX1BNga009Uw0vYZpSUs0:EtUITKd0bMIULpGX1BNga009Uw0vySUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580664, "uuid": "976dce01-7157-4ee5-96aa-a5bd1e91e6ac", "value": 35155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580664, "uuid": "aefe4280-2f73-4fe3-8cb5-ce629a166ad9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580664, "uuid": "d611e959-6fb7-4df0-9675-8858fe62f46c", "value": "Pago 0384999965.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ca8c2b-2fd6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634535729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535729, "uuid": "36870a0d-01a6-46a5-945c-3e51ffd8ac04", "comment": "Malware payload", "value": "d5e93972b4350f15e9b7dbff7df11823", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535729, "uuid": "64921105-e497-4c75-8525-3fca3486a51b", "comment": "Malware payload", "value": "92de9fb5b8c4cfb5bdf047c8ff2a6ce57b05fb32016f4e086842914b5be54f79", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535729, "uuid": "f3a3b39b-f04d-4ee8-a208-5775b96fb149", "comment": "Malware payload", "value": "ae6ab3997344fe3081448b62350a1511a6ff8516", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535729, "uuid": "0f7493cb-06f0-4ebe-8eef-d41fd079754f", "comment": "Malware payload", "value": "f95fbfb392302d39ca7251f094d93aff6032e5b375db9a58e70651ec33e852918fc2f7000c72a929831afbabf8d1c865", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535729, "uuid": "0f1575cc-d2c9-438a-a4b4-fbb3fb54fcaf", "value": "T15AD58D23F2D18437C1732A389D5B9768A929BE102E78984B3BF83D4C5F3979079252D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535729, "uuid": "10a17c00-89bc-4b5e-b3b0-94cabf87e180", "value": "24576:0hoXK4GQWbqW5Aw6rCILAtDo+vZVqJA9lCLpe8as1yYTU+l2Ye5OYLDA:0hgRCILAtrVmA9liTPl2jOYLDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634535729, "uuid": "8ec27a32-e37a-42c8-9243-f2ff17af670a", "value": 2809856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634535729, "uuid": "d60c277a-4326-42ca-8d14-127eca2908a0", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535729, "uuid": "876070e5-bb0e-45f5-8c27-7bce5e74a3f5", "value": "_jfiyhapcegomhmfioehcggdhaufeolqslpwuuzqa.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e931920-3009-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634557760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557760, "uuid": "810813a9-259b-4367-865b-b949fce30f24", "comment": "Malware payload (Loki)", "value": "5ebc54ff148cfb126169f6b4a9286f8f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557760, "uuid": "6d34dda7-8233-4754-b42b-1d72fed98133", "comment": "Malware payload (Loki)", "value": "93319275e6a7705beb1bc510a1eb3728d02706cd416e8daee48916300425eaf3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557760, "uuid": "c35593f1-45c1-4ad7-a6b1-0afdaf79743f", "comment": "Malware payload (Loki)", "value": "d4f3e836d52f9a71da31ada4debb5bc4d9f35f6f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557760, "uuid": "e9033aba-a72c-4115-86d7-676a2501cece", "comment": "Malware payload (Loki)", "value": "550c13a8ac7ad259ca5830b7b0a7d138626a31729310ebac4bf17b00fe196e4375f0a96b0afb0ab5054094bddd989cb1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557760, "uuid": "127df67f-6b16-4b6e-ac8f-de16717e768c", "value": "T166C2467EF58B0E49DE5686AD061A7BA5064DF51D32C840E236BCCB347A5C85B8B23D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557760, "uuid": "00da9eda-2dde-483b-85b9-09775af1a52b", "value": "768:wJ0S2hDwMPstRMnkZbbI7x3kKPpHxrn8d4:U0S2dzP0RMkZfeFkKRHxr8d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634557760, "uuid": "2884415f-8468-4365-bd55-832abf3f2fc9", "value": 26707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634557760, "uuid": "f21dc3e4-0763-4c49-afdb-bd2751500b41", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557760, "uuid": "bd4ff210-9fed-4797-ad5d-3fa2d3b23e6e", "value": "5ebc54ff148cfb126169f6b4a9286f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1dfbb4-304a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634585840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585840, "uuid": "b4f932b2-9b8b-4260-918c-7c344602c80c", "comment": "Malware payload (Mirai)", "value": "8d584168a73f726cf48ba42f1925687d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585840, "uuid": "b985eedb-7684-4af6-aa08-b369bdb7c4b3", "comment": "Malware payload (Mirai)", "value": "93eff6ad0b9a24a8f2c3aa11e05e1a64f1dd37dc6d95d283066df977d1bb6666", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585840, "uuid": "f242149d-3136-4249-a4d3-e75883016724", "comment": "Malware payload (Mirai)", "value": "b70549746189b71db2f76c1bab35050b4c568bb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585840, "uuid": "819c417a-ea08-4499-b9c8-58aa24290d92", "comment": "Malware payload (Mirai)", "value": "fdfc8bbc05a4d5afb84b2cea601f26327ef5c9396be9e2ab4a303227e4cd059baf423f1b3d8371999c0984fe1430b384", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585840, "uuid": "470d05bf-46e5-4869-9a66-2542e620cfe4", "value": "T12A735CC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585840, "uuid": "2bdebdfb-bc31-4b5c-8f6f-ae5c378f9093", "value": "1536:b/DYQYs1ZokODichvg15UzOHIt09bfsH18ruUGDKVQSi:zDhzUkODichviUzk40h0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634585840, "uuid": "bec13bfd-d9da-4fde-b22d-66ff95cf8f76", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634585840, "uuid": "ef7ec9df-396e-4cd0-abc8-7f8e4ee0944e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585840, "uuid": "e6e0e925-332e-4c59-a922-6c8d43d494f1", "value": "8d584168a73f726cf48ba42f1925687d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451d8320-303e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634580454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580454, "uuid": "63004606-e2b4-4c6c-98e2-6c0bad0b1540", "comment": "Malware payload", "value": "ad0f9c56ee043931b29fe72b175512fb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580454, "uuid": "966bd716-1803-4b4d-a3ad-35939517d263", "comment": "Malware payload", "value": "94813fb713b0e758db6696738b44ce13078ec27c4bfcf4c95e09cdb7bea9040f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580454, "uuid": "cdcfed86-657b-49dc-8fd6-40e2161ab16a", "comment": "Malware payload", "value": "3d59319fb0ddc0be6ec0bf8ad1e4138c6de2273d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580454, "uuid": "caff1da6-c410-431b-b8ff-8da1148a9a86", "comment": "Malware payload", "value": "413cca7da63c3fdc7433147614c008abe643c1f75c7b4a7b6ea6eedbae6b2e0b988487fc999ddebcd3284d0b9dcb890e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580454, "uuid": "d3a9c2ef-14c5-496e-a44f-b37edf878233", "value": "T16803DA7DF18B0A88CF8693B8170B2F41164CF51DF7D994B236A8DB3866D1D7A921293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580454, "uuid": "12cc5011-5110-46eb-a85d-6f027f0d70ac", "value": "768:jeJQoSaDlnvFbKbH0+2n4dztFhy7mIUPjdsUpwGTjzIHQd/3igBb:je2odlvFbKbH0+2n4dztFhy7mIUPjdsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580454, "uuid": "480e8640-7d1a-41e4-b868-b9fb6f169ee8", "value": 38851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580454, "uuid": "090ec93f-693c-4ebd-91e7-771af11e62b1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580454, "uuid": "1af9261c-d502-412f-a9c3-4520f86ff46e", "value": "INQUIRY IG0107-GAZ-SHT-8105.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcefff51-3023-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569059, "uuid": "8b74c30d-fdee-4f57-9851-1532af1495fc", "comment": "Malware payload (Mirai)", "value": "ba2e8d34befd26c402b12bb8a745ec97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569059, "uuid": "e167fbd4-0c8d-45ad-b9ef-a24e31e9952f", "comment": "Malware payload (Mirai)", "value": "962ae963398700325c5c7a836018f9e6d899e2902c89271c973c93ca4e8d92c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569059, "uuid": "d78daf34-d594-458b-ae64-ddce2a8402f7", "comment": "Malware payload (Mirai)", "value": "2ae7515b7fe3517d11d6f3b29d018ea68a6feef6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569059, "uuid": "7d0ba005-2158-49f6-84e2-16a1a6bd3baf", "comment": "Malware payload (Mirai)", "value": "71131b01298f8ed22463462a29a07831eec963f573ce9336ae5bfd4b6dc01125090109ea4e3b61e23e773a7d48966b3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569059, "uuid": "75944ecc-fbb9-44f6-aaaa-1aeefdb1ab93", "value": "T19663AEB2D07695D4C0864238A4A89D3A2F13F5889263BEF65ED647A65047DFCF408FF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569059, "uuid": "a72828a1-86cf-4a83-8c8b-1b3cfb3352c2", "value": "1536:Bh/8p58Yx3Y/jeNh5FUmodm9qaYiER9AKoKC84Gd42+:Bh0/5txUmoME/AKoKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569059, "uuid": "1fb97172-69d8-41e7-b82a-733d685cd82e", "value": 71348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569059, "uuid": "92374d32-c5b4-4adb-bd08-e92f456c20eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569059, "uuid": "9bcf9617-b781-40cd-b33b-cf48dd949f65", "value": "ba2e8d34befd26c402b12bb8a745ec97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31aa2653-301c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634565819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565819, "uuid": "c9803b76-5413-456d-b0b8-11b6225905dd", "comment": "Malware payload (Formbook)", "value": "51c6709cd33cc68226450140b2d2d02b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565819, "uuid": "49b55834-9b3f-41e9-9887-223baf0ea99e", "comment": "Malware payload (Formbook)", "value": "96e14fedf020cef802a005cf9289d7c8f8a0f2bd516fee5f4096cf36a2f2c1e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565819, "uuid": "61a41963-dc45-4c2b-ae4c-d8e417e3c8e0", "comment": "Malware payload (Formbook)", "value": "573d6fecd46c30dac8c337ea8ed9ee218980f0ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565819, "uuid": "77967dc8-a30b-4b07-96ec-3fd81d78430e", "comment": "Malware payload (Formbook)", "value": "3463490a1876b4122fe1a17141543258f3cd0e7198728d2f5a83976a12423de09ae09b6c23ee21faf6cbf325bc8cdb70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565819, "uuid": "9794bf82-2882-4eaf-b78a-c614b93bd85e", "value": "T132059E75F1E087BAE1721A38094F6BCD95397C907988594B9FE93C9D4FEE58130328A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565819, "uuid": "63ef817d-926e-425e-8846-a3a1fb6b7214", "value": "c27a46121fdf0c7d592b2676dec19736", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565819, "uuid": "10f39006-0528-4796-ab68-01004ba9dd38", "value": "12288:vg7gE4RdCLZ3nWmAaIfGmLgdNHuApk2CDTMZEsxH2zar1BYdQarCv:vPE1LZ36/lL2Lk2CDEEsJHJ+QarC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565819, "uuid": "296ce116-8933-41d3-946d-760dc9c87248", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565819, "uuid": "eab765c5-f7d5-4a58-9da7-94a2698e8b19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565819, "uuid": "0eb25604-f850-4489-be53-d2a09f22050c", "value": "Lista de orden.PO9876543354.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682034e6-2fc4-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528114, "uuid": "8de898d2-2f90-4a80-9c75-ce22b69fd410", "comment": "Malware payload (Gafgyt)", "value": "3a477d241b4a4987a769586284673c67", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528114, "uuid": "b22201b2-984b-48c9-a48c-0bff70c579a5", "comment": "Malware payload (Gafgyt)", "value": "972ff77cfe34759ff7c1a4a4b17a6fb091959a758031f07b828b45196039568e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528114, "uuid": "2285bf64-e8e7-499e-ad67-01901285ac9e", "comment": "Malware payload (Gafgyt)", "value": "955627dd5a7c666621082f8fbabe372a9e1cb72c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528114, "uuid": "a209a51a-0976-40a2-ba9f-4e1571e3330b", "comment": "Malware payload (Gafgyt)", "value": "54e9870e4641028db762d0350efd8aa3264f7fee1cde845385d93a6ab3764c570e918d42ab5c4495fd4200268743a7a7", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528114, "uuid": "d1a83ab9-d995-4b4b-a57f-7a875cb65958", "value": "T183B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528114, "uuid": "d782d03c-5ad1-4f24-a86a-5c2a6446614a", "value": "3072:qd0weSAewzi+Xn+8Uhw6W+aPhJmDk1c8xF6KjW:rfO8IB4JmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528114, "uuid": "22ddf435-672f-4b45-9c65-e7983b43bfe3", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528114, "uuid": "0b958607-f5f0-458a-92a9-cbef9b911f32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528114, "uuid": "86653fdf-6174-46b9-8884-63316629db86", "value": "3a477d241b4a4987a769586284673c67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fc2ec4-2fbe-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634525405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525405, "uuid": "c2dffb70-62f2-4961-8dde-25c73ef55ace", "comment": "Malware payload (Mirai)", "value": "d52472f1b832f8e55e9bea6d4f0f8c6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525405, "uuid": "b202e21d-9356-42fe-8324-3b85f8c3c0f0", "comment": "Malware payload (Mirai)", "value": "97fe95b77d5d3ce5bc3e6722030cc51c0632ab91f200396f66234d24e3fd8538", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525405, "uuid": "05f57f85-f157-484b-bb20-c2aec8e79107", "comment": "Malware payload (Mirai)", "value": "1f3bb9f71cd837212f195bf6ae89507544d4ee3e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525405, "uuid": "10a155d4-b8ba-4506-9906-dbaf661e3e68", "comment": "Malware payload (Mirai)", "value": "b50f373a14b59605abaf85f08cf4c7427dc04fc145a05307dca5641fb4a20b229dc543c62e2477419d4eee2a79158cb1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525405, "uuid": "93bf8a19-b9c3-4359-8e37-156f6465afbb", "value": "T1F5C32C56EA818F03C4D61776BAAF42493323E754D3DB730689186FB43F867AE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525405, "uuid": "099fa5dc-de90-468d-a3dc-714ef82d846b", "value": "3072:tIQbg4/MabDUv25UVRx74DyYv+oV+M/98w4i/:2Qbg4/MKz5UVRxcDp+okM/985i/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634525405, "uuid": "b3f881f8-67ff-48f5-b4cc-180883523bfb", "value": 121479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634525405, "uuid": "c6d83128-449a-4c82-8f29-e294e2addd2c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525405, "uuid": "e4ed5598-e40c-4219-9b0c-9d61475bbe44", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14236f7-3012-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561711, "uuid": "d873fd4c-602c-4bfd-bef3-04260864eda9", "comment": "Malware payload", "value": "2547db98cb5387447fdcdcaccc0dfd76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561711, "uuid": "dbbab6fc-67d5-4662-86f4-07c8eceeb6fc", "comment": "Malware payload", "value": "98030abe3b55718b6e014c5b81c7c3c602a50cf4e2004da4eeae1c0de42669f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561711, "uuid": "b9294e6a-bc54-44b1-98e6-b6d349eca507", "comment": "Malware payload", "value": "ac34daf95b1466002fe324339d9cafba8a017a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561711, "uuid": "df738928-0c4e-422f-bd03-a90d8c8b9835", "comment": "Malware payload", "value": "5c37fe1d35d4dd465afa0756268c79d302652a59dd40cb11b5eb843d6956cd377f5c951420180aa37897e40433b47cd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561711, "uuid": "e6b95613-dbd3-4b48-9a31-071b03e3e6c9", "value": "T171D4F110A7E0C234F1B657F859BA9378A92E3A90AB2190CF53F917DA57346E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561711, "uuid": "d0bf7ceb-3628-4e9d-ab98-0474557f50fd", "value": "aa28841a98fbdef9684f8dac2b470256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561711, "uuid": "b02b90ac-058d-4083-bc4d-f51814f7079e", "value": "12288:5xZvP+KiqtgV2oqjA/YHcSYU8TKBoF78sH6gUS0K+ialig2RLI:TZn+2tgko4AgHcSYL9FJW2gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561711, "uuid": "16a5f461-6b1e-48fb-a5c6-618181a6002a", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561711, "uuid": "7da31490-c859-4986-9e05-8bfa91344aea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561711, "uuid": "506036bd-111f-4b37-a3db-7b1675f06f8b", "value": "2547db98cb5387447fdcdcaccc0dfd76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2cbe5d-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1634555716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555716, "uuid": "e7ba1a26-db56-454c-bd48-594220adbb10", "comment": "Malware payload (TrickBot)", "value": "839fb59bb9cb224b1b71d0a9f7d4558f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555716, "uuid": "be15b74c-1378-473a-b210-de315d63dd28", "comment": "Malware payload (TrickBot)", "value": "9890dddc8087d395c5eab7410880b35d3e790d11ab08f2b4a039818e814f21ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555716, "uuid": "22b3e1cb-1f74-4e86-95bb-53634c974514", "comment": "Malware payload (TrickBot)", "value": "27dd4e9a4fcc98fff75195fcfb86f5594ee0b2f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555716, "uuid": "01544543-d974-4b1a-9f46-9295eab48cbc", "comment": "Malware payload (TrickBot)", "value": "92c5cf83126f97925380cadf558b99e0ee198424e81c6ae69527182f743c9fc615ba873ba71d33a04d52e6afdec2b413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555716, "uuid": "2d1f32af-9eed-4f99-9696-365acd7c9423", "value": "T16615C01A3AF1C076C5A291700FF67B6AB6F9ED605B378AC753804E4D6D31DC1463A23A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555716, "uuid": "bfcdc8c5-6dda-4d95-abfe-d4722a2bcf2a", "value": "d3d730d77f19513c17bee56cad3fbfd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555716, "uuid": "d02ab54b-01f4-42ca-9842-31bf19f5e21a", "value": "12288:DEMkCMMFkUED6ANs4ZD9V63Az2hPmy+khUzJUu/:m+ED6+xZzkmiiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555716, "uuid": "ac33ce8e-5338-49a6-a3ee-af2aa57fc8a9", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555716, "uuid": "b786f42f-d566-4d76-ae6b-4cab60508841", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555716, "uuid": "f9053842-d98c-40ea-9bac-1c7688058a38", "value": "839fb59bb9cb224b1b71d0a9f7d4558f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de0ddb0-3013-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634561974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561974, "uuid": "1900b6d2-f31d-4bf0-b33a-c59256a1d9b2", "comment": "Malware payload (Smoke Loader)", "value": "2b858c79a8a7a652f8cb60059eb7a95a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561974, "uuid": "51cb5a0e-38a6-42f1-864a-e987ec9a89f6", "comment": "Malware payload (Smoke Loader)", "value": "991e3c5fb9946ed0490a723a541bda0f36a9b94fff8a68f6729c15e1044dd954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561974, "uuid": "ae653cc6-8a5a-41ad-8020-008398be090a", "comment": "Malware payload (Smoke Loader)", "value": "e669008a553976d275388ee02e49d5c938a6c27b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561974, "uuid": "007559f4-80ef-498b-a923-153f021f4190", "comment": "Malware payload (Smoke Loader)", "value": "b7f54dc240fbaa646001cc1b9526b3a062592d0d6ddd4cff071f1831e881f91cbabbe017deeafcabf717fb3fcb984b0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561974, "uuid": "cfe68bc5-0673-4903-ba6d-456c66333633", "value": "T11D746D00A690C039F5B752FD89BA9379A52E7FA16B2450CB53D52AEE9F345E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561974, "uuid": "3e39038a-6d8c-4d57-a087-25bb24a0b300", "value": "b4cda15a674ef12000829b9be50880b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561974, "uuid": "cade6341-ebb6-4fb5-93e9-57665aae3c40", "value": "6144:r6V5SbKU1o61YWv+MYQMddfjZjz0x0a6zyyHGkES8woAy6HQf:rqSewZYWWMYQMZjZ30x01yaGDS8woH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561974, "uuid": "2a21f705-6ace-4b57-89ab-d97c8f6a5493", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561974, "uuid": "e71bf191-aadc-422e-a67d-846a76fd492c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561974, "uuid": "efddb196-211d-4a14-891e-aa33207a4412", "value": "2b858c79a8a7a652f8cb60059eb7a95a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b9e12c-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568421, "uuid": "e5d14400-e9f4-468d-870b-b0ceccd64d35", "comment": "Malware payload (Mirai)", "value": "4189a0945ba133dcd61527b7cd6cb22e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568421, "uuid": "ab2756d0-0514-4eac-96d7-d2dc306d9387", "comment": "Malware payload (Mirai)", "value": "994a896ef338c18ffc5b4da5d28bf094533472b1126dfce0604735d06fdf6895", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568421, "uuid": "71197b73-93ee-4f22-a559-53d243f7ced4", "comment": "Malware payload (Mirai)", "value": "d46f9b0f164fc50d805e4f9eec2169951f2de1be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568421, "uuid": "0b5760e7-b687-4c3c-a32c-2918d93ff2af", "comment": "Malware payload (Mirai)", "value": "e777a901d7fc672ae5eac95ba94d27125bc236afdb1fcad13f6f09770596a89095fcc7fb7c5979ef082ee41c14eb8295", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568421, "uuid": "0414f0b8-2062-42e1-b10f-6bfe6ec6cd14", "value": "T14B832A9AF400DEBCF88BD6BA41664D0EB930A39016920F367767FE933C23095DD56D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568421, "uuid": "a97ede31-2979-4834-84a9-a1d52e3ca3e2", "value": "1536:qLf0+QM5PHyVwi7f27UiEy+DlOo7qL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fm+DM9SJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568421, "uuid": "4bec5c42-65cc-454b-924e-398b63af26d5", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568421, "uuid": "f3ecc50d-7531-46ec-b388-5375abf10312", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568421, "uuid": "2cecc510-4530-46c7-b593-d0d4324edc20", "value": "4189a0945ba133dcd61527b7cd6cb22e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcb78a5-2fbe-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634525440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525440, "uuid": "eae73944-f770-4cbb-b11d-1d2b342a2dbe", "comment": "Malware payload (RedLineStealer)", "value": "a9d63ba83576c19bb1dbad9e85b51ecc", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525440, "uuid": "6b7b93c0-fb24-44e0-bc1d-18d49ee3a3a0", "comment": "Malware payload (RedLineStealer)", "value": "995d009e2fa6b510a0251895e0e71d0709ebfdeac782eae91caa3b4ee30bd29b", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525440, "uuid": "508a11d3-a022-4381-9ffe-fe230ef3897e", "comment": "Malware payload (RedLineStealer)", "value": "f37937e9afd6c78be38c58ebf84a03f66091c03c", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525440, "uuid": "2dfd0aca-d233-4dae-93c5-5c6be54dcdc6", "comment": "Malware payload (RedLineStealer)", "value": "58f9bc0611fc515e4f4fcb0b79c179e4ea4e6008e460ed536f49ba2e8fe54aeefee8c1cbbf95f9ad1c3f05bcc22d33c4", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525440, "uuid": "6da0f98d-ccdd-40a5-8e8d-4dd092c7562a", "value": "T1C5563311917CC7F6ECA00B7664B543BA25F30C9DE97B9ADC5D702A821E13D9E2706D83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525440, "uuid": "71ad2709-53c5-4265-971b-f6eb181efe38", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525440, "uuid": "65d73987-43e0-4e75-b654-92c328d9cc7f", "value": "98304:JaZL5WwT7cp5HNGSNhOpW8XIw0J+OfIxJ67PYpVd9kxzamMHf42P8baI2BWcjOzF:JaZoYc5geAAILMYpBiam9e8OIiFOz8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634525440, "uuid": "0ac71a12-4914-4aa1-9e79-92e042a4d560", "value": 6160211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634525440, "uuid": "1013d1a4-3d72-434f-ab21-7ddf38cc26f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525440, "uuid": "1219c6d4-18ea-42f4-94d0-057d8ab2b1bd", "value": "a9d63ba83576c19bb1dbad9e85b51ecc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf0f559-2fce-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634532607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532607, "uuid": "e097c120-4f96-4138-9864-a44bb1881e08", "comment": "Malware payload (Mirai)", "value": "39bf0f937a94e8895e9c76bcafa9b5ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532607, "uuid": "fd8435cc-c16e-49fd-8027-e2fd45695c04", "comment": "Malware payload (Mirai)", "value": "9978dfc9fcd2200a8496f498b29218fae1d6f2028d3bba62b965e4d3ad74ba5b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532607, "uuid": "3ebe0fd9-812b-4378-bcc3-5d98dd4f31e1", "comment": "Malware payload (Mirai)", "value": "51ca0f5f662114ffd9e9dbf409a22171b1e781e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634532607, "uuid": "085de4e9-13ba-4d1c-879f-8c158a4d38bf", "comment": "Malware payload (Mirai)", "value": "597f96a7f6aa5ece4fe12974d6cf60c54120aa4b42d6c76b0a0f215aaacd99cb5ad8e0c0c71f3d106129aa54916163ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634532607, "uuid": "a875c224-3bfc-4f6b-832e-b0b82fb62c5b", "value": "T19013F15D100DB666C66424B9FD3C868347A71838E04832FE5D49DB51F2836029AF57FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634532607, "uuid": "09aea992-26f6-4a42-9be4-45894d9507ca", "value": "768:3uv/RcDyFI/OhqdOQFFcGdyvj2VppaDa/Sevz4YfasHgo8X2a6xShPs3Uozf:3abhcXFEgpMDkSevzp6o8XV0zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634532607, "uuid": "9eed76a6-894d-4df1-abf8-e6e2d11fbe0b", "value": 43992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634532607, "uuid": "b7cdbbeb-4b2c-4bd5-93ac-9902fd13f0a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634532607, "uuid": "54f19b5a-3516-441d-ab6d-605e8c473029", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf415740-2fe2-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1634541145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541145, "uuid": "34a3c11f-14af-42d3-87fb-5c4c51176c2a", "comment": "Malware payload (RemcosRAT)", "value": "e5906776fc08713cc08be7a37b8f012a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541145, "uuid": "d6c6cf6c-00da-437f-8e3e-18881d8e98da", "comment": "Malware payload (RemcosRAT)", "value": "9cd00220162ac28c07e3adfa3d6fa203b56b39934dcc560258ce888b2b869a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541145, "uuid": "fc0210e3-b6de-4d15-ab44-6e6a38860d90", "comment": "Malware payload (RemcosRAT)", "value": "328062b1385ee321faae9daf6e3e1e18ac95e967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541145, "uuid": "c3afdf97-cb5c-471c-a765-485241326af3", "comment": "Malware payload (RemcosRAT)", "value": "c8fa041aacbe331808ffa82ba88a9e5a3e919c5968feb050c7efbc41e343bf64cfe998c9fd8a1daeb9c3f3721e424f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541145, "uuid": "9a04ee94-0a34-4bc3-af2a-9a322ac41090", "value": "T1DD059FE9D193C035D123953EDE077726D01E7E80BA9158813AF5798D5FBA3823A3A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541145, "uuid": "5d465a2f-4f63-4f8b-b2eb-05a395ddbda2", "value": "9d6254f1666ec7df9c70515cf5807dca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541145, "uuid": "3c1463c8-6e73-4940-ba5c-cec716010c9e", "value": "12288:ngXbE33TJYei20w6R5ghlWIWeePpfzqzqyjFPKncY:ngXozJzix84eePAH56c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634541145, "uuid": "6a3c70b0-fe28-4719-bd28-574f9ac1ccd8", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634541145, "uuid": "187509b4-e51e-49ae-a6d5-3aec58ae027f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541145, "uuid": "a3281586-c135-4ba1-b936-5e98c0b449c1", "value": "DHL_119040 kvitteringsdokument,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0521f2c0-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634561020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561020, "uuid": "d324a5b6-cf8f-4072-b7be-7a591488d9b8", "comment": "Malware payload (GuLoader)", "value": "fed612633dbae78ee850227d5c347e42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561020, "uuid": "6431c147-cafd-4622-a990-57d6bb45e5d1", "comment": "Malware payload (GuLoader)", "value": "9d64d8a2df600d19e92d0819ff3cf7dfea0e35da0658a87d5c9a5bd08c69b0d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561020, "uuid": "957c68c2-71fe-4422-8953-f31d53b846d8", "comment": "Malware payload (GuLoader)", "value": "5cbfbbfb639edc158903186dd4a76e9e82b8fdad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561020, "uuid": "9326e397-6bf8-4135-80fc-21be0649a358", "comment": "Malware payload (GuLoader)", "value": "79f30625bb92e68a414b01748bef3318b9bf9b6ce1f2fc8e3f0de8414adf76f44d10c2f739e4ffc722da14a3e4797a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561020, "uuid": "fc391caa-867f-4733-8086-e79707b59d07", "value": "T17AE34AADA950FA37DAE285F6F572C2FC14A52C721A37181B5788260D8FB27C4641CF36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561020, "uuid": "7d6fadf9-7b3b-45e0-a747-5f3ed2e58a94", "value": "5a65e0668fc8ba426b65f25a72e093aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561020, "uuid": "f6064135-9bdc-463f-b912-3a33fa66cc00", "value": "1536:D8oYjmnS4S24jeQS7MehfCKT1Z7nRG0FnvQeftmbDM3hDF:+mn1RPqKP7nRvnvUbYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561020, "uuid": "b42cfb15-4f42-41a9-85ba-85264834758a", "value": 156944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561020, "uuid": "492b3eae-a0da-4840-9f18-1ea1d66cb924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561020, "uuid": "b3ebc8a9-fe4f-4269-bfdb-8bf3b2334d12", "value": "FINAL_SHIPPING-BILLS-Reg-99383000002292-EXPORTSDEPARTMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7b53a9-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634561359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561359, "uuid": "9fe50a35-ebbd-4f64-bd29-f5babddfabd6", "comment": "Malware payload (RedLineStealer)", "value": "4c1cb3eb362b3eedb2889084943f4c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561359, "uuid": "c4dc3e64-6f28-4b15-bdf0-5ac6fd751d28", "comment": "Malware payload (RedLineStealer)", "value": "9da261b424c3556a10381504bce49fd981fb77451d96bd8f08316941954255fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561359, "uuid": "0482f232-dacd-4ec1-b661-c9fe0ee45d9d", "comment": "Malware payload (RedLineStealer)", "value": "49209c4e0017e4ac045ee7c7d74d392e9d6d92d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561359, "uuid": "2b2cda00-5b13-4369-afbf-27bb313b5e6c", "comment": "Malware payload (RedLineStealer)", "value": "ff143c95f6afb907eae94be60facc6c739df0f3c04563fe64ac0d3843590258904fca5f5d8ad80cec74b9acfbc6d34e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561359, "uuid": "342adc3c-ebb3-4695-b5cd-ec55f1acf24f", "value": "T14D63C677407690A6C5882730F8B50F0B367CD6381A80B698F04BB6EADC1D69D9EF47B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561359, "uuid": "08129f2e-e66b-4049-aac9-4b6af4ca6def", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561359, "uuid": "32c1aedb-d269-4295-85bb-786bc91c3362", "value": "1536:DO4tqCnFeos2enoruLV9pcOAgKE5qMocw2p3XsN99O:DO4ciFe2aorubpfdKGTocjsN9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561359, "uuid": "6db2d74a-cb72-4ce0-87d6-1aeca1ebf2f4", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561359, "uuid": "22968801-948d-4bb6-9547-c3ad0b44f8d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561359, "uuid": "8a7d1bd7-d336-45ec-84e1-764a0296d026", "value": "4c1cb3eb362b3eedb2889084943f4c88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a619dbe-302a-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634571873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571873, "uuid": "7c0aff35-6eff-4676-9c21-c7aede9ea68d", "comment": "Malware payload (SilentBuilder)", "value": "8b0ac08459238a7d97e5793f4215e384", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571873, "uuid": "07723b77-4e45-4717-8be6-a5e9e5c10536", "comment": "Malware payload (SilentBuilder)", "value": "9f1f3b362ce563c89776aa9fa602662eeb6720bc2d201d1b15e81fc4b5655167", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571873, "uuid": "72d87bd9-ab12-4410-a4e3-5e8591e3f36b", "comment": "Malware payload (SilentBuilder)", "value": "ac26412c2d4e2b146bb6a2f964ed48da67e8372a", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571873, "uuid": "cb7eed5a-491e-4f00-af53-0f544dfdaa30", "comment": "Malware payload (SilentBuilder)", "value": "b7357753cfbfea9390752a274ccad118ac82cb54b493994925c6ea7d589734941ad16628dc7164ec302e48d7f18c0666", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571873, "uuid": "6b791d99-7bfb-417c-a3ba-e7586370bdf0", "value": "T1CF44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571873, "uuid": "ac7df2a5-0e0d-41fb-999d-85f267f653c3", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7W:U9jFrjmkD7IvLDK3vLvfn1+2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571873, "uuid": "bd0c0dc6-c686-4ff4-91ca-77a819a47fed", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571873, "uuid": "d3ee2cb8-8ce0-49f1-8b91-09972254ee06", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571873, "uuid": "645c29be-fee1-4ff0-9567-4033cad3e872", "value": "8b0ac08459238a7d97e5793f4215e384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1055aa6-3018-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634564288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634564288, "uuid": "8dc52559-c95a-4eed-ad48-13ba1053d56c", "comment": "Malware payload (Loki)", "value": "c4151a67fe4412821d43b0f5297d7004", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634564288, "uuid": "bb1e15a2-4e25-487a-bf08-8da0100472c2", "comment": "Malware payload (Loki)", "value": "a001d248a75b25696fc58e278aa37fb21a81dd6a2fa4ee5c126d37412cb4b993", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634564288, "uuid": "20f0bdf4-a7d7-49ea-ab87-c03bc9a07576", "comment": "Malware payload (Loki)", "value": "6970f5c040febebbd06f6ce909d3b4daac04f8bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634564288, "uuid": "0b17f304-15eb-473b-a31b-042158e0a330", "comment": "Malware payload (Loki)", "value": "2706a4093bd00dd4a0885bdca9cb5645cbada961d176f14bed0b32a12eabce393a4a8f79e0cdca43ce5dcbe9b9199555", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634564288, "uuid": "d685b291-6b7c-41a7-8770-1eb298c55520", "value": "T14F649F0077A0C034F1B726F849B993B8A93E7EA16B2590CF5ED116EA46796E1DC30F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634564288, "uuid": "18ee996c-a0fb-40eb-925c-2918d14ce645", "value": "6f2a068c255b00f177d7f883be0dc61e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634564288, "uuid": "7224809c-2bc1-4124-a172-8f80300bb0c4", "value": "6144:WZT46FBxhEAXqXCrdgP1R0oHQikJI0oF4wM:MEmlEQ8CrdgPAoHQiYoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634564288, "uuid": "a280f940-3862-47b7-afde-b4b9a2b90623", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634564288, "uuid": "6d581e38-3e30-4803-92e6-7102326c74f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634564288, "uuid": "e544eb68-68a1-4d28-ad34-70bc808ca08d", "value": "c4151a67fe4412821d43b0f5297d7004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8cd500-303e-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634580683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580683, "uuid": "0b9fb19d-41d4-4fd6-988b-bf2da7ce8052", "comment": "Malware payload (NanoCore)", "value": "5645c8ea1ca2e5012d172b9fe4b265ae", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580683, "uuid": "88872e36-a40b-4e65-ac06-b4bcda4ce31f", "comment": "Malware payload (NanoCore)", "value": "a0512e7537eac6c6d9bc33483261c2403c9ac0d49f6a10748b2ad81d591ec892", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580683, "uuid": "851a68d3-f4a9-4d1a-a08b-0957e538e9c0", "comment": "Malware payload (NanoCore)", "value": "edcf8460d3ab64dd385ec3cea70d29c520ec8ac9", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580683, "uuid": "535e106f-6cda-4432-a7a4-68d03762a6f8", "comment": "Malware payload (NanoCore)", "value": "c653e0377d93ae57cc94280653032fb2322c7f0b34453ccb4a6e9b610c8b01131c5723a44f4726cc03d9ef801c91fee8", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580683, "uuid": "24f43aa1-a1f1-4679-a1cc-c0cd992cea55", "value": "T1B274C06226497C85E9030C74D311622F324A5D797222C5BDEDF278CAC679338E27FA76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580683, "uuid": "3b2d10d7-5a57-4af6-976d-28356214e778", "value": "6144:uJFMk2INzMzOavJApwnxxWCSVKevSpUFBjitgjJ2G1Qhol1vgamQ5yY:uYINzWJ5+kwBu+jIG1QhY5gaD5yY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580683, "uuid": "3f7ef20a-0ffb-4551-a545-bb5256149a43", "value": 351720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580683, "uuid": "37d9387f-03ea-4b24-94b2-6b96f24aa7ca", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580683, "uuid": "c2884de1-3ddc-443a-a981-66c26c6a6583", "value": "we-ship-SNE-9874657.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d77929-306c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634600211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634600211, "uuid": "9b48d850-f035-475f-8da4-e9cbb29b37ab", "comment": "Malware payload", "value": "8a5336e1f45a85b04b3b8930a714a7b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634600211, "uuid": "4def7c18-0897-40b6-8b79-13c798daafc7", "comment": "Malware payload", "value": "a2be24512daa156d5c3cd4726819d6cb085e77a1d8f3a6b2c6bfc26221f8853c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634600211, "uuid": "e93f0359-f99d-4672-b94b-1b6f1927dcd3", "comment": "Malware payload", "value": "2bac2e1ddfebabfe1e8f15301434b47be53063c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634600211, "uuid": "cd3ca02f-067a-4e64-8343-07e3113bf4b8", "comment": "Malware payload", "value": "d6efca461aafed6e41cc5a31c9bf2eed23ff6826e0fc517a8d81069e2bf69e445a61a4f85d32ca96d592df61a1fbcc1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634600211, "uuid": "2add172c-cb07-496c-9669-3620a47f79aa", "value": "T1EB83E9013E047685C5D20DBA01B659C1A3B84DDE8E9BCE7379E1B73E74B3624AE07939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634600211, "uuid": "af656099-2f2a-4528-83b6-ff078664f59b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634600211, "uuid": "6108e8f8-b0b6-4c5e-9e7b-1353f5b751c7", "value": "1536:XHJILdpECz3IULFMAAiu6JL6oNsgFAyox0cH:XHJAdpJz3IULY6JL6oNsYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634600211, "uuid": "118aa1d5-acef-42bc-8511-b9902ec1eb03", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634600211, "uuid": "815ec5a1-af68-430b-b86d-4327df0951ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634600211, "uuid": "168baf08-2dc9-49da-a880-a9ff0147ad05", "value": "8a5336e1f45a85b04b3b8930a714a7b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f88ccf-3007-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634557100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557100, "uuid": "5731e5ab-5e66-4e96-a4fa-7332a7500461", "comment": "Malware payload", "value": "fd765ec2c4e8973d1d66c49423d56cfa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557100, "uuid": "08813687-ab61-4641-a587-4af18fb59bf1", "comment": "Malware payload", "value": "a34918cec5576b5bcf69676227967cc7a38a26bc41a85d5f3cba3f3827a35374", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557100, "uuid": "79019a70-4df2-4b76-98a7-538f8bd82e51", "comment": "Malware payload", "value": "66b1c8d592e4554a055abf2e2bf20e44265d331a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557100, "uuid": "45ee42ca-263a-4e34-834d-84648eb89b2f", "comment": "Malware payload", "value": "638a3965617cc0e1465df228d10bd5ee41150756d1f8bfed6cdab0877d8a413a471ee69e4afb7015f7a852309ba2fcec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557100, "uuid": "452fd660-f76d-48d5-9b4c-64c4f0d227c2", "value": "T15A152305C59E91CCCD8ACEC1B78C329D7B942F65D2D4D6A83A190EE2DAC11871E7ED32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557100, "uuid": "ef3bee01-c36f-4723-a730-29ac4510274b", "value": "24576:Z/QmRBwX5atez/9gtCHxWeFKJ0x4oFej60lpgb:ZTDwXUte79glj0aWT0l2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634557100, "uuid": "657ae182-3b15-454e-ac6c-22b89af34a61", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634557100, "uuid": "9a9c0b4e-38e0-457e-b618-43f0796db090", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557100, "uuid": "f95af27b-5edd-4212-81c7-6350c1061248", "value": "File", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c157a0-304c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634586594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586594, "uuid": "b2d8784d-0a98-4de8-a0e7-56e5801b8e6e", "comment": "Malware payload", "value": "557e2280b31b538ba72bdb9d4a0ae05a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586594, "uuid": "211a5632-d1a4-4363-abd4-b501259a4c8b", "comment": "Malware payload", "value": "a34f1651b53b2a303c258b5fb5942791710e97c4adc842f038b1951ee3eb456e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586594, "uuid": "ddb399ff-7535-41e0-aacd-1cfa060ea403", "comment": "Malware payload", "value": "2634a9b2a43a9612f272bad0c1b18a8273129a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586594, "uuid": "781beb3c-7ad1-4396-a437-e5ecff7c8cca", "comment": "Malware payload", "value": "07194dfd0e115084c87d46c0859cc64cdb2a87be4191749ca17049b68801449ec3143bb7109ef20a716117c01b1c0121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586594, "uuid": "fa127571-edf4-4e06-810b-fbb970d112ae", "value": "T198059F2576848431D0BA2A7DCD4DA153A07F7D523AB4EC827DFD39885B3AA43347A2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586594, "uuid": "3de8f476-755b-4d9a-a0b2-4728a220c9d0", "value": "9d6254f1666ec7df9c70515cf5807dca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586594, "uuid": "7ca3565b-246a-46f3-a0c7-3a29d1a11613", "value": "12288:ngXbE33TJYei20w6R5ghlWIWeePOfzqzqyjFPKncY:ngXozJzix84eePzH56c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586594, "uuid": "279622f3-3f4f-4561-981f-39c97262cb05", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586594, "uuid": "ea4fb087-aaa3-4164-a34c-bb628c1c423a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586594, "uuid": "76470a5a-7a7b-49ae-ac07-9b911a5a3db1", "value": "Halkbank_Ekstre_20211018_082357_541079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfd14ba-2ff3-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634548443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548443, "uuid": "551a6d06-505f-4844-8fc4-bd19f9c740bf", "comment": "Malware payload (GuLoader)", "value": "451917c2e4e2a33472a77a038b69080b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548443, "uuid": "3c0ded71-b6cd-4b9b-90fa-94152f19cad1", "comment": "Malware payload (GuLoader)", "value": "a45b16b772f03f78b4dc14188e8e7de92e8efdc8c1625b298355073f4b461647", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548443, "uuid": "774a11c2-79c5-413a-8bde-e0b39967465d", "comment": "Malware payload (GuLoader)", "value": "147a13bf20af812b06a6f600bd5651f02d3cb515", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548443, "uuid": "e6d22b39-9d1b-4953-aa0a-ad743f02f2a9", "comment": "Malware payload (GuLoader)", "value": "018d58ac154d93c4171ec43e86bc9691c045f5515ea8d6bc75d7ec081157ce3eb0bb979a5a7409667eace4f46c3361aa", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548443, "uuid": "13dc9575-4221-4f31-ad38-ff374cbfd76b", "value": "T1CB74CFB82984C68EF4EBEDF9231E6800D80BDD11D218779BB2B03AD5EE345E935495D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548443, "uuid": "3dd37273-2f29-4153-b808-29ff72c222a6", "value": "6144:Y5TQ8VZnPAMKkrkc1xkANEnASS0ovlw1pvyMuFAA/V5fw8BIR2ubKnQm4/4/o:qfHIMKakmxkKEAStovApn+zPwTRut84A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634548443, "uuid": "fdf5fce8-a06f-4552-ade3-ba8276cd1006", "value": 351448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634548443, "uuid": "c49173dc-a462-4f2f-b3cb-c97482ff7aca", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548443, "uuid": "634a916e-d94c-4257-a6e1-b482afdefeaf", "value": "Payment Advice 00055000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb04026-2fea-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634544388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544388, "uuid": "49a1705c-540a-45a4-b98e-9af42517cd98", "comment": "Malware payload (Mirai)", "value": "a4ba371fa3d69d640798cb0e7da9907e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544388, "uuid": "5777d5c9-fea4-4ce8-83d6-dc449328d694", "comment": "Malware payload (Mirai)", "value": "a479b8b751ed3e88d4f3dbb9126462e1cde4db30c9fb292ab2aae8ed8180542e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544388, "uuid": "27580808-be46-4640-b805-1b31c143e07f", "comment": "Malware payload (Mirai)", "value": "0d41f2a47163e8c876f35f5d45a7dcab6c68114d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544388, "uuid": "2f4e5fc6-2128-41e0-939b-2106a5c43fa6", "comment": "Malware payload (Mirai)", "value": "bbc9b32c07356ebc7527cd663c302a6682aef4754dc018f13f6f44615efa44297c5f30233b94464695b735effaecbb42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544388, "uuid": "38b91481-d09d-44b9-bf57-859ab3675e81", "value": "T187635C366D7A2E26C1C0A47E11F34764B2E1278E3AE8CA1E7D730E0EFF55A5060176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544388, "uuid": "7ce423ba-d69b-4e74-9f7e-334db53b6faf", "value": "1536:MqeSAu22OLuSZXcnOS6lJys1kW10vSGUGEA:kWl6TP1kW7Gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634544388, "uuid": "c0bf5892-a7a5-4554-a553-797af69a33dd", "value": 73176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634544388, "uuid": "00a09855-1740-43f1-a1bd-9b4459eb4b22", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544388, "uuid": "62f8ddf7-97e9-43a5-a9e3-16172dc4a3fb", "value": "a4ba371fa3d69d640798cb0e7da9907e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b65c97-2fbf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634526008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526008, "uuid": "4037bacc-10f1-47b4-abda-7212ef326a7d", "comment": "Malware payload", "value": "d4560164e284df60e1c646f90fbe75f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526008, "uuid": "03d902f8-0784-45d6-9f40-2ffecbdb9017", "comment": "Malware payload", "value": "a59f1dbe0739e77453c406d7a9057b5f9f216fe5598cb12edaab9ff3d54d6482", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526008, "uuid": "452d545b-8948-40f6-9a42-6b40829bb5a8", "comment": "Malware payload", "value": "18cf43b53869a3045a3580bcd21146aed37bf937", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634526008, "uuid": "c440ee06-71c6-46aa-b80e-a866312b4b68", "comment": "Malware payload", "value": "a1c619c8e0474224b7482f258de84a701a1cce71537520625f2652c3853a2f8740ea82f3bf68ce5566fc8b48df569775", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634526008, "uuid": "d8e53eec-9980-4626-86bb-0c4b0d47a15b", "value": "T16D03F132974B9066C4B04CF6E5E9030473DD03B48CAB3116DB5A2B486DF76ED2BB0568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634526008, "uuid": "f2dbd771-5dc2-4d31-b676-448f9a965b35", "value": "768:jSnGKgWNh6a79rd2Zm7blvjLPMG7r2aLMX1IJkD+NQkUNTR3Ue8I:mnGKLhNBd2elvjJLMX1IJg+qWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634526008, "uuid": "4ddeae29-c7ee-40fd-86e2-90b65c31acd3", "value": 38520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634526008, "uuid": "675b9104-255c-45ca-8587-81b5db6193fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634526008, "uuid": "1d0cb441-087c-41e9-92cc-b92748847dea", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b678c7bf-302c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634572913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572913, "uuid": "ec038fcb-2e6d-4fe3-a5e8-01dadfe24ed0", "comment": "Malware payload (Dridex)", "value": "ec40302c6da1f3379ad2db586768b348", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572913, "uuid": "da798ccb-4094-41e4-bc87-a8dce3fd931e", "comment": "Malware payload (Dridex)", "value": "a63d5af0c6d5817dd92a3efad5233a75704268b37194f4a36765af2d753dbf6e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572913, "uuid": "6f3fde2a-4b7f-4acf-b6fd-f772dc506196", "comment": "Malware payload (Dridex)", "value": "92d1815b0a70b317ba2efd4d027500bc16e1fd38", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572913, "uuid": "cf88f788-fc60-4889-8661-37eece8e973d", "comment": "Malware payload (Dridex)", "value": "554f71abc2fe1770708f8143b657109ea5554bfb7306e0556acc5532f6f3e327c76f2a499c15d04da66367d18456a3dc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572913, "uuid": "3ed201f6-566e-4e74-9aa3-538bc904467e", "value": "T12004D128E76600C5EDDF0D7A130DF32ED4BA1D066341C5BDE90CE762A224F29A97E365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572913, "uuid": "e021eb35-2b9a-439a-884c-be7034e1b725", "value": "adb0dd6ace4ae202db9532637ae1959a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572913, "uuid": "3a45608a-278d-48e5-992d-68890ad8844c", "value": "3072:bOE9O68ciPs9BrcOgPqT7nWLTkpv0W270f0muemESB4:iE9/QMcvPaSLTkp/5uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634572913, "uuid": "fa5ce519-8626-40df-88f7-53f329a52751", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634572913, "uuid": "435f2749-d518-4254-9766-72f0f4cd46c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572913, "uuid": "66d6f3cb-b1ba-4399-82cb-61f7e7f1a3e4", "value": "7_docprop.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353e194f-3042-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582146, "uuid": "ee87f318-3a39-479c-ae04-16cbbaf9ca8b", "comment": "Malware payload (Gafgyt)", "value": "9f86b8b9cf40a44387852597d6307d32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582146, "uuid": "d1653cd2-48f4-446b-b7fe-c3b7e6f37e10", "comment": "Malware payload (Gafgyt)", "value": "a64f7450762a41d6504a5e15c991addbc56b6235e8dc1c64a0133200f29c2021", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582146, "uuid": "b28a811d-5e3a-49b5-a0bc-5d513ed5120d", "comment": "Malware payload (Gafgyt)", "value": "bb7ec581e9414a0136805c082cba5d904771684f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582146, "uuid": "3c7a02c8-a911-4318-b507-d6f8799ddfec", "comment": "Malware payload (Gafgyt)", "value": "77428a975420d9b552a3a43e7f577be420fb5a1a973ce91f530d4451044edce231ed80f002122a27418a7d69b86466c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582146, "uuid": "e22d0810-9fe5-4e86-8389-08f17c94333a", "value": "T179B318377B270E63C0CA147112D70732AAB5C6D938FA5397B9E06DAC2F16A843916FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582146, "uuid": "9b3a0b44-6eef-4341-b090-3c12ca868eb4", "value": "1536:RXYQ9M3NM5utzOftEjSphWdddddTJOwxUsVmYj1EPZjDbfKasj:R3M3N8sOfrphAPTVmK1EPZHbfvsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582146, "uuid": "c8d88ea3-1df2-4c82-9ebf-6819b28082d5", "value": 108147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582146, "uuid": "031832db-6b57-458e-adbc-69b1064048a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582146, "uuid": "99cb62d7-57c5-42f5-bd3e-cf9be5d86788", "value": "9f86b8b9cf40a44387852597d6307d32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d1c990-3061-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634595600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595600, "uuid": "200da043-7bbb-49e7-94c2-56ba13cd0a62", "comment": "Malware payload (SilentBuilder)", "value": "2669310752a5d9fa5f522d7c945f9183", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595600, "uuid": "0f9d97a3-3728-462e-a279-e8fda6bb92d4", "comment": "Malware payload (SilentBuilder)", "value": "a69904535a0c7b7edb7080638ba0485f8adba6d11a158c94388f4b281f0b000d", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595600, "uuid": "94d86c6a-382f-4e08-b261-ad1576c5b1e1", "comment": "Malware payload (SilentBuilder)", "value": "f5f7e5b58ddd11a8bdcea133671ffe1880bd8691", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595600, "uuid": "d93d1e9f-8ab4-49c5-90ff-8b2390811274", "comment": "Malware payload (SilentBuilder)", "value": "34dff4ca41f8e034017985f87df20a210378a5cdcb539c86879f68aee0be82408f8b21bd3dac930a61f4dfd4bc62ec99", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595600, "uuid": "63f52284-91b2-4fa2-9285-5d8ba9c1fbe0", "value": "T13C44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595600, "uuid": "f46da7c9-fdc7-4e85-8239-f384147f0ce9", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7I:U9jFrjmkD7IvLDK3vLvfn1+2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595600, "uuid": "21faad4b-79ab-4f6d-9c88-d8abc212b7e9", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595600, "uuid": "ca32a525-cb2f-4dc7-b57e-93a69910d3b9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595600, "uuid": "25cf438d-6be7-4376-a063-cf2462a0e00f", "value": "2669310752a5d9fa5f522d7c945f9183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03754198-3043-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582492, "uuid": "2bdab196-0da3-4835-bd3a-79e210f30431", "comment": "Malware payload (Gafgyt)", "value": "c4bd164e9cb56e429c0d837c40686f25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582492, "uuid": "6f73a32c-a996-4b86-bf16-14255c095b31", "comment": "Malware payload (Gafgyt)", "value": "a7794d1e377573c72384242c9ebb3066d5014fd5624c4861cab794defb8f44b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582492, "uuid": "516657bf-64b9-4daa-b284-3ce6ec115576", "comment": "Malware payload (Gafgyt)", "value": "575354db74f4feed767d7b1ad6f05513c7a95dee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582492, "uuid": "da47efb3-d230-4640-a6c7-9d3f274bbe99", "comment": "Malware payload (Gafgyt)", "value": "f83970513b15dc789e08e226c6527cd5e8bcf4faf12a1d9ad2158d45b803fa8c3558223674031354de76fe49724376bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582492, "uuid": "9af69a72-6acb-4eb9-9b2c-9757cb464085", "value": "T15FB30905F8404767C2D327B6F79F478D7B326AA457D733016A247EB02BC1B992E39960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582492, "uuid": "881a469c-ccd9-451d-9c76-226604709a08", "value": "3072:Q+/i/dRMVRyXhr5h2vecwr88niume3QQxXxzXToj:QTdRMOXhr5h2vebnRme3QQxXxzXToj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582492, "uuid": "a11159a2-b5b6-46ad-8521-c7fa195fcd0d", "value": 109594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582492, "uuid": "4df50bef-12ab-46ea-a735-42010f371525", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582492, "uuid": "f0c7d575-3926-4afd-8759-d9c90fb60430", "value": "c4bd164e9cb56e429c0d837c40686f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083173ea-305a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634592378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592378, "uuid": "5efcfe78-cc21-4743-8fcf-b90841b5012c", "comment": "Malware payload (Mirai)", "value": "f520a77ee5271e3d472a74e013d769af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592378, "uuid": "aa8a9a62-d8c1-4f79-9b1f-5456f2ad3517", "comment": "Malware payload (Mirai)", "value": "a87166e64422ecaa79d0111546ae1ad74bd6512ed90de17115e746e62ecad2c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592378, "uuid": "7821d817-27e1-4578-be45-c72a480c6e7e", "comment": "Malware payload (Mirai)", "value": "7fc717f444bdd91df61d3e4dac8402730f862754", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592378, "uuid": "af754605-a2e3-4932-a307-5f83cb124af4", "comment": "Malware payload (Mirai)", "value": "c12e86652c05abe248295dce691a93357b7b9682b7e2871c070e1affee7134777a5b63d33f768031114bdd723cf4092b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592378, "uuid": "00ebad59-c9b5-4baf-ab76-5a59a018f366", "value": "T145D3F802E5716FB7C112A97139BB2E640B19BD512F1F0996692DBBB0037F5CBB04FA24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592378, "uuid": "66b6ce74-9fbc-4ec4-95a2-f9f226e2108b", "value": "3072:clmhLS3MSx7k1M/zlXkyNQV3GN0siBZLm4M1J8zEiuuX:clmpSh9UM/zmO8GN0si3m4M1J8zEiuuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592378, "uuid": "0e73aa9d-a4ad-4488-9d94-8f0f76e3504e", "value": 137879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592378, "uuid": "b5c05583-ae89-4364-9b1b-ccbd8f795431", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592378, "uuid": "eb724fde-8722-4131-8608-b4d96ce357eb", "value": "f520a77ee5271e3d472a74e013d769af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a81ede-302e-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634573744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634573744, "uuid": "11902a68-a791-4bca-b9f0-07f1686c17db", "comment": "Malware payload (Smoke Loader)", "value": "003e691923293c72dca0b670e9ff9390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634573744, "uuid": "e9bb475b-42a9-46d1-bc62-01b3288a917a", "comment": "Malware payload (Smoke Loader)", "value": "a8e4f8648ff3dbfcf882b39d32033d3ca1f6fdaef9694107aba80f36a0480e36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634573744, "uuid": "aec80b21-870a-4267-81e0-775c54a87177", "comment": "Malware payload (Smoke Loader)", "value": "9019ddfe5e2bfea43005d59c34646ebde9d1f1fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634573744, "uuid": "4f13601f-82eb-4062-a9db-d855b8557dbc", "comment": "Malware payload (Smoke Loader)", "value": "3844ca8e1331f3e9eb2ab3eb0f52a5bd7a67be50d75c5dc28895b06b6b387da94affd5e1da413052aa3b0d4da9e2c49c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634573744, "uuid": "06df41ea-5c23-4b74-88db-7f2b65dc5c19", "value": "T1A6D2CFEABD6780BCCDAC80F398E706FE92CEA1B4B4460249D55D2A7679C137C807970D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634573744, "uuid": "b9ef3341-ad13-499a-88af-875d6d32b307", "value": "768:aOsIP7IRNWUlaMijihcIGfTAy95w5HUWCvgnvh5gG:axYfMmiokyI5HUWAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634573744, "uuid": "aa61172b-7468-4807-b74f-31c3cd51f9b6", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634573744, "uuid": "147c9ea6-6acb-46ad-8305-05c8580c98a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634573744, "uuid": "5fd7702e-50d9-4996-b026-347eca85741f", "value": "SecuriteInfo.com.Variant.Razy.537868.26927.14165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ca8c09-2fcf-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634533070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533070, "uuid": "b3cfde1a-3f01-4a4a-947a-d09e4175f33b", "comment": "Malware payload (SnakeKeylogger)", "value": "3371850350b649ff2c38c85c54e7ad92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533070, "uuid": "e32cacd9-d6dc-40da-881c-10cc4aaf0122", "comment": "Malware payload (SnakeKeylogger)", "value": "aae3a2116a6e013d9390eb5e5581a705bdd4aa26ebda99ef2e0013f936c34001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533070, "uuid": "96771099-3a2c-4d21-a5aa-b175a57984ed", "comment": "Malware payload (SnakeKeylogger)", "value": "90351dbd992060be62e790f2604f30bd1d695445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533070, "uuid": "afbcce45-0013-40a1-a591-b4768d447d75", "comment": "Malware payload (SnakeKeylogger)", "value": "146492cb37babd2d4e20777c8b1842a4b713bf83a346f17f4c9ab2b222d58afeb7dcc0593724ef882303fc30b3cdbc94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533070, "uuid": "e51f0822-1001-4d27-a38d-e30a5c13cf0a", "value": "T1721319047B2643A2D96A4AF3D5BBA58033F98BD58E5EEA00BDDC059D50CF10E9F27B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533070, "uuid": "4727c11b-bd5c-4177-a8de-a7d3589603fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533070, "uuid": "fbaf4900-730f-4575-bb5f-24b56647cca0", "value": "768:mlQwpo62G8V2D8MfjpHv4Rg2USW/B3I9c/tD/RPgSsJt:mlQwpo62xV2D8MfjdMEv/JZPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634533070, "uuid": "799d4515-c2a3-4f33-a2ce-225a47c77211", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634533070, "uuid": "9a70cb73-9382-41a2-bc04-0f873d301e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533070, "uuid": "fecf0e6c-1805-403e-9370-2b6045392131", "value": "3371850350b649ff2c38c85c54e7ad92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aac716-3050-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634588240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588240, "uuid": "f63616b5-3cac-4d04-ac7e-a47062b5ef38", "comment": "Malware payload (Formbook)", "value": "fa3d5b504712ac42e68f6c5d98598e1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588240, "uuid": "07abd268-0e81-450e-97ff-e2c77b245be2", "comment": "Malware payload (Formbook)", "value": "aaf0400f83fd271800e1f4cb50fab438958eb3771a6b6a9401c5fa66c1c5b956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588240, "uuid": "bf73da5a-a323-4909-ab0f-d70b940f1a9c", "comment": "Malware payload (Formbook)", "value": "a164c5bf7e2bb44ccece3d28ee4b7ae040c6f004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588240, "uuid": "390972d7-0b6b-4bd6-a44e-57affa669a38", "comment": "Malware payload (Formbook)", "value": "65d337533c85f83825c182a0f11aedf83ada84849c7e0e05ed5d3e602dbbd440c7e0e68d90ae4d46a61ade5c97947a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588240, "uuid": "941eb218-d736-4e75-8497-c83f9bed43ac", "value": "T126D4BE7CEE046A67D269D63CE49E0506F27450D733316E8711CB370D741FA8A3AAA39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588240, "uuid": "eb2f08bf-9b2d-4690-ae43-a122d54515b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588240, "uuid": "a1f73afd-b2f6-4f71-85d9-1520c099c49c", "value": "12288:ny3bU4N/HJRNwwC6dQ7HG+4FnjLlOhsxeHH:0fJrPZQ7HGhBpOyxen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634588240, "uuid": "15ad60e5-6687-480f-8ae1-8cf3d441c752", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634588240, "uuid": "1d219581-07d4-4254-b9bf-5c4811ec71d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588240, "uuid": "d45ec33f-7f83-4843-beb8-fad16e69df69", "value": "fa3d5b504712ac42e68f6c5d98598e1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fe0618-304e-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634587220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587220, "uuid": "602f05e4-03c2-4c63-97e5-34084a5f5d78", "comment": "Malware payload (Metamorfo)", "value": "698e4e722edc9bea04826ea0b36cfc99", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587220, "uuid": "0b0478cc-eb90-4acc-a4e0-0d6a90e1cee6", "comment": "Malware payload (Metamorfo)", "value": "ab8ca85b3465e12c84b62bfacd66e851fb0d86574338226cf11a619405f93c4b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587220, "uuid": "13f84482-6d7a-4dd3-a5e3-38ab464d9d22", "comment": "Malware payload (Metamorfo)", "value": "93cb2881ebc1e452596d6e2b3f16110e0bc72f45", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587220, "uuid": "7f2e77b9-3cfd-42ba-b476-0b80d02903ec", "comment": "Malware payload (Metamorfo)", "value": "373142fb7d4cbaa93c14a2c4e0f29a6ea2330264803f96ec1c7b159c7a0a58b5e42ed65e91f34fb419c85f91463e7107", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587220, "uuid": "092853cc-b0c5-4bbf-b034-946c85a11405", "value": "T1FB41FF041EE62329C3B3CF3628FAA2468EBBBD51AE534F5E8084438B1851580EC31D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587220, "uuid": "02111553-c418-427a-81fd-feae2851c9fe", "value": "48:8+uH+M+LbMYGnIfpa6EL/HlTHGUQe1cIXv3KaIqiHkb6NS6:8+ueFLbBEzFTHGS1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587220, "uuid": "93ff9b5a-c77b-443f-b611-2b2d4a50626b", "value": 2052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587220, "uuid": "5d912185-6b01-4dba-9238-f933a52dd653", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587220, "uuid": "6449f255-1f82-4287-998c-1139b7c83df3", "value": "Anexo - 18102145782.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb5c981-2fab-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634517442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517442, "uuid": "33d33e86-ab8d-472f-aaab-df7ab77cc1e6", "comment": "Malware payload (Mirai)", "value": "6f5e0968a7cbcb56f79c2133974fb69c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517442, "uuid": "52d13533-88ef-4bbf-b4ed-0285cc68f88c", "comment": "Malware payload (Mirai)", "value": "ac1eb76e71a50ff6f1fc0f2c44491f079b73d7e603162c9b7e40a93b30a4dd1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517442, "uuid": "175765b3-2e87-4bc2-9795-11d30733ea48", "comment": "Malware payload (Mirai)", "value": "4bc31045b9db05c02cf8aa5f265e20ebb1c3b512", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517442, "uuid": "841d810d-6154-4c68-b5a5-9315f9a71909", "comment": "Malware payload (Mirai)", "value": "5ef0e9c00526efa0889e34815e035232b4d539810cc9ec3a2d9f9215ebe77a4609eb12d771090a95c0c533002d566f6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517442, "uuid": "c46fe131-0d91-461c-bf9e-eb585f2c995f", "value": "T13A630852B8818E15C5D813BBFA2E018D33126778E3DFB2169D106F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517442, "uuid": "e42c472c-618c-4076-9dce-9e12d08b5c69", "value": "1536:StnwsWjjS5+8hEWZc+mQM4fJL4Okw/RqO1do3YpPz9I5iY5UJ/k:MWjA+QEWZbbZx4OjcO3o3H5UJ/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634517442, "uuid": "0583efbb-82ee-4d4e-b2af-23a279a36822", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634517442, "uuid": "deaf8d4b-e420-4a55-aba6-f38b26654fb9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517442, "uuid": "85adcb1c-b15b-4e0e-8d7c-3b73b7f4a2b1", "value": "6f5e0968a7cbcb56f79c2133974fb69c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330f5981-2ff6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634549500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549500, "uuid": "5266a921-1fbf-41c1-9ec8-d245ac56e71c", "comment": "Malware payload (AgentTesla)", "value": "b03c62beb813436c42e00544acd49bdb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549500, "uuid": "3480dfcb-a8f0-44b2-804f-94478e141e2e", "comment": "Malware payload (AgentTesla)", "value": "ac8b2c0172a6ebd98b661af827f42d283df366866d22817180922b64dab795d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549500, "uuid": "ad67ecc5-4916-4544-94cc-f62d8d5ea81c", "comment": "Malware payload (AgentTesla)", "value": "f7e4c81eb07e29943dc270f4323c8a105a9d459e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549500, "uuid": "2080aa30-01b6-4dcc-af61-628f3262c66a", "comment": "Malware payload (AgentTesla)", "value": "3a92b24a803e2ca2f8ad726288f5478d446dcff0c5962a506991fca84bc43046eff1f4ddc3b77f3571fbe94f8a8085e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549500, "uuid": "a157df9d-0371-4dbd-9529-e37dd2e80ac8", "value": "T17555B317B342B80FE25B853340E418E3E10665E7A609C366A6737EBB559DB808F487DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549500, "uuid": "f5de9ed2-102e-4516-b47d-6191aab9ae16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549500, "uuid": "1248f62c-757c-4d39-9020-df40bb5cf92a", "value": "12288:PHLwA5XPo7/fBSkkkkkkkkkkkkkkx9L+kIkkvkkkkkkkk7ZLyszVNA87b8CoirI6:PH8A5A7klIGs087PoitB+JS6afj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549500, "uuid": "7c2b08c7-2d1a-4dc0-bbbe-a561170ddd16", "value": 1373184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549500, "uuid": "46efc2f2-491d-4cf7-b674-05d5713dfb1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549500, "uuid": "5455326c-ca42-45d2-89b7-f892387381e4", "value": "210706 RFQ of New Project(Yuanfang W339-25)_Rev1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4984e869-3064-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634596782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596782, "uuid": "5316b389-f3e5-4e99-9f1f-736ae4992008", "comment": "Malware payload (Mirai)", "value": "2de4b07d1abd4d31ed5a2328a48f2f13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596782, "uuid": "3a59f38f-75bd-464c-bc82-b623782a0cb0", "comment": "Malware payload (Mirai)", "value": "acba1125ee83d8b3f4950d4011d52952458a6ef2b21a19dbc33c4a9e2c8be8aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596782, "uuid": "27d65c8b-1bfc-41fe-aede-5f52228a29e7", "comment": "Malware payload (Mirai)", "value": "7ad30a4a187b15bf58756fba6e8e1036cf884f11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596782, "uuid": "599b154e-a205-4a0a-a21f-d7670ee52d16", "comment": "Malware payload (Mirai)", "value": "ec7c53745982be835ae6c6a1097327e33722468299fde8afecf917949b8f6844374916e48e5c17efde1f2d4a74dac4e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596782, "uuid": "8bf40fd3-20ed-411e-81f1-982554688b31", "value": "T10D833782F9C1AA12C9D55B7BFA4E018D332753ECD2EE36138D249F62379F52A0E67045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596782, "uuid": "0a608f24-0c9f-46ef-a5f9-abc194bb89b8", "value": "1536:4F1bd3OnLKVKXdkvIT0ttOSovxT1V43j9FrKwNxK2U3b0fjvGllj:mp3OneU0Xhov5jwhFrKwNI2U3bkGllj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634596782, "uuid": "14847ef5-5b1c-4ca7-8659-c658f96edca1", "value": 83232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634596782, "uuid": "c1e2cebf-df1d-4c71-9710-37b57a6324db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596782, "uuid": "d4633bcb-ba8c-4f82-95ca-70f19b21f33d", "value": "2de4b07d1abd4d31ed5a2328a48f2f13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5302a021-3007-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634556855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556855, "uuid": "84195eb7-8f88-4018-85db-3bc066c70876", "comment": "Malware payload (SnakeKeylogger)", "value": "a37e7dab62e1bc27058e90fa26bd5e60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556855, "uuid": "bb2b7dcf-b280-4c8c-87a5-3d56130b4e91", "comment": "Malware payload (SnakeKeylogger)", "value": "accad8825cb1550525445007a28a4d2ac8b5db15a6b403d78a4177262a1f681b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556855, "uuid": "86950a59-2dbd-4102-acfa-3449c1689e5f", "comment": "Malware payload (SnakeKeylogger)", "value": "8e08ca884b5490b9efc9f7cc8b2408eefbf96338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556855, "uuid": "2f10141e-44c7-4667-878b-7786d52eda3d", "comment": "Malware payload (SnakeKeylogger)", "value": "041ccacefbc029e1d02c989d4bd591948d8588d8e843904fd1f2189fa05c30baf4c47b0827af189022fb372b9930da55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556855, "uuid": "f24e74af-fe73-4bc1-9df1-cbd6daebc012", "value": "T10F73D8017E046689C4920C7901F259D1A3784DDF8E9ACE3779E1B73E78B3664AE0793D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556855, "uuid": "bff7a25e-b9e6-4e6b-927e-96334c6f10a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556855, "uuid": "6218fb30-ec89-4557-8225-a3030a34afe1", "value": "768:spwNDD9IULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0cv:s09IULFMAAiu6JL6oNsgFAyox0cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556855, "uuid": "c4fc445c-310a-4ce7-808e-cc8c5c901651", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556855, "uuid": "6a8a21f0-b943-48e5-b846-4ff67374e317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556855, "uuid": "f7769a91-293a-4bde-b3ad-2e23d125e553", "value": "a37e7dab62e1bc27058e90fa26bd5e60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6434585e-2fc4-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528108, "uuid": "ea5203c0-12e2-40a8-bbd2-e247fdd26bb5", "comment": "Malware payload (Gafgyt)", "value": "012ee05b4cb274dec44b10d8d5a9f1f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528108, "uuid": "0e7c8f2c-19cd-48ca-a6cb-6c09f123cc95", "comment": "Malware payload (Gafgyt)", "value": "ad543c6b6f13b4f9fbca129a625178dd9b175e115f52551b4e9c78dac77641eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528108, "uuid": "f963eac4-9f8d-4ba1-a390-46331240311b", "comment": "Malware payload (Gafgyt)", "value": "16effe689ee1f269f804749201b78e9174f35d96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528108, "uuid": "94886c9b-152d-4d75-99e1-61562a2b1620", "comment": "Malware payload (Gafgyt)", "value": "8396fa21f8ea62859aa266d955e88b051e39a8ff932a40a6d9dbfc4d02231c0bb372cf709ce6bf3d6bbdbafc8d9ef796", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528108, "uuid": "28fc2e0f-8bc0-45d9-8550-9d9684da5a63", "value": "T1F9E38266BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528108, "uuid": "45ad1ab9-7c35-46b7-bdd7-864ef3bb565d", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVppLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflfgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528108, "uuid": "2b87835f-3b22-4460-80e1-d68fd57d1fbd", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528108, "uuid": "dfd743f8-3c00-42ab-b268-6db7d3f23c38", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528108, "uuid": "c1d58e02-ed53-41bc-a9ea-16f794855dd7", "value": "012ee05b4cb274dec44b10d8d5a9f1f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914129f4-2fab-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634517446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517446, "uuid": "30f81a2d-6a57-4589-94b8-d565bd9c9914", "comment": "Malware payload (Mirai)", "value": "53c4f24e4c22450348cc232ef8f3fc44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517446, "uuid": "70d6978d-d937-4282-accd-0cfaabcf1e03", "comment": "Malware payload (Mirai)", "value": "adcc82947b72bf8614f8072bd6b90892d10ba5d428c6e972904395960462ea00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517446, "uuid": "a984d2e8-6eaa-4d4e-84c4-cf86e89def68", "comment": "Malware payload (Mirai)", "value": "db7dc68492b36c4c56df49a0075b2f183edb7922", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517446, "uuid": "9a11c816-4b8c-4b0c-8669-c4ac9f2309c1", "comment": "Malware payload (Mirai)", "value": "f6e8acb45dd3fcdc532caaceea8310fcf315d9ea09b4c539b19fc904ca8b92df8d42cc404dd471a30fa235c74b95fcad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517446, "uuid": "75a7d243-941d-4c8e-885c-bfb5bd323dd9", "value": "T12C435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517446, "uuid": "4d04344b-7cb8-4605-a707-dd1e47900668", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczEppVuz2GipH6TnSgGABJ:ybUg1Jgzz4Cqu1HFsi6nSgG8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634517446, "uuid": "42d76a3d-19b2-4a1b-936a-33cdfe77a46d", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634517446, "uuid": "fc7c800e-39dc-412f-b524-accb1cb585f3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517446, "uuid": "372b88e7-9e70-4f77-9825-18f076b68dd9", "value": "53c4f24e4c22450348cc232ef8f3fc44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8404377-3064-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634597049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634597049, "uuid": "8463eddb-8047-45b9-91a4-0db7f3e4506c", "comment": "Malware payload", "value": "c048209154042d9ff5514cfd008df4bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634597049, "uuid": "a63cdbad-50a2-4724-aeb9-a1668e727c11", "comment": "Malware payload", "value": "ae0f20124bf7ef06bf7eb4de7243ef4cf08b6523b791547c5f9f106f565b4366", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634597049, "uuid": "a0228086-709e-4ffc-8f74-f1a9a58bcd72", "comment": "Malware payload", "value": "a51cfe496eeacc2cdc18a5bee96e0103a7814853", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634597049, "uuid": "da795770-ebf0-462c-8d87-58b402c547d7", "comment": "Malware payload", "value": "57728031f90c3762aeb5953d05c6f9cf6ef48a0fded90324c970b4d2c8c1d6ebff9446ed392539fb5d034a1e1c599262", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634597049, "uuid": "754ba175-dbd2-446d-bbc1-07200185ccd5", "value": "T1C2659E11F742A036ECE3017386FF4AFF8D28A621034894D7E3C45DA95A619E27B3765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634597049, "uuid": "28f31499-6895-4729-a89a-ef3a3548093a", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634597049, "uuid": "11f778f0-d81f-44ee-90d1-9bcfc97d0d22", "value": "24576:PxpXPaR2J33o3S7P5zuHHOF2CxfehMHsGKzOYCMEMfX43Z1oI:5py+VDi8rgHfX43Z2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634597049, "uuid": "7f734326-3958-45d0-9403-ad3406df96e1", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634597049, "uuid": "a1ede341-2a58-4044-8fe9-b54a2dac9b15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634597049, "uuid": "d556eb3f-161a-46fd-a104-fd4295ba33ab", "value": "c048209154042d9ff5514cfd008df4bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6501fb-3023-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569036, "uuid": "a7cecb3c-f026-404b-acab-1f2b70677ae6", "comment": "Malware payload (Mirai)", "value": "9ed83558ef5a109b36a38572bfed222a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569036, "uuid": "4ad0f402-8f19-4f2e-8278-0622f7b1b045", "comment": "Malware payload (Mirai)", "value": "ae2d919187bdc360d67bfe6b732d486efda438de8358f7265b9f60ebeacbf4a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569036, "uuid": "8ab58084-3e6f-4050-833d-ebbf20bb67ae", "comment": "Malware payload (Mirai)", "value": "189fcd682147398695288e8dc8a72015df03c038", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569036, "uuid": "fcdaa802-0a37-4fe9-bc22-7caf5792181c", "comment": "Malware payload (Mirai)", "value": "7c5284eb89b2a79fdb294fef975a8bf37451caf58c1ca25722be703abbc5bdbfa0884f2e9d328b8ed6946bf98f26b27d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569036, "uuid": "6eb05588-d684-4ab5-913d-9a7a386b88f8", "value": "T1FD932946B8828A56C5D413FAF92D118E372263F8E2CFB112DD111F3477CA92B0D67E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569036, "uuid": "6f2e9bdf-8e89-44bf-8894-75060577aefe", "value": "1536:vgNnSSiUEFhV4ptUf+Igiarvcc/0zvNUiV6EClXy4enxM+ieUQxnz2qd42+:v6i7gpt7nv2WiVPVUQxnz2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569036, "uuid": "106f3c04-af30-4cc0-b2c2-5726c7ccf73a", "value": 91368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569036, "uuid": "e78ab4c4-b4f4-44f1-acf3-a9f2930db6ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569036, "uuid": "1bffadbd-f9b1-4326-87c6-16bbed6c39d9", "value": "9ed83558ef5a109b36a38572bfed222a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103c1fea-2ff1-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634547294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547294, "uuid": "9c3120e4-168f-4778-97c1-07dbe548a42f", "comment": "Malware payload (Loki)", "value": "515f7da0562307df4c9354d5d5486e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547294, "uuid": "f4cc5ce6-62fc-4dd3-8355-a431bd732f3e", "comment": "Malware payload (Loki)", "value": "ae30c77472bd494b2116c5ef0fc7bedc11fca5a57c4796e316333d95ef61f437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547294, "uuid": "a9739e5a-c4ea-446d-b482-0ced93d71ed6", "comment": "Malware payload (Loki)", "value": "e18acee85cfa4728d7a8103a30b23f6bf2b8b3b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547294, "uuid": "f715ca1e-1641-4e8e-ac81-b94948bc3323", "comment": "Malware payload (Loki)", "value": "dd8109a41e9bddf079e68a65537c6487c32ea2ba78f38efa364f7afd1379c5aed8bad1762f63d74080b5e257dea54d9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547294, "uuid": "47e57dd5-965f-4b36-ab95-d463dd76aab0", "value": "T12544127671D490F3C88218F026FAAA3856F783145252FAAB57E09F63766E7C3500F396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547294, "uuid": "472964d1-268f-4193-94df-d11497194aa3", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547294, "uuid": "562c1848-b53c-48a8-a3e5-6bb9c6ac20d7", "value": "6144:yBlL/DXCB2O/sbRmS8EIOAv9YlEuc7AUsDGun6SG:4hXCB68S3Ixv9Y6sDGmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634547294, "uuid": "04160e11-9fae-445e-ac17-899d24f2bb65", "value": 255208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634547294, "uuid": "0e511b16-f967-4ede-8256-e0d27feb706c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547294, "uuid": "ddc1d9c8-e5ff-4f11-8904-4dfd917b1cfc", "value": "DHL Consignment Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2d5a02-3006-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634556686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556686, "uuid": "44cede12-71a3-43b8-92a3-a554f18c1315", "comment": "Malware payload (Formbook)", "value": "0fa7e8fbae34d439551872a7aa9fbd82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556686, "uuid": "2f4526a1-b7f5-4685-a1a0-00db2133210d", "comment": "Malware payload (Formbook)", "value": "ae96332ca43b0c594a1c8c81d26c14742eca1c15c290901772bc4ae29c530f29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556686, "uuid": "b48407f1-8484-455c-b977-f0e827e3c473", "comment": "Malware payload (Formbook)", "value": "f031508962597a71ef21489dd14589e5dd5761e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556686, "uuid": "944d9f8a-af44-4424-bad8-7c90562f0758", "comment": "Malware payload (Formbook)", "value": "d74dc7de4319f70f566f6f5b31e959ddf6923118eb4291521a22ed5f4b757337761d9066cdbf5f69a7d97fe012fa1709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556686, "uuid": "e2c47244-0c51-4ed4-89d4-c86d896324d9", "value": "T1E98412423794C963CB2906BAC0E2E3681B75B8213F53E74B6E8B38DB5D777005D90A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556686, "uuid": "ccd94979-34c4-4a40-b35a-63b85f65898c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556686, "uuid": "5229fad3-fd07-4daf-b83f-270c00b0e592", "value": "6144:CnugQQdh9w9+D8rnAtYGnAVivZ0Q3eurGjZOnZt1Z5DqjaS+Y:WugQQdh9w9C8rnQYGAabO6iZGZ5jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556686, "uuid": "059b5d34-cbb0-455c-ad9c-59edf23d9df9", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556686, "uuid": "112b5d92-5a7a-425d-abc1-664778d5c7ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556686, "uuid": "2a5af3a3-7d35-49aa-b73e-62d31aaef411", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4dd727-3057-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634591447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591447, "uuid": "2d3f63e3-e1b7-4dcd-9b72-45d8eb457065", "comment": "Malware payload", "value": "6beb56894205d142c60df85d97fa866b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591447, "uuid": "950e7544-64f0-4788-b46c-4c87b004cc8c", "comment": "Malware payload", "value": "aee98ad0f93a84cb1e024f39d76d2d65c43b9f1cca8bae1eaa3983aaf7a1b99c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591447, "uuid": "98a546d7-70fd-4e20-a9c5-f8743c1af759", "comment": "Malware payload", "value": "a669447e629d491e50a1fc5ef6db26fdf16de554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591447, "uuid": "e17c6e46-838b-4093-a77c-f4fc513a91ce", "comment": "Malware payload", "value": "561169140d41168f92e35baa39b97f3dde3138664ed3d3da023b34753c8831af47407edb9d50d2e2e8c45c6e754a66e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591447, "uuid": "d0d93644-4a2d-4d44-aae4-66792df0c9e5", "value": "T1299533AF8B66E4C3FE03A9B16C8B650B0D56CB8FEC6F77C5A995CCC04A93410D5016AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591447, "uuid": "f28dd839-b784-4be5-bab9-0b9dce508969", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591447, "uuid": "1ac4f12a-1499-4961-bfeb-edea37ceef95", "value": "49152:6yC6aZGCmi5Vfa/FayNpb2P5egZtieOIiCYGcfRAhHQ9U7i:6yC6y7mi5E/dbuxZtEEqSW9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634591447, "uuid": "c26e15bf-766a-4074-a14e-6666bc86d624", "value": 2016944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634591447, "uuid": "8d1f72a4-4091-4ade-b4be-3265929a4ca1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591447, "uuid": "e53b90e6-838b-4de0-be08-8611051d30ff", "value": "Valorant legit hack by Spyro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81d3ad1-3027-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634570822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570822, "uuid": "c7bf4efb-943a-4c96-af87-7f6dbe59b90f", "comment": "Malware payload (SilentBuilder)", "value": "13f39a45b6aaed491831cc73e7134656", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570822, "uuid": "1ad773c2-eeab-4660-8243-cfea329d9d88", "comment": "Malware payload (SilentBuilder)", "value": "af0233b934e0909b512759c7ece463b520b08c68ac0e33200e8ee258120ddb67", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570822, "uuid": "479dfdd5-6b60-496d-80a9-ff62fcf8e970", "comment": "Malware payload (SilentBuilder)", "value": "4f08398ffe6d8730e03242f555056b7868d437b4", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570822, "uuid": "f05010f6-38eb-4315-9228-0aa8d0d524ba", "comment": "Malware payload (SilentBuilder)", "value": "4c4c0c3a2630ee633680a0ff2faffb7cc5f6d34d19e4a6ae911d8efcb37d7faade6f97048eff24c4479a6909a92e5a63", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570822, "uuid": "e54ac299-b750-4907-a425-f1ce2a779031", "value": "T18244E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570822, "uuid": "dd3250cc-df45-4962-bfbd-223906b941c9", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7K:U9jFrjmkD7IvLDK3vLvfn1+2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634570822, "uuid": "c3faf6ba-6cc8-4a70-bc9a-3e41de197973", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634570822, "uuid": "548feb3d-04d4-47af-a400-f2bb2465d038", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570822, "uuid": "2858ef6d-1aa3-4fe0-a3b9-4b6e5f5c2973", "value": "13f39a45b6aaed491831cc73e7134656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358ef153-2ff7-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634549934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549934, "uuid": "57ec87d5-8266-4bf9-aa1b-7276ddead78b", "comment": "Malware payload (ArkeiStealer)", "value": "531576d42fac0f02c88fdc36714d3d1c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549934, "uuid": "9cacfe38-2e12-4d04-8963-7afdbff27e22", "comment": "Malware payload (ArkeiStealer)", "value": "af731db3ff0accea3ed49292d5aaf903ea530de823197fd3eda5e21830c49b8d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549934, "uuid": "3dbe8118-4a34-4abc-aa1e-3bb939bda3d0", "comment": "Malware payload (ArkeiStealer)", "value": "b792e083daa495aa9474e8fca8e885a6eef6b263", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549934, "uuid": "13651ecb-57cb-4e7e-9b65-ddc699ce4cab", "comment": "Malware payload (ArkeiStealer)", "value": "fcf050e04ca3bd4c8de84b28b9d97bd84f46df84bd883cc8b326970c96df741a1f8545ebe609d831b515511f8c74276c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549934, "uuid": "8aa60b33-2e86-4839-8fa5-a15b459f104b", "value": "T12343AD01FA4AE915F399A0B02EC3C6C5772ABC4D9D92A32732617F9FFC359B00A11706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549934, "uuid": "4c9ccc8e-f154-49ec-b7ae-836bbe3a5bbc", "value": "768:UAcUdkarMdzkx0EHG+Mo66b7Dt5cxJdo8rGoAy:UHikhRuzv6wD/cxHoIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549934, "uuid": "efc53d17-1f41-40a8-a870-299162b2fdd1", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549934, "uuid": "ae735265-ff09-4c1c-a4c8-767c398bf149", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549934, "uuid": "cdc1a602-f168-4bd4-9da6-f5505d69c500", "value": "Invoice- 9452729 Oil_Field_Swift_remmitance.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8797079b-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561238, "uuid": "bd9772f3-8ac6-483f-99f4-e4edb9beea03", "comment": "Malware payload", "value": "99b12957fe462758bb4d9a96bc4b00a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561238, "uuid": "99767a14-f741-40a5-a8bb-50f21bcf0710", "comment": "Malware payload", "value": "aff35c55dbec9ab7f9a31c84c20a3a42630f72db70bfe5f5408f9a0eeb8649bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561238, "uuid": "c350e2a3-9c23-43da-9b51-887c54d0bdf9", "comment": "Malware payload", "value": "fdf44b7fb1b86ec1dee9d66e2cb117ad37ea0ec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561238, "uuid": "2ea3caec-36e6-4301-9a22-1d72d669c2cc", "comment": "Malware payload", "value": "6ec1549306182a7ad850b5ebbfa91a6de3302c407ae71492109b8ebda6a1ed691bb9da4d1ae44598c0e766583190532d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561238, "uuid": "5923ee82-0602-4fdf-8009-c2ce1bb85381", "value": "T14094F101B2688F22CDB553F5403D919307B66D3781A0E19A1ED5BCCB3E79F82922DB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561238, "uuid": "303df9a9-2151-426d-be1c-5ae1da9a9f6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561238, "uuid": "b3979385-1410-4a1c-bfbe-643e07540c1c", "value": "12288:YWrf4GtEB1/SMxcqvedvqHSTzdu1VAV/sW+jeToIkBiji:YWJEjfxXveV0STJuksWTL1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561238, "uuid": "8c5a2c7f-4aef-455e-8757-9746726280ce", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561238, "uuid": "ec6f6fe1-0d56-4c29-84f0-cedcd0cfdfd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561238, "uuid": "d87e83fb-f632-471e-b4f3-c309c76fc922", "value": "Scan Receipt 0007008122.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10141b0-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568609, "uuid": "e5a78a9b-97ab-4d8b-8f28-d9a14fb98367", "comment": "Malware payload (Mirai)", "value": "dbdd6d284dab9e56caee96a325da363a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568609, "uuid": "feda5f01-4ba8-4228-a29b-3b5a5e8e1f67", "comment": "Malware payload (Mirai)", "value": "b0026617ef8165b7f7301f783cb9944832c2b696953d650635f76374418526e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568609, "uuid": "dfac09bf-105b-4ba2-9418-bd54756611e9", "comment": "Malware payload (Mirai)", "value": "a2334676508cb5bda0b25dc8e90a53a11836ce5c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568609, "uuid": "39048d1e-7909-4abb-b01f-6b91d557ac4e", "comment": "Malware payload (Mirai)", "value": "524421d2291d3af15d2aaa819e4346fe86c3a7d8540e24b72ac24a8e80c58efe4b983a919f722dc327b9a8c067481dfc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568609, "uuid": "baed557e-5b20-4787-9794-bcff3abbc2a1", "value": "T11B630237C800B6A3BF2119BB693A42C2B7354EB5016932E75A781DE8BED706659BC047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568609, "uuid": "7528e8e5-490c-437a-89ed-f26793ee1aab", "value": "1536:ITveTVAsxhRPYcaJCy155WGNND6iLk8fDFTR+zQs3auT:UG5DPRPYcawy15f/RLTFTR+UyHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568609, "uuid": "700f45f6-af39-42d4-9ce3-2a2a8ac7c932", "value": 68856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568609, "uuid": "64f1552f-fdb3-4dfb-82cf-90b924c58008", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568609, "uuid": "e6972fe5-f310-4bf8-881b-ca15cf7a35c9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed64bf9-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634561063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561063, "uuid": "7ae5c9f4-a6e7-4090-98f4-9abea47e2aef", "comment": "Malware payload (NanoCore)", "value": "d41623f500bff32c852bd5ec139684df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561063, "uuid": "63239614-1376-43ab-bbb7-68719817870f", "comment": "Malware payload (NanoCore)", "value": "b10f498f823b8bb942232a025ee9376375d4479608658b91608096331688bc95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561063, "uuid": "37fce855-4851-49e0-85e5-75548b872479", "comment": "Malware payload (NanoCore)", "value": "8bbb5ff29e298e9177ef97da9d35e49224b574ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561063, "uuid": "e77522cb-d5d4-4b45-b4dc-13a84b749e1e", "comment": "Malware payload (NanoCore)", "value": "d21892f3f1d90e6ee5ce2b9b7e6d4765b63cc2be3a8e9ee01f67cba843f502c540a4dc46bcaa5f4f3474cdfd272bd6b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561063, "uuid": "d2e55b55-efeb-494f-93ef-6063ac6bd715", "value": "T1A19412163388C267DB29027590F1ABA02B71E5326E56D75B2FC634EF1C7B7442E80B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561063, "uuid": "b147fb99-7090-428c-a75f-0b50954df5a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561063, "uuid": "6b7e9991-492c-400a-a7bd-f5ca949a7f86", "value": "6144:GlYiFRIM4/8C6uJk07oQ2g+pYSa1/Fe+y0QWSoWQx4sahloJ/vcFTHV4dB:GCinIMMH6uNooYB0RnCJDoJ/0FT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561063, "uuid": "2f433bb2-61d7-404e-9915-4d72f6ecfd57", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561063, "uuid": "9ca01b48-7567-4187-9c8f-d4b9bd2d62cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561063, "uuid": "d269de0a-ba32-4c0d-9654-9c0fdc34b87c", "value": "My Resume.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e20d59b-304b-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634586187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586187, "uuid": "209fbb07-a810-4e71-bef6-a235e0246c54", "comment": "Malware payload (Metamorfo)", "value": "8092f843c4b77e140627465c132a5c1a", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586187, "uuid": "f2f5eaed-c3d2-4905-9b3e-a64df313b4e0", "comment": "Malware payload (Metamorfo)", "value": "b1fa7f475f173abdda355f8b07e965ea45348da1edadd4d81a0a5cf099c7df05", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586187, "uuid": "1b4c1936-9b43-4400-a3d7-4dac90fd6777", "comment": "Malware payload (Metamorfo)", "value": "c501e1d13d1ba74770ba1c0b18c26965c4d5a447", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586187, "uuid": "b367e4fc-d258-44ee-8d48-3e99d9ffca9f", "comment": "Malware payload (Metamorfo)", "value": "90fe2c34051028153055be120321c7ddce768dca074abe6473b9ec0db8bda6f9dcf23b47b155563d8187fe000164df18", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586187, "uuid": "55335e00-1551-4e0b-bf45-8f547f6784ea", "value": "T17741C30419FB0329C2B7CF7624FAA1898DBAFC51AE934F9F408457CB5861190ED36D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586187, "uuid": "53010640-0ea0-4921-8f65-1013c07141d4", "value": "48:8+uH+M+LstBc7jFX5e1cIXv3KaIqiHkb6NS6:8+ueFLstwXg1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586187, "uuid": "ea41a833-02ee-4f00-91eb-c9adc657b44f", "value": 2056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586187, "uuid": "1250ef68-332f-471e-bc5d-57b0e6d7e55c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586187, "uuid": "e8a27ff2-a86c-4c86-b567-9d57d80ea742", "value": "Foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d415d11b-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634542039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542039, "uuid": "0a02dfcf-bd3d-4337-9e43-90b831694b18", "comment": "Malware payload (Formbook)", "value": "71302ed111a77e0a4ea1b7e88443771c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542039, "uuid": "76a14aa5-e8a0-4ff4-8b69-81ab5a192ecd", "comment": "Malware payload (Formbook)", "value": "b2c3f7a700072b93747169f7d0b90b39d44c1089f64ede59a8db55eab4fdfd69", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542039, "uuid": "0a3bcc99-4705-49c9-bd6f-20680861f6b9", "comment": "Malware payload (Formbook)", "value": "035707574afb4e7176b16e23cfc56184c8cf670e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542039, "uuid": "4d6e95a8-6b3c-43b9-b75e-396fa3b5d686", "comment": "Malware payload (Formbook)", "value": "6ddc25bba50b9078960e14c2d553b25c61406e310e15c40efdd1dcb2b20a3e4c396961795984a51e67bf13a494884997", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542039, "uuid": "6108cd17-2d42-424d-92a3-a23a328727e5", "value": "T13C25AEF875047CD62A6F576BDA96ACDD13B627639ACBA4CC4068B7C305A3375EE02C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542039, "uuid": "a3323ba0-46f2-4ae8-864f-56d21fa5305b", "value": "24576:ta05R8khiZqtiH+jZGPW6CNAiry8RzAr+VTgI+J55Nhz:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542039, "uuid": "5327d62f-a9b4-409a-bd06-473f04035cd4", "value": 986394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542039, "uuid": "84ab747a-b2a3-483a-a417-bbca00ed0148", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542039, "uuid": "760fa997-a00a-416b-bf71-930949f27bbe", "value": "PO-33120.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d890a8-3028-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634571171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571171, "uuid": "c94f9972-0544-4c05-8363-35ae7b903e9e", "comment": "Malware payload (SilentBuilder)", "value": "fcf9de6af65858b0218dff53651275e6", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571171, "uuid": "02e97230-fde4-4a20-8dc0-afc04e38b729", "comment": "Malware payload (SilentBuilder)", "value": "b2d4134bcc1525b87dcaeb6730450726d2f0846e06d33893fc8e84b7367d318c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571171, "uuid": "754e9563-8d2a-4f21-9cba-b6e032eefbe5", "comment": "Malware payload (SilentBuilder)", "value": "9172af187c13029aa3c96b93f99b6a3eafe57ec5", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571171, "uuid": "724b5f71-357b-4c7a-9dde-44e025e8580b", "comment": "Malware payload (SilentBuilder)", "value": "6424c2a3ffcea1facd7e78a6d12e91a44c0f0ff79ba93441b7d6c19bd524208e385a0ca7ef1e0bc91b20aa79dcf67cb3", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571171, "uuid": "fca8af34-8784-45cd-85da-8f80f66350e0", "value": "T1C344E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571171, "uuid": "b8491960-3064-4054-8e60-49b3894ba967", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7C:U9jFrjmkD7IvLDK3vLvfn1+2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571171, "uuid": "8a81a22e-6366-4f14-ad77-b741b498d26d", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571171, "uuid": "e58462fd-d46a-49c6-a9a2-70bb80ca8370", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571171, "uuid": "3e792271-6b3f-4b7f-b439-8fefc9954f2c", "value": "fcf9de6af65858b0218dff53651275e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c61af4a-304b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634586104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586104, "uuid": "5dbbb0c1-7592-4b80-8618-be0f399b16c2", "comment": "Malware payload (Mirai)", "value": "8f1016f89d932e01a8f2b23d3e74e325", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586104, "uuid": "866b39d5-d85b-4db8-a85c-7c227488bd18", "comment": "Malware payload (Mirai)", "value": "b32614ede7b876909612de16e820cdd720cdaf1989b086667b48514d82d4813b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586104, "uuid": "20787b94-74a4-4d2b-b45d-695f68de7a77", "comment": "Malware payload (Mirai)", "value": "202774331ae1443edc541d18402b0da29c189ae1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586104, "uuid": "bb9ff450-1dbd-485a-ba8d-5f60dd263d18", "comment": "Malware payload (Mirai)", "value": "e2437ece143cf58cfb19131eb102ceeb7f47e1757941ffc380fc4b95d34bb36bd78b11b8847290f34a3a2697bb8532de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586104, "uuid": "b6915e31-7a94-4956-88dd-a17023c23c5b", "value": "T15FB3C40ABF610FF7E8ABEC3745A92B05249D510B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586104, "uuid": "54eec34c-fd8d-46a7-af16-7b4b3e4315be", "value": "1536:g9DYWFx+xx+AaEPihMR2jk2EkZ+BzYojKoOvDBgplbngVZ14hvG:gqWFx+xUA0iR2hEkZ+BlpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586104, "uuid": "f1cbdebb-9c3d-4c51-be63-d79c69fac411", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586104, "uuid": "24924ff2-b8ab-4332-b02f-da7b599ade2b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586104, "uuid": "2bbeee43-14c6-4f32-b321-7e61ffe38e63", "value": "8f1016f89d932e01a8f2b23d3e74e325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3509775e-3020-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634567542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567542, "uuid": "b048ef1f-5b97-4e81-a8b7-460283b65305", "comment": "Malware payload (Mirai)", "value": "4757425c8f2d8c15ab5fb9325862b699", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567542, "uuid": "7705896e-a60c-4ea6-9321-f77597788a37", "comment": "Malware payload (Mirai)", "value": "b35dd9e267efaf7a5ea44f47fd4b8f35a3d57a77f057309f5ab9af871735c9ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567542, "uuid": "c2705112-4acb-41bb-99da-35b006f18379", "comment": "Malware payload (Mirai)", "value": "af1b2480dfba51012115d3ac14d8897733154b13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567542, "uuid": "af12c8ae-a83b-4011-ab56-38624ce6f85e", "comment": "Malware payload (Mirai)", "value": "c83b0f57756ab18822ead84a206e72ac28983e88de62c345593588eed7fe36a1fd722e4881a80aa097f53b9c6919d46f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567542, "uuid": "f6951c6c-2b63-46a5-9fae-91beda5b098d", "value": "T116A3B4092E259F7DFB9D823987B78E25A64833D63AE1C481D15CEE011E7024E741BFB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567542, "uuid": "87f41a62-db46-4242-b645-15c3b1da2179", "value": "1536:yoyP3d31omK0NTq8fCj+sYj3Oj3HFj3MgZ+IJWoKDMUcru6MEwkX8bsBnxTcush/:94kmK0NTNKdzudgnxTcHhqPu6Xdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634567542, "uuid": "5b463473-9a9b-4636-bd0c-4840887faf98", "value": 101968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634567542, "uuid": "6eb49b47-5cc4-4351-9ada-571654b4cf1b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567542, "uuid": "cafa9688-5919-445b-9f83-c442d549891f", "value": "4757425c8f2d8c15ab5fb9325862b699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecafd61-2ff4-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634548849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548849, "uuid": "13f82f36-8caf-4bf3-8f8b-041b328f0288", "comment": "Malware payload (Loki)", "value": "dceadc6623bb5c5478d465426574cce4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548849, "uuid": "c471b9be-8d24-4604-a446-8621f28b41b7", "comment": "Malware payload (Loki)", "value": "b4e4d80ec926c51e238fd82cb73094c32214e350e58939b54b7146f610225c49", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548849, "uuid": "3ce48c77-7346-4846-9616-53a4056b5706", "comment": "Malware payload (Loki)", "value": "e19b8b24222e6c9d5b644a8c879095b29c4d5763", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548849, "uuid": "813e7386-f49d-47aa-9590-1bf81f82f80b", "comment": "Malware payload (Loki)", "value": "25005661e5fe662ee947ea78cf1ff7d572e9485c7da545244e6a032f4392b75ea2576772eba9c838fd578915ab3176f8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548849, "uuid": "85364f59-680d-4004-9d29-3ecd43ad3f39", "value": "T1E774D0AADE8CA369D3CD9E314F9028892B49BCF40941F6A388EB3CDE1475643C3F5651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548849, "uuid": "c1962ded-fe93-434b-9be9-bda12f8562f5", "value": "6144:xxODKVSGInY4h1JAsJDk0s7JUIAUZyusSwy53twhoL4MTdyn0Lu99h+j:qPfAQACIAsUBIv0tN+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634548849, "uuid": "1f49781c-d9d8-47eb-bb63-4ca560cd4f4d", "value": 351288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634548849, "uuid": "3542b280-95bd-4808-baee-3f5c4c23c449", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548849, "uuid": "22c34ea4-2183-4ff7-b6fb-ac3e78e3c64f", "value": "SWIFT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ea8c5a-305f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634594553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594553, "uuid": "3deedb5f-f093-42d5-a3f7-ed3e285b66f3", "comment": "Malware payload", "value": "6753b99b2b777f5f800890c1c043c1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594553, "uuid": "3257c89d-fa21-49f6-8328-8cd99d5318e5", "comment": "Malware payload", "value": "b50733e5a47bfc0aa698a9fdc6517b5fffb8fd2942c83ce0343fdbe7fa9b29d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594553, "uuid": "aaaf1b9b-a4c6-4ed9-a91a-e391f7752f81", "comment": "Malware payload", "value": "e304f755c41c08184d9fb05c79a7a65b9b590699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634594553, "uuid": "bd08e314-dce5-4d5c-8438-1365b5695eaf", "comment": "Malware payload", "value": "bd7c286db6b1558cef602adc66b2544a9e7d0a940d33cfa49b906dffed70e62a462f61794c549381425faf70a4fcf6da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594553, "uuid": "26edb113-8f38-4632-83e8-c8cc008ca5ac", "value": "T174055A1AB2D7143BC03706BD492752645C3B7E202A96585A5EFCBF4C0F392A33D36E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594553, "uuid": "48c33e2b-d826-483a-b085-f754fae0e606", "value": "c00b6ba7dbbc6abee9ace3a65a49ba24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594553, "uuid": "6ae38fcc-8c09-4ae4-aec6-22a866767088", "value": "12288:OwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4FhozEa888888888888W8888888J:eNzCtUpQ9WWPBSSRMTEpMNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634594553, "uuid": "4d927c15-cd6e-430e-9f15-95ad30ada085", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634594553, "uuid": "15cbc00d-0d7d-4b93-884a-6133d0996286", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634594553, "uuid": "780b998e-c13e-4018-a31b-add517132b0d", "value": "MajorRevision.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f6d6a9-304b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634586118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586118, "uuid": "c65133fb-fa8d-4b12-bfbb-b8fcbfab2e11", "comment": "Malware payload (Mirai)", "value": "99f5fe1a67642b5671577b0aa23987bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586118, "uuid": "67be69f2-a403-44b8-ba0d-5a7f34314e32", "comment": "Malware payload (Mirai)", "value": "b598a4fc4cb9bc45c69d9b4478b187ae22b7af13c73b9c9dd9d9ec51f286a876", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586118, "uuid": "72fca5e4-a458-4e1f-b0dd-c82b5d325da1", "comment": "Malware payload (Mirai)", "value": "ab8d98e8a0b883a6bbcf4eee429563ed693b6fbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586118, "uuid": "fff2b4c8-cd68-43a7-9b06-201fc806be1d", "comment": "Malware payload (Mirai)", "value": "05d39379236cc1fd837ec6a4fa6df23d05da1abc69759575be173771f3f1162d6d81a16a7a7dd8b1293b15c4b7c838fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586118, "uuid": "cecdab7d-e1b1-4f52-9bea-e2b3109503a6", "value": "T13BF34C46EA418B13C1D31776FA9F414A33229794E3DB73068D286BF43F87A5E0E57A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586118, "uuid": "89f70052-74d5-49bc-89f9-bb51044c1864", "value": "3072:JrE0wQVvVhMM+tKXaRGLKW3Sfz8azYEBPFsleM/96O1M:JrMQVoZsXaRGLKWCfXDBPFsQM/96O1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586118, "uuid": "f5469923-264c-4220-8241-f6f5f41b0d06", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586118, "uuid": "863a715b-371a-4ff8-bd21-a6cf26a2d25d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586118, "uuid": "2e42c40e-8ff6-46dd-9628-1f2f96f1e6c3", "value": "99f5fe1a67642b5671577b0aa23987bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4866958-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634555784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555784, "uuid": "d6d3e234-0a6c-4651-8b60-8b743e4367a7", "comment": "Malware payload (RedLineStealer)", "value": "42c792f8620646cb828c53cd07c3f594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555784, "uuid": "f7b4d6c5-d9a5-485d-a14d-0ed35ea221a8", "comment": "Malware payload (RedLineStealer)", "value": "b684a67ae1f8ca2db59e24cc902eea35fb575d4044049a388cc9824583328b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555784, "uuid": "1e55752c-818b-4b4b-b644-5efe1e317fe6", "comment": "Malware payload (RedLineStealer)", "value": "0cbab40cf1dbbc129268233f47b15d05154a8bb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555784, "uuid": "e071d69d-81bf-4fad-b121-1f99d53ecd00", "comment": "Malware payload (RedLineStealer)", "value": "eb8a3d7c5c7cf0d659cafb6ca676d83dfe6f5fc2a51d8b816c88c4b8e717108c96d30d94dea4e18a8d2ab595f14ce042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555784, "uuid": "50f63e27-1dc2-418e-9adf-9805bc5d9d76", "value": "T180949D10A660C039F5F256F58DB99278A52E7EE06B3C50CB62D51AEE97375E1EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555784, "uuid": "7672ed35-9764-4ffc-8045-3e37c84f1567", "value": "bd3694527adf0e2f58ae8cb4e18ad5ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555784, "uuid": "cea5aa7e-edad-47a1-bcf4-1e414b16562d", "value": "12288:aoen5ZNyqyxiQPTMPbJ2A07RnHQ4dHO2ory5cSlo:ab5Uxic6bJ2Aun82ory", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555784, "uuid": "2115cbcd-1514-406e-b88b-74a0e7267eaf", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555784, "uuid": "3477cfc7-4568-486b-ba73-eab5bc388ab3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555784, "uuid": "e96bf920-7982-42d1-99ea-8ac12066f2cd", "value": "42c792f8620646cb828c53cd07c3f594.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f98d57-2fac-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634517753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517753, "uuid": "bee66039-1709-499f-9e30-85c711d52665", "comment": "Malware payload (Mirai)", "value": "2ef193314d744e3c7521de334ae13349", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517753, "uuid": "584bd9b7-371b-4fd4-a854-d75744d6c5e1", "comment": "Malware payload (Mirai)", "value": "b87bc18c3c30d6f32a97c2ae15e130f4b52c8c902760abe2f7c8db292ba20766", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517753, "uuid": "f7698e02-def1-46e7-895c-ab170cba8ebf", "comment": "Malware payload (Mirai)", "value": "447812f49f65962ce4eabc92fdca9968d19be9af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517753, "uuid": "caed0594-14a6-4a6d-9306-299414dedd48", "comment": "Malware payload (Mirai)", "value": "4fa1376cf0cb59c873556a593f448d9933ec0a5e0c5f5d701b7aec04778818e90cd2dda89baa2e8c245e165201abf82f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517753, "uuid": "2afc9c4a-12e5-40cc-942a-60ee622afebc", "value": "T148339E76C42EADD8C6458734B82A4A740FA3E10891E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517753, "uuid": "709fbeba-26c3-404b-8848-6645d2fa4d93", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40ZdiWFyGoMuJLk3XCmlolN9aXCxy:EcdC753UlwtNFFyGoMD3X3qlGXCxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634517753, "uuid": "4b4cc312-18ef-45ec-b151-5addde1aea76", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634517753, "uuid": "ac7883ec-e2be-4b58-88c0-99bd79d27312", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517753, "uuid": "c904481a-3503-448b-9862-87f8d6c527fc", "value": "2ef193314d744e3c7521de334ae13349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2749045f-3025-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569667, "uuid": "9a27798c-73e2-4661-a8e2-0ec1a20738b4", "comment": "Malware payload (Mirai)", "value": "c8209bc45ee41a3f6630151a0292c62e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569667, "uuid": "94cd1b40-2c3f-4af3-96d4-0ae0f0fbb26f", "comment": "Malware payload (Mirai)", "value": "b8d0f6417fee449720effcb38b83c186aba0e23fd7e6c8355453a87827e0216f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569667, "uuid": "85f6c4fd-87f6-4661-b131-8b2421a249fe", "comment": "Malware payload (Mirai)", "value": "e219f5a9d0f90cab00d39f4ae934d050799597dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569667, "uuid": "bff1a58e-2034-40b4-9968-8d5a72a04c7c", "comment": "Malware payload (Mirai)", "value": "c84eb6914b9451271058ef3a8a15d74aa93e4e00505d6ebc04ae2b904c06372c39ab46abc4fcf51add73ec628f8c47df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569667, "uuid": "8af86775-e038-4fbb-9d7f-18ff55f957ab", "value": "T12E930885B8819E15C6D413BBFA2F008D335297A8E2DEB253CD145F6477CA81F0E7BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569667, "uuid": "9f07adcb-4b68-452f-a78b-a0dd1f642aa8", "value": "1536:019n6ba+ZvOpqHk5QOgyb+YAYQ+yxNcjsuCvw9mrsplDKZUCQBKXAVanVX+F8JyP:0KbaykeObbDAV+eNOsRo9mrsplDKZUCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569667, "uuid": "ad02b6d5-eddd-4256-93f8-f740f1d55bc5", "value": 91264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569667, "uuid": "8db245b7-498e-4fc3-970e-860886daeca3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569667, "uuid": "5e37d9a5-5114-4e39-b7c7-4405b8aa18f3", "value": "c8209bc45ee41a3f6630151a0292c62e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbc71fe-304f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634587961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587961, "uuid": "47ed76ca-f38f-448f-a534-5da5f0f4e1e4", "comment": "Malware payload (RedLineStealer)", "value": "a5dac566745c199a3e0d2358c53a8d66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587961, "uuid": "623c9dea-8e8b-4de3-accf-a9bbb78a08f5", "comment": "Malware payload (RedLineStealer)", "value": "ba59622733f580592e807c44751503149a54f104b593b097dee0d6cd9e314bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587961, "uuid": "d79cb7fb-0a63-4ea3-b088-94384d7924f5", "comment": "Malware payload (RedLineStealer)", "value": "948b8a0a70da414ada34cadcf06d1c5d1941649b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587961, "uuid": "89ac69fa-2475-4251-a3b5-963ce958456e", "comment": "Malware payload (RedLineStealer)", "value": "be5942e32fffc90cf8ce0cca406ff0bc5c2e989db62a1814c0c5da5e85d6f3e3aadca3a80cb9c961706856048ad77d7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587961, "uuid": "b92b4430-95c9-48b6-b6f2-035ab7fb49b1", "value": "T102A4F05AA2E51098DAF441F7D9620746E73034791B25A3DB1BB813B70B2B9C99F3D3C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587961, "uuid": "e857ea75-6891-48d6-8b8e-75fbf1b1be27", "value": "f326f88ca83c9aacaa44acfb8884f1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587961, "uuid": "e291fd2f-1ccf-4399-927d-5c475fcdc1c7", "value": "12288:a5oaqjp/9T6QYXDKWPJZso//Ol8VlfylFUnR:a5v4DT6Jh//u8VlQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587961, "uuid": "cc165259-793a-47f0-a02e-578e11042513", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587961, "uuid": "2e18698f-edbe-4eeb-8952-413a9db3c1c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587961, "uuid": "8370e78f-4c1c-4575-a1b0-a3d8bf06f05d", "value": "a5dac566745c199a3e0d2358c53a8d66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde406bf-2fee-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634546297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546297, "uuid": "5d386a60-1caf-4e00-9418-822e5a7d7f3b", "comment": "Malware payload (Loki)", "value": "4c7f75dbea906c8bac51094411dd5467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546297, "uuid": "77bc0627-a766-4284-b4a6-843bffcdfad6", "comment": "Malware payload (Loki)", "value": "ba7495813ffeac0429b6e26659f1a6c3638f9b2e7863f4a96aa3d030ddae9b9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546297, "uuid": "1b2558d6-9034-4ff6-821a-2939b02a5982", "comment": "Malware payload (Loki)", "value": "e1b8377fb6db63cabb5f2daec730608327d8b28b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546297, "uuid": "78ea885e-d9b8-4d8c-bee4-6ab9ce11564b", "comment": "Malware payload (Loki)", "value": "15c6cac53c03e988751ce171ead806455cec5aeeb64d5d27c1983348cdc5f33db6f92bcfc77bf552f959062b640c7a26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546297, "uuid": "1041f6e6-7c35-4ef3-bada-cc84de96650b", "value": "T149449F00B7A0C035F0F716F845BA93A8B53E7AA16B6494CF62D516EE46776E0EC30367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546297, "uuid": "8dffe54c-f232-4ef6-ad51-96e0ddba2364", "value": "b2b1ce057c4a3ad8c1ee685e46521866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546297, "uuid": "d27a1573-3e0c-4a3d-92d2-fd9dd2c036ed", "value": "3072:d0jpv7yusHK+YMiHHtxe8S7ZyTlSdgDKbcBPU3rSe229A3N33Hg4WAtuxGtEYN+T:5HKRxS7sT8dgoUMGeh9A3RHWAwxAX9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546297, "uuid": "00b61531-e8de-42af-8cab-de5a5c1ab66b", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546297, "uuid": "b5bda69b-95b4-4d21-a0c9-4c6c55bdcb59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546297, "uuid": "790b5a38-0e37-41f7-9305-fa036b60b476", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e120287-3056-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634590804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590804, "uuid": "2d2a5769-2175-411a-b8cc-316b47e3ddb4", "comment": "Malware payload (Mirai)", "value": "aad17cba61b4d49007e1234581e304f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590804, "uuid": "bcaf275d-6f2f-49f5-ac08-d5110aed4303", "comment": "Malware payload (Mirai)", "value": "badc89fd1e3b4d7d2e05ff94be4c70ac032d658b0ca5fac9353e23cd245cc418", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590804, "uuid": "1d93bf7b-511e-430b-ad20-9cd760fa31be", "comment": "Malware payload (Mirai)", "value": "74155a3f4178860b90feb572af1d55071a104bf9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590804, "uuid": "fdbd0d60-c858-479f-802e-9f9bf05e5d57", "comment": "Malware payload (Mirai)", "value": "e5b670d34626aeb09e931499a742caa671501f62c7d8f9a5dd5a8bde7c25102cb18201e48ea65d5c1483fd979d752e9b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590804, "uuid": "53992475-6901-4ccf-a951-017fed03aa0e", "value": "T12123F143681B52CDD399BA728CCFF51D0C59465EC7962BB2B38C5533CFE27622298362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590804, "uuid": "d4d85d5b-0aa4-485f-a3f1-39b9dee46e05", "value": "768:r0U9qSFRmm/dI0prbhaRiejEG2AZHtQaMGO7HEOI3thmDJnnbcuyD7UWyqdvXQGt:IU0cRmipr1aRSYp27Hp8vmlnnouy8Nqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590804, "uuid": "8f0c354e-36c8-4208-8678-92f00e2323f1", "value": 46288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590804, "uuid": "526a3d46-67e4-464c-9bfa-44df86b268c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590804, "uuid": "359d85e0-107a-42d0-82dd-42c526b6f54e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00b4587-3006-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634556582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556582, "uuid": "aa2ae16c-75df-4c45-b553-3904b1b5e059", "comment": "Malware payload (SnakeKeylogger)", "value": "7d0ab695c712dccd72a7eba3f2db14be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556582, "uuid": "e760cbad-f65e-4e0e-b17c-04f3ed21562a", "comment": "Malware payload (SnakeKeylogger)", "value": "baddb56c76c155fd267142a7d131a7526644fde87c04f0a031e9354f3a10465a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556582, "uuid": "4eb1187a-9f35-4ac0-95d1-e4ed3c26c0c1", "comment": "Malware payload (SnakeKeylogger)", "value": "9a2ab2c1e9a4e4315110cd446450526641f06db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556582, "uuid": "73bff4b7-e61b-4701-9f93-cbde5cb66502", "comment": "Malware payload (SnakeKeylogger)", "value": "ee4a59a941fdd8f4dcd270799bd2c2f2480a4b9af7b9aa8ff6d33209bc6872615b98fbb6c2b8bbbd88aad49cac2424c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556582, "uuid": "f3e0ff14-98a5-4d01-99e8-f05de8bbe6d3", "value": "T1A373C8013E046689C4920C7901F25AD1A3789DDF8E9ACE3779E1B73E7873664AE0793D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556582, "uuid": "f7cc49be-344e-427a-8db0-23c4bdff24fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556582, "uuid": "4fd6bcf1-d4c5-486f-86a7-e8e8dcde1640", "value": "768:lIv/MicLIULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0cU:luCLIULFMAAiu6JL6oNsgFAyox0cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556582, "uuid": "9e8e84d3-9831-40c0-8518-d7398ddd5fe8", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556582, "uuid": "0358c38c-49cc-4380-929b-081ff57980b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556582, "uuid": "621db9cc-f535-42c1-ac86-f7a61c83066a", "value": "7d0ab695c712dccd72a7eba3f2db14be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996f70fd-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561268, "uuid": "52eb7b81-7af5-4580-9916-408453ce8708", "comment": "Malware payload", "value": "5676ad145519a6fb3ef67a93da3e5183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561268, "uuid": "a3e5b4e7-a3c9-4195-9ff4-b133a1d4026f", "comment": "Malware payload", "value": "bc5aec803186c219d6a530934a8e63bb6273100c8e324b84279f8251f11a4b51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561268, "uuid": "2a769067-41f4-4493-974c-ee4f816f645c", "comment": "Malware payload", "value": "752ced8226dce1cb544cdeac334a2011fa51af40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561268, "uuid": "95e81c70-9289-41d4-9a4f-5768991afaa4", "comment": "Malware payload", "value": "4ad32c9dd1260a30e89c9dde00feabc7d676a58525e114b71968bce0ebb25d689d88fe99bb18a3d68d91681c521b0078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561268, "uuid": "b80a1423-8259-4551-bac4-b0d46fd4e3bc", "value": "T16D94F105B2654F22C9B557FA843895530B726C2780A4F18A9ED0BCCB3E79F82857DF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561268, "uuid": "d9122261-12d8-44b5-879e-5adfdeff8f39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561268, "uuid": "f188efac-b020-4844-8c05-eb8cc483e301", "value": "12288:WDYG5WQmRmQVJT2AOfdCQuhzk0so+AFB:WcV02yOZsohFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561268, "uuid": "bdefb812-7449-425b-a4ce-1980bdc64050", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561268, "uuid": "375072a2-4e65-436f-8a5b-c7b25150b624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561268, "uuid": "9ef6c176-10a7-457a-a690-3b65c214b272", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4319ee-2fc5-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528660, "uuid": "72e83f58-3cf3-4c9a-8ac5-46a0f55bb979", "comment": "Malware payload (Gafgyt)", "value": "9a7f5656d5b96d51ebc8686080d61c3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528660, "uuid": "0d8b0947-4fa4-45a3-81b0-4aab6107b5af", "comment": "Malware payload (Gafgyt)", "value": "bcb53c4e7f042ed1f890b215ea64297768d2f8f980fcbd69d4c8fba963f27a88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528660, "uuid": "cf7c21b8-bcba-4e6d-a204-2456763fd8ed", "comment": "Malware payload (Gafgyt)", "value": "7b315eeb6441b7c887815736b660d2119504fd5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528660, "uuid": "25810306-6ef6-4b55-9b90-5c6183fe47d9", "comment": "Malware payload (Gafgyt)", "value": "fb53683a9e3f86a8d07164370c19f5ef36d7f853ab0fb02c1fff694b0eea08a2fe25cda517732e2e760c3e2561b69506", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528660, "uuid": "ab6428af-ff1d-40f1-a898-c6a5d3e5276d", "value": "T149C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528660, "uuid": "7348a8cb-698d-4e15-a78a-cab0f3c6a51e", "value": "3072:hQrFRNfuLrGhEPOD0vg3gNlmBoHQuQekQnYW:IFzuaEGQvg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528660, "uuid": "f1c1114b-4757-4b06-9eb1-e4729c5c0fa6", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528660, "uuid": "d779d55f-5c88-43f0-968b-411868e489b0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528660, "uuid": "42bdc4ce-9a0e-4f82-9466-cbb441154817", "value": "9a7f5656d5b96d51ebc8686080d61c3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c156fed-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634555582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555582, "uuid": "5c7782e9-7149-44ac-b6f6-cf54fb0aca97", "comment": "Malware payload (DanaBot)", "value": "4fa552588131a234325cdba4ad76db03", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555582, "uuid": "25b9b844-c476-4652-b7ff-60403d067450", "comment": "Malware payload (DanaBot)", "value": "bd2b57dff03a595dfcf0d129bbc8c6e0fe75743a27ec20806380f2e87868ef41", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555582, "uuid": "12e44851-92f3-4ff3-bf17-dba2408940ae", "comment": "Malware payload (DanaBot)", "value": "1b94cc18a9326e87c04ad9cf23b6d96e72c79e69", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555582, "uuid": "67155d47-eab8-4a52-aff8-c299ce8b45fd", "comment": "Malware payload (DanaBot)", "value": "82dd2008675d9a7403589d094ae8b0ceb0295930ee295c544b7bf0125b5409b4557debbd2e3ccafa8841672a60cb44d0", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555582, "uuid": "f06560eb-5867-401f-a140-4ead51fe5d23", "value": "T1834512C1E760C035F4B256B84AB69378B93E7EA0AB2494CF22D555ED12389E1EC33717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555582, "uuid": "4503c65b-2191-413f-9ffd-f6a8592daa19", "value": "b2b1ce057c4a3ad8c1ee685e46521866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555582, "uuid": "56d8f986-c8c6-44ee-b28d-e640f3892bbc", "value": "24576:H0WDq5YYpokoXqXhEhlIzlpkQGku0RKfRvqy4m+s9OU6T:FIYMokocm+zlpkQG30RKZvqyp+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555582, "uuid": "92bafe19-1ec2-44f5-accb-e4e724c182a3", "value": 1181184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555582, "uuid": "dad1b738-75ad-4062-87d1-1822898efff7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555582, "uuid": "d5d14b79-43be-4bf5-a96b-7bf9f1ce36cd", "value": "4fa552588131a234325cdba4ad76db03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e98abe3-2fe8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634543480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543480, "uuid": "f6c69643-ced7-4686-9c42-f0eed7ef2b7a", "comment": "Malware payload (Mirai)", "value": "5243ae0823be447f00f768f8c961edc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543480, "uuid": "25b4f0b3-95dc-45d5-b075-eeb6b86572d3", "comment": "Malware payload (Mirai)", "value": "be33676d77e9f00e4473e9ef4d62598a8184a9e918dbde0194240f20fee3e33c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543480, "uuid": "4cf5367e-f694-4f02-b1d5-a2f919a3a00b", "comment": "Malware payload (Mirai)", "value": "9b06e9d02b2af0fe5da2e9b6aaa88c0f26955a4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543480, "uuid": "d3b3f7ac-fb87-4f6f-b2a6-2924049d2586", "comment": "Malware payload (Mirai)", "value": "4b4638544a66194028ada432d32ebce928ae20fbe8dd4cf1bfe317b7de6fbb358cbc9ec09e0d814e13c6fd24cf569c06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543480, "uuid": "88721663-7cb2-4a9a-8aef-7dd6826dcc64", "value": "T147A36CD7FC00DDBDF809DA3A41570A0AB131A3A10E921B37B2536C6BFD751D45A2BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543480, "uuid": "4e75385b-5b28-4c30-ac0e-09bb09d00be3", "value": "3072:cCMLL8316iIBnqy5ZspGWN6AAerSyoSeIrhHV/J3bB:cR+1UqymGWNXUyoirdFJ3bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543480, "uuid": "0849b429-696a-4466-ba3f-98b71f9a2a73", "value": 106636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543480, "uuid": "ca3f87e9-be80-4661-b8a2-68b01b64b807", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543480, "uuid": "4af29a10-2ce9-434b-9a86-3a51280c177b", "value": "5243ae0823be447f00f768f8c961edc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d060a09e-3006-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634556636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556636, "uuid": "7041cade-cf55-49ac-abcb-6537fa2c4cdc", "comment": "Malware payload (Loki)", "value": "5cbfb2df545e0a96794aa3fe10993096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556636, "uuid": "f350d32e-0206-4fad-945a-80ef2583bea3", "comment": "Malware payload (Loki)", "value": "be6d440f5e47df354be0baae9d4d625cd4368acac5567150c6e9eff877c6814e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556636, "uuid": "4863d586-1b6a-456f-8640-aa2e6db54a86", "comment": "Malware payload (Loki)", "value": "4591ad3416fe1e4017c14d12d6f139c0d47f5a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556636, "uuid": "d637688c-9298-4f11-9c50-582e0c00a426", "comment": "Malware payload (Loki)", "value": "024ef4384d0166cffd968fcd4fd10a57ce698dcd9a94db15be1a3b3f7aa2568eec75cb4f46f88a41349cc28d17627ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556636, "uuid": "e24891a9-8456-44d0-b458-536d30e595e4", "value": "T14A34122F73C540B3DA43CA7757BB5B3753EF96052123AA8B53788F3AB1699C2500A187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556636, "uuid": "85a193c9-7169-4697-9556-be0342fad9fc", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556636, "uuid": "b32ec594-9dc4-435c-badc-d999be35ea0b", "value": "6144:yBlL/DLEPAeLuEMrzITQlKuOaRHPawE1Q2wd5mJVHBp2:4hNprgFxwiQldMH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556636, "uuid": "c57f7d31-1fb1-456d-b5c3-31ba319ce4a2", "value": 250381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556636, "uuid": "61ab5ac9-c3be-443d-81eb-8f11fb183de0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556636, "uuid": "97bf46b6-c9c9-4951-847a-9a014040292d", "value": "Consignment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec504ff-305a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634592389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592389, "uuid": "d5ec291f-c13a-41dc-8c2a-dc0399375f6f", "comment": "Malware payload", "value": "7e7d5f990c1ec4aec6ea3e97d6e3869d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592389, "uuid": "b4e532a3-7dc4-4a05-8ab5-dcf24c7239a3", "comment": "Malware payload", "value": "be79e9e636884e314d9f302c161d615348cf81d5e6020c988c37e0a541b85236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592389, "uuid": "dec481d6-4ee6-47d5-8c32-a8e47c9c4cac", "comment": "Malware payload", "value": "6560d991ed13cbe736f625a8a5d347f5a46f4970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592389, "uuid": "87cf7d46-2e3b-4719-96b4-402c5afa5479", "comment": "Malware payload", "value": "ba752192dfa7cfe977789a5a1a1983b12dbceeb3828e8312efc65acaa5dcd12f38c49fbe221f1f28ae1d2dd70fa8e6f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592389, "uuid": "8e4a5d91-27e1-40d6-9d5d-e0f687929404", "value": "T15C7633B079CFC072D74525769C25AAD27F1A3CB1527154AFFBE426AE6232B14AC31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592389, "uuid": "66b00a83-6be7-4f77-8f95-56e6e04aef54", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592389, "uuid": "fb6595a6-991f-47ce-822c-02aa50708c8a", "value": "196608:ubEslMEi8Vk+g474G/4vz4sz9bVjJToo39YDB52B5:u4gViskX4V/4v0Knj17YD65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592389, "uuid": "6e054899-8e9d-469d-8148-462243fd7a2b", "value": 7661307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592389, "uuid": "74f6ccaa-3da3-4413-986e-de8e987afd5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592389, "uuid": "5da92e48-3dc6-4953-ba4a-0bdb67fd63c4", "value": "IcePick.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86614b73-3061-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634595596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595596, "uuid": "c395a57b-beba-4a99-b7c4-b99fbe6dfd10", "comment": "Malware payload (Mirai)", "value": "f931672ea333f80c3560d3b70951159d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595596, "uuid": "8c5a46b4-e423-4b2c-8e47-bde84842f58b", "comment": "Malware payload (Mirai)", "value": "be8f5c0f3b42589b573d91cec71965f13a461a8fbc09021d9cb065de41ee1bcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595596, "uuid": "977a3386-6ee6-4160-b6f0-19514568922a", "comment": "Malware payload (Mirai)", "value": "248bcd44d8a4536628c4f158b9b4396de52e3707", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595596, "uuid": "a37cf15f-f784-4e73-b171-37cddfda6dac", "comment": "Malware payload (Mirai)", "value": "4005437301763c4e0fa588d2505dada8dd5213292ea680ad60a6286f586f8ebfe4ee897d08aa785bf9278089e71e8ac0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595596, "uuid": "c2b38301-6925-4e62-a1af-80beadc5ce73", "value": "T1D6831A56F8809B12C5E456BEFE1E018D33131FF8E2DE7212DD286F243BEAA5A0D67541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595596, "uuid": "2420b3a5-b8af-413a-bc1e-1ad66d24a57c", "value": "1536:kOn8/2zo+fXlGCeTkL3RRDR5KKYi2VICiPequXBzfKMYvx3fOyURgdG6efYIhBAG:e2zo+fXlGCeTkL3RRD3YePe5TJgdGffZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595596, "uuid": "65948c3a-ef98-4228-b9bc-7a9d413f1861", "value": 86872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595596, "uuid": "bc4fc286-b327-4545-951c-aa4af0aa42fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595596, "uuid": "4b3636b0-e267-4907-96f4-ebdf8fb8d868", "value": "f931672ea333f80c3560d3b70951159d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb55a71-3056-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634590805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590805, "uuid": "7abd1aeb-6d8f-4daa-89ec-96c6c549cf55", "comment": "Malware payload", "value": "40b81c1562625c9e723bb8710777e558", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590805, "uuid": "c8a19e5f-2379-46d8-a5e0-3755141ecfe8", "comment": "Malware payload", "value": "bf653177ff090f20c9a1a5d2f9bf66e2f9b880ce6231b00069a9091f28df284e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590805, "uuid": "8d301522-8972-401f-8b7f-8babb9bc6fb0", "comment": "Malware payload", "value": "785d1853e118fca6865b518b166af02644432aac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590805, "uuid": "d2d7c978-d26e-4298-a063-a01d75f65612", "comment": "Malware payload", "value": "593ae2825ab3ab44348ebc643de0632ec1a5abd0db32d3ce681f11c67d28c4daef8b949939b9571b834cda881deca763", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590805, "uuid": "cdb1881e-d107-45ce-9821-5efd789cea36", "value": "T1EE6301D1A6921F718464A93310B53442B5283EB8ECDB30F693B2E5B6EDF67C454F8C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590805, "uuid": "23a259a2-fc69-4f3b-8d60-03ef67823da1", "value": "1536:aUV/mc5r4XNU06sGYZVNOT895MsfEE2gmGtoanPHPuYoy6+Q4cHc:ogEXOAzXsRsfhlJvuYjO4cHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590805, "uuid": "8adac93a-6658-496a-b5b0-72906088d713", "value": 68520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590805, "uuid": "92943de8-dcd7-4281-86ac-d0127021d5c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590805, "uuid": "8f4937c5-ab21-408a-8858-c29380966c1c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8111c0a1-300b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634558650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558650, "uuid": "e604a109-830f-42c8-8e92-f8e757aa6a63", "comment": "Malware payload", "value": "c2a6a00cae217186b812487684f843a0", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558650, "uuid": "04854e5d-8d7c-4e15-979d-8fad6ed4ddee", "comment": "Malware payload", "value": "bfd6471c354eefa96fa3e5a26d83444463b8b4ec3ae6eb7630a02ef14f45a75e", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558650, "uuid": "9c4d7031-79e7-466b-9e30-40c091ea2526", "comment": "Malware payload", "value": "53579f8e6aed1a15fe57351795cfe4044fa21724", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558650, "uuid": "7f2e3769-7980-4778-af6f-1152aa307429", "comment": "Malware payload", "value": "accbba68abe157785b7aa910c802990a2b699d12e95f27d80d7d4892ea59c39a347245b01951f29eec96e5f0cd43e5d9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558650, "uuid": "db175240-b5e4-4f53-8766-dc5cd90a3347", "value": "T1C7842364976C58E646CC39BAD488129DF221F6339786FF8B09EC9479940324C4BFE78D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558650, "uuid": "a647defa-b65d-4eb9-8365-ff48af42524d", "value": "6144:yA+RqiI9rPYvKW88hNdgZKoJzHN0/5DC5GHvvxU99oCnlAyPPyuUTuc9r33Yau:yPI9rgy583oJzeOcHvG99oep3B6uc9Tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558650, "uuid": "ec2c7192-c552-4762-ab21-a9efbd4d2f99", "value": 372620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558650, "uuid": "db1b8bca-4aa7-4b6c-a54a-c1bc74ad30fd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558650, "uuid": "5aa93078-2958-466f-8eca-79af75817e30", "value": "34522201036.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecbe195-301c-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1634566082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566082, "uuid": "8cd08e2c-5cba-4d97-9aec-5a5256824587", "comment": "Malware payload (njrat)", "value": "6dac828a152d6eeb75ee6d92dcf3bd39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566082, "uuid": "60294d7f-807c-4d24-8325-0d6b52d26819", "comment": "Malware payload (njrat)", "value": "c0e3ff2c207a1dafd241067bed9a69eb50edd1a891f6137294af478f7cbc1dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566082, "uuid": "bcda605f-4c00-4607-894f-64993e9f777f", "comment": "Malware payload (njrat)", "value": "839c8970c6e3bc6dc010a175c2b4523f18ebafc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566082, "uuid": "eb10ecf8-42d5-4fbb-b29e-bc43615b736e", "comment": "Malware payload (njrat)", "value": "ddf29380dad2b15e71f26c5c0b4995876f751f21f723f010c47204717a43aa3f8c8345da78f3971c33a5f2cdc0192104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566082, "uuid": "124848d5-f6a1-4c29-8be8-856f25e72acb", "value": "T121033A4D7FE1816CC5FD057B06B2D41207BAE04F6E23D91E8EE564AA37636C48B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566082, "uuid": "a1a7dc28-c737-46ed-b91a-a440e1e63fe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566082, "uuid": "7108a643-12b9-4e91-bd3e-909c77b76f29", "value": "384:rqbsiDlT95hL5YyUvjh/xOi4aaF3lrAF+rMRTyN/0L+EcoinblneHQM3epzXuNrf:e5v5zUvjhDlaRlrM+rMRa8NuIDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634566082, "uuid": "ebed5013-c1e5-4b81-9406-9d7ed9a5bf17", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634566082, "uuid": "cc0af609-6cca-4f2a-93e3-bc16b4a5d34a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566082, "uuid": "8f9a6ef1-216b-49eb-aac5-371088f9682d", "value": "NO - IP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a726fc30-305a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634592645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592645, "uuid": "866fb1c6-7666-4601-8f54-8fe50100e4b3", "comment": "Malware payload", "value": "bd2d013fd5bdb05f000609b2e5876be9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592645, "uuid": "b2849d0b-1a52-4b52-99dc-93401bf71ece", "comment": "Malware payload", "value": "c17aa2ef0fbfbc2829cc97d1ac66a95c181a7dd7a48cc9b1b3e72f3314573e45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592645, "uuid": "3f935a0c-d65a-44a3-802f-9b57e2351236", "comment": "Malware payload", "value": "67e0fbb954b230308c27c2faedeabd1f370c6638", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592645, "uuid": "1e162f3a-a09a-458b-82c3-10529aa63f32", "comment": "Malware payload", "value": "4469a0cecdc7fc8a0d7b0733354c393e8a23385ebebfaa323ebee9c2608805bced27ddca2ce47e286a43b0cad05e69c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592645, "uuid": "50e0a428-47cd-4d68-81e6-badfe21554b2", "value": "T1ED23F20252CC7162CEE05E71656E220332161FBD6DE6EBCB52885132B7E70C3697963F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592645, "uuid": "21db959c-1f55-429b-a1bd-9c8adc29acaf", "value": "768:KO7AUG/jU83H1VnVfCaimw7Ggnh6745SvzUu75loaoP8MI3ZMuDAo23UCnobyNGM:KO7VeU83HjVXQh6zwuloa08MIGSr+k2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592645, "uuid": "457cc739-6a8f-4b8d-8a54-c16321221a5f", "value": 47488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592645, "uuid": "3f661f50-c1ea-41d8-9415-c60ea9e91a93", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592645, "uuid": "07a48170-aa90-4adb-8a8a-9a0c041ec1cd", "value": "bd2d013fd5bdb05f000609b2e5876be9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86ca946-2faa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634517055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517055, "uuid": "7b95bac1-ca8b-46c1-8d63-12b153837c9c", "comment": "Malware payload (Mirai)", "value": "55468a322b5cecf1840bd45367b456ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517055, "uuid": "b4d2a192-f1ca-49b4-8907-6e3a8db38fe1", "comment": "Malware payload (Mirai)", "value": "c218663e8f6deb41bd7c705faeabc531b49ab076006f561423ba183e6fc97788", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517055, "uuid": "7bb30929-0904-4394-aadc-49c16b01e238", "comment": "Malware payload (Mirai)", "value": "0ae79ae89fd7b87905f9774dc8c80315c0f7a365", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517055, "uuid": "8bbeec4a-8cfc-4130-bc26-44649d6af72e", "comment": "Malware payload (Mirai)", "value": "3a55107ed697a42965fc0144898714353a697f834da35b69bfa4dc0cb1c1bbc17982abd9aca25c6481462f61b2ca31c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517055, "uuid": "00e19087-8fd3-47e6-b946-710c92c315a1", "value": "T11433D795B8D25A2AC6E4237AF9AE40CE332073E8D1CF3217CD151B147AD592F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517055, "uuid": "76e22d24-50ce-48f5-b732-9deff5997f6f", "value": "1536:S5Z4fJ6tL/yXFeL5zvL5nrHwcA7WhKpQY:S5ZIs5LL5nEcAihWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634517055, "uuid": "35a9ca78-76cd-420d-b42e-405222fd65ae", "value": 51168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634517055, "uuid": "e30bb9e3-9245-494d-9564-d7d835427f97", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517055, "uuid": "bb6f161f-da69-405e-9fbd-160212695185", "value": "55468a322b5cecf1840bd45367b456ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30d2a3c-303e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634580666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580666, "uuid": "5074e6a1-62b3-4a62-b7fe-4d21673b4692", "comment": "Malware payload (AgentTesla)", "value": "38ee6efde5143d84cea6a5b73b656317", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580666, "uuid": "62be60bc-9ff4-46dc-82e1-45f9897fa101", "comment": "Malware payload (AgentTesla)", "value": "c2d4a5449663eaba12f55a56487d731f148f6ff74e977814afcfd57f8584b5b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580666, "uuid": "9583dabd-469b-429a-8cf8-79b6a7f8b1e4", "comment": "Malware payload (AgentTesla)", "value": "e3371a76b3b849afe330da30a2f7e77aea1aee43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580666, "uuid": "adf135b1-d5f9-4eff-8f97-7fa6006ae7d2", "comment": "Malware payload (AgentTesla)", "value": "f3bb7aa43161b0964026e10b58c47ac82b3b8285b039ee6abb8c3f705e45306ed3bb50cd4f348afbb95b1a9b3460b9b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580666, "uuid": "048e5662-2e86-4d72-907a-f1e1db12fe3d", "value": "T1C974DF1D1DD4B2D3DB3579F2A009B2BB60D64C5A088B638B162474E2D2F6BFE85C351B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580666, "uuid": "bcca169c-abbc-4ecc-b702-0af3340090da", "value": "6144:P4N/oMFCey3JQ+dMQ96bNzvQyCZ8P9trMMEMjh4okVmI:gBoQoJQ1Q96CyCZ8FtrMPMVY8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580666, "uuid": "462cb82a-e49e-4dd6-ad32-36da210e1c1a", "value": 355976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580666, "uuid": "add46b54-ab25-497c-9174-9d52de154fae", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580666, "uuid": "88a7ee74-63ae-4a4d-9216-e71f0772676b", "value": "NEW order AST 2021_10_18.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e710f928-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634555815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555815, "uuid": "f88d7673-5d60-44ec-bad6-5a8e3b8bddcb", "comment": "Malware payload (RaccoonStealer)", "value": "23b012be89b2da9c579f5d36a86ade9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555815, "uuid": "0904280d-27ab-4144-965e-c3b5c7d8b686", "comment": "Malware payload (RaccoonStealer)", "value": "c3461cf008e62a6616de0037fd35c54a4d3165a89431dcdb1d431669ca81fa3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555815, "uuid": "45de41ac-0fe3-4a5c-b722-10e546cabbd8", "comment": "Malware payload (RaccoonStealer)", "value": "120ea9845521f310c3ddc77417cda6aa62839aa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555815, "uuid": "26c4b6b5-0cbe-4a29-8824-cc0199ee3413", "comment": "Malware payload (RaccoonStealer)", "value": "79d642849b49304998bdeace3305b5d33940e06cdd73d3586ab6b663f196989de00a7234769cd76f997813a49f98c48b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555815, "uuid": "32cfd2b2-c857-4573-b363-f4006aad681d", "value": "T1D6D4C000A651C038F7B252F489BA9669A52E7FE0672460EB53D51AED8734EF0FD3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555815, "uuid": "d30fb143-668a-404a-abef-d5ab4ccad5c3", "value": "b4cda15a674ef12000829b9be50880b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555815, "uuid": "97da5467-4391-4459-a537-84952e3708b6", "value": "12288:Ta8vUz8dG6qU7bnM0WUCu0pH1Ga68h+Mk5grfbwh4o+BGFQj:TFUzmWU7bXI1GaP+Ywh4og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555815, "uuid": "175b7739-b5e6-4597-8fe7-3d5dab4220dd", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555815, "uuid": "41258c50-f6ee-4ab3-82e2-b79f52907b2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555815, "uuid": "888e476a-db3e-495f-a36d-a43429ff7dc0", "value": "23b012be89b2da9c579f5d36a86ade9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0a05b7-303f-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1634580946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580946, "uuid": "5f980181-76e2-4efc-b3be-9217bb482683", "comment": "Malware payload (Metamorfo)", "value": "fa4626860af62aafc6cbdffc1a1afe4d", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580946, "uuid": "a51e956e-21d3-4290-a18d-b315910503f6", "comment": "Malware payload (Metamorfo)", "value": "c41f9864fa3292233f09ee57d278d00a2266e5889f9bdf229a729857c35b7659", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580946, "uuid": "a570217f-9cd3-4a0b-976c-26a54957fd39", "comment": "Malware payload (Metamorfo)", "value": "3c2e32997c719bee8e3943fa28170956469248e8", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580946, "uuid": "ee5b06bd-bab0-4ac2-b672-7ed8c34cc59d", "comment": "Malware payload (Metamorfo)", "value": "41b7918444a613d1c06313a8dc93507a7a3cbc1dc34963797ebc57adb6cd484ef97c6ee42bfc9a7c41cc4501913407a2", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580946, "uuid": "2e528e77-baed-4ea9-a4fc-ff98602efea1", "value": "T1F541E3182DEB031AD2B3CE7624FA624689ABB952AD834F4E408443CB1861144FC35D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580946, "uuid": "96f91a55-f73b-4557-838d-0fce99222f5f", "value": "48:8+uH+M+LTIpbhDFYkeete1cIXv3KaIqiHkb6NS6:8+ueFLTID6keec1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580946, "uuid": "4a11fc98-eeca-4050-bca6-ff5ba1ba3a6f", "value": 2056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580946, "uuid": "50e8959a-2a97-4426-bd59-35132390974d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580946, "uuid": "b70b037f-8175-4851-9be2-1e7375facd41", "value": "Anexo - 18102145782.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cee4512-2ff6-11ec-843c-42010a9c0014", "comment": "Malware payload (Adwind)", "timestamp": 1634549436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549436, "uuid": "0a958e9e-45e7-486e-979b-3e87b69f2411", "comment": "Malware payload (Adwind)", "value": "5133242f7929889a5caa1660adae60b1", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549436, "uuid": "01c38953-27d2-46e9-97b7-a67995edb080", "comment": "Malware payload (Adwind)", "value": "c45df88fca15e293063cb91bb1d87f0e8c2256c1504bee82e426e12e7d5a8a2a", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549436, "uuid": "e3c3601a-e88c-493e-9fbd-44afee2ad95f", "comment": "Malware payload (Adwind)", "value": "47e0eea187f342e4be4c68655433bd0e20d4f2ae", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549436, "uuid": "7314c025-9b06-4ea6-83e6-272ac04f08eb", "comment": "Malware payload (Adwind)", "value": "6395877bc540478dc445d7c5371100d073c5c3d76a433bf2b6ea97e769298e0f7d55efbfb1caa390d6395f42b2ae9b81", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549436, "uuid": "abb898af-96ee-46b1-abc1-72bdfa8af831", "value": "T124E433A0B61E0F002E5249A492F235BCDE39EC6A75E13743E677C3758D11F4A2E8E617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549436, "uuid": "268856b4-97d5-4641-b9a9-3241877339ae", "value": "12288:DLcUQsYYoOHSSEe2TfeShAtnkTQgxqIOJevMfsX8rqGXzKHdXrTf0Te:DIUQhdO79CeShf0lxEvMsX8rqGXzKx/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549436, "uuid": "6053d5d6-aa46-43f2-bd5a-30b8cb43abcc", "value": 667947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549436, "uuid": "f86f624e-a3b2-4330-828d-3690b928ecf0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549436, "uuid": "8d57ea26-a936-4370-b6b1-5966d6b4c5cb", "value": "ORDER_211099A_pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42648db-3042-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582466, "uuid": "8d47fb25-35e8-419e-9ca6-fc43efe5f4a3", "comment": "Malware payload (Gafgyt)", "value": "a2e12cb9b64bcfed8d973e1249b5b460", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582466, "uuid": "3773d1a5-5698-429e-a8d4-76e6aa3a728d", "comment": "Malware payload (Gafgyt)", "value": "c475b4c585ef371f0d1e9c0083d3ccd55efde4a46b2255a2e7d8a63c6c6adebf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582466, "uuid": "e8f4f8f3-92de-4228-b352-da165efeb480", "comment": "Malware payload (Gafgyt)", "value": "7968d2b0ce342242a4804cbfbfd91467832f49dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582466, "uuid": "e318f825-0a09-4f1a-a0c4-cad0eda700ad", "comment": "Malware payload (Gafgyt)", "value": "bb72a4e3603e93eec73545d0821e8709c75e9682de6f87a95e576a54493de156a3204283f3b78be1cf2809c41e7e2761", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582466, "uuid": "28ca5b36-dbf4-4d99-96d8-54a1bfdd7051", "value": "T155831842BA40CAB3C44305B6129F9B110A33F9FB1E57AE56F36D6CF09E15585B223F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582466, "uuid": "a16971aa-43de-426c-98a3-ba379b38cd40", "value": "1536:tSQP74RoUyUM9HqjjtXWw5jlZ7MHdJfureYK0mi5hkddddd1bdQl5+mYHc0r6jmy:tSQTYoUyUM9HqjjtXfjlFM9du6G5h0b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582466, "uuid": "7534221a-1eb8-4656-85cd-a2ea1d53a045", "value": 85756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582466, "uuid": "8a341995-d62d-4b7b-a86c-41ad356b9d7d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582466, "uuid": "a57518e4-f2c4-4e08-b14c-882ef63c8f4a", "value": "a2e12cb9b64bcfed8d973e1249b5b460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1307badb-301d-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1634566197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566197, "uuid": "e92a699c-98fc-4ddd-9f99-cfae2512ac03", "comment": "Malware payload (STRRAT)", "value": "b2097471ac7d4e8304a119e815ac5261", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566197, "uuid": "10336461-f5f7-483c-b2da-15bf157a660d", "comment": "Malware payload (STRRAT)", "value": "c4acaaf51b789c246dc51d925ee92f8e0af9019da7385b8b4b127fca43fbb81d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566197, "uuid": "e322c77f-b0b9-444a-8815-6896ed3572f8", "comment": "Malware payload (STRRAT)", "value": "c23236d1b2bd3e6925a59d084d2bac275ea0b484", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634566197, "uuid": "4cadf67c-20f8-4a59-9c9a-1e5a06cc9064", "comment": "Malware payload (STRRAT)", "value": "742c6a2c79a27810be490a93816cdb3d9cc0e8bac9c865a064cfef30c2090d5bc3d3d838c6e1bde469910f14a793226b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566197, "uuid": "7a2fe2a4-1a80-4505-b934-4a166ade980a", "value": "T126A3E02BBCDDE5A9D01348B39450A2722A0C869CED0CF67F4DF910961EF2D6807966DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566197, "uuid": "785bb3cd-c985-4047-aad9-afbe976da6ce", "value": "1536:ddAewzYpcmCIE7/d8CC9odgo08E1fl3VLIjo1S8mfaEh7FT8VYclwDu2d:zAewzChPWC9oqoENIGS7LNFTPcu6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634566197, "uuid": "ec1773f1-9e5a-42f6-968e-7e694ec60b27", "value": 104999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634566197, "uuid": "6038271b-efe0-40bb-aaec-54bdc18a7e41", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634566197, "uuid": "8985ae96-fe7b-4010-a1ab-18d0e4c4bb9e", "value": "micro.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c09da89-304c-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1634586532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586532, "uuid": "938e55ef-2515-4365-bf18-3985f8c378f2", "comment": "Malware payload (CobaltStrike)", "value": "955de98b45d92a379953b75f151c972c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Harvester", "colour": "#0E3708", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586532, "uuid": "207bfdba-c4c0-49c1-a682-5394926cb3fa", "comment": "Malware payload (CobaltStrike)", "value": "c4b6d7e88a63945f3e0768657e299d2d3a4087266b4fc6b1498e2435e311f5d1", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Harvester", "colour": "#0E3708", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586532, "uuid": "44a0b08d-6299-4d76-92b6-22a6c865aaaa", "comment": "Malware payload (CobaltStrike)", "value": "cdd5ac367c54d03ed7fafd0e9e5db9f3f21ef35d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Harvester", "colour": "#0E3708", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586532, "uuid": "2b3808e5-a8f7-490f-b480-43199ca73f08", "comment": "Malware payload (CobaltStrike)", "value": "7dafd4593a7bc7990f8dcf68fc9144077e7d173c6fd9b5c2f30613b1c9a53fa7063e0ef2c1da989e29cbb20b2ad4a54d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Harvester", "colour": "#0E3708", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586532, "uuid": "554d53ab-1665-4347-bb85-20c8233ea0f6", "value": "T139F52333127521C4F8E6C8315937FEE471F6136ECB82ACB85DAAADC529211E5E713A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586532, "uuid": "9885f78d-f525-417e-83b4-8153aa59d574", "value": "71abe5350798202b14eb622b0ea0082d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586532, "uuid": "1b19386e-1da0-40c8-a393-e30123efaf8a", "value": "49152:OKVFpU3abdmFIeHS3bIPMQxgRV53hP75YRbRVdeJQwr9C3yyxloUM:OpabMFSr4W3Z7UtKB9CCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586532, "uuid": "ebb97097-39ce-47e5-95eb-6e5d4f2d1508", "value": 3442176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586532, "uuid": "fdb09a8f-939c-475d-8f06-7675701411d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586532, "uuid": "e75a485e-8f71-43bb-999b-0a12812e19b0", "value": "c4b6d7e88a63945f3e0768657e299d2d3a4087266b4fc6b1498e2435e311f5d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a6e792-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634542042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542042, "uuid": "341d486d-7653-47d4-adbf-7e67f796002f", "comment": "Malware payload (Formbook)", "value": "f64b10dbacd98b43a96e5fbb6ad24c3f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542042, "uuid": "0d88734c-c4f6-47b4-b9de-16ea79d2b71c", "comment": "Malware payload (Formbook)", "value": "c4d02d2a69ba8a52ee9be8727c37e5cac75a2cbd79aaf51936de99b42fe9d3e2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542042, "uuid": "6e133042-aaf2-4269-b83a-2e46be57721a", "comment": "Malware payload (Formbook)", "value": "230148ed7d498f33522666a5c1ba19928da496e4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542042, "uuid": "7faf350c-8829-49cc-9b48-ffd60bd3e552", "comment": "Malware payload (Formbook)", "value": "02c3be0fc698f91934aa62213ae9c74f43c264de1cdc1408dd85ec8ec090bca79de2130a75c493a80556492cd1675bde", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542042, "uuid": "2b3f9eaf-4a19-42d7-879f-737ade3cbad8", "value": "T18974CF19988D3DD9D87290F1FBECE34704C47D0099D5B4A70EA7BE84ACB097AE498B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542042, "uuid": "136b95fe-8520-46e5-89ab-0319483c42d8", "value": "6144:c7IdVFQWqVpszPMsfGH4zurzPnYLA+lZr8PzHkSvfqm2Kf:DXCfpszPBfGH1rzPWvZ6rvx2Kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542042, "uuid": "2bd3b37a-fa2e-4bc3-9964-34dd8162e636", "value": 351336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542042, "uuid": "ddedb284-28c2-4cec-bc69-d48ae8924163", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542042, "uuid": "26344b0e-3220-4627-a082-b835291291d5", "value": "Statement of Account.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f33677-3063-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634596508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596508, "uuid": "3733a014-27a9-4a14-be71-e0964972e5e5", "comment": "Malware payload (Mirai)", "value": "c98e91573f7bb5a378e90768057013cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596508, "uuid": "e2941752-3db5-4729-a79e-5c4da56bae0d", "comment": "Malware payload (Mirai)", "value": "c579c708300a09b7d0632fcfddff78f017855fc137c5ee658ccc472482b6bc5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596508, "uuid": "ca362f80-e145-454d-8533-3c4dbe212667", "comment": "Malware payload (Mirai)", "value": "feeb896506bda484c57376a7759eaae3a2594860", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596508, "uuid": "883b0105-becc-485c-8fd2-97d786724869", "comment": "Malware payload (Mirai)", "value": "dbd97c66b999a141f99fba29cde7f71e36b8a00e2b900046a4e2a7d50e37e71f9d7522abb05d60bf5b7913ed8f2e9d49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596508, "uuid": "ae8d779d-6444-4cb8-95bb-5240ce2ad683", "value": "T17393392236790B23C5F1953D51E79336F2FA17882878825F7DA15E0C7FA95A03193BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596508, "uuid": "40f779cc-b716-4482-bdee-c3d0e77e3d41", "value": "1536:zeF3rAmgjiQaBAe7tw87Z5NmnedF3RCEtGDMl8q:YEpaBXtBN5MnMRCwl8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634596508, "uuid": "11729c0d-b3e4-4d8b-b433-f8b821af389d", "value": 93848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634596508, "uuid": "c9fc972d-e5f7-4ae1-81ca-db603446b8b3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596508, "uuid": "e6251bf2-41d2-416b-ad98-457f6ef7fcf3", "value": "c98e91573f7bb5a378e90768057013cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329d758a-3040-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634581282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581282, "uuid": "1dfffab1-56a6-471f-bdbe-2015e4e8a264", "comment": "Malware payload (Mirai)", "value": "0ce2e9b283f60109a24f37355bf05538", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581282, "uuid": "a38bcd32-6107-4e5c-a2a7-38321977b5bf", "comment": "Malware payload (Mirai)", "value": "c6a753a6235c521174599676592e2bceaa8ac59a10d7e5178d83225ed81f0e2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581282, "uuid": "ad4820a9-9ec0-403e-8c3e-d73504f54381", "comment": "Malware payload (Mirai)", "value": "071a2f24c67151a40275ab0d116caf359568d40b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581282, "uuid": "228ff06a-af54-4558-a638-1d6b56205012", "comment": "Malware payload (Mirai)", "value": "8ad8aff6a4869eb69c4d013c1a391d903c0d1718e9d7859bf7678470f05daf78e5c1f4a4e0922bc3d07f8b659bd15377", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581282, "uuid": "78f79ef2-363a-47a4-97b5-d91454245860", "value": "T106531C01AA418B13C1D32BB9F7DF43687B2179588BDB3341AA297EB42B837DD1725321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581282, "uuid": "606b297d-ffd1-4e84-9105-9754eacaed7f", "value": "1536:C8PiqXHv55bRUItvr0PTK8gFqBUfQHlqowX4r:h1XHXNdr0PgpfQH8owX4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634581282, "uuid": "af1cff3e-8534-4550-afcc-b504b292035f", "value": 65378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634581282, "uuid": "83bdd740-3c87-476e-8b7c-87fe8dd68529", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581282, "uuid": "9a612e5a-f53e-435c-a050-fa75380a1bbe", "value": "0ce2e9b283f60109a24f37355bf05538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69143b57-2fff-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1634553456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553456, "uuid": "3265d0a2-7453-4fd1-8eb1-175e0c177418", "comment": "Malware payload (ArkeiStealer)", "value": "be89eef16c6bff3aeba20d44c6fdd929", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553456, "uuid": "9a822f8c-1f2e-4d56-88a0-0f34613f9139", "comment": "Malware payload (ArkeiStealer)", "value": "c7cd466599c4d2052661164355ab037a917291751887e7ce1aaed1cfe035017b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553456, "uuid": "8ab4bf14-4a24-4226-929e-db5a4422fcc4", "comment": "Malware payload (ArkeiStealer)", "value": "d44f6f4e6fe33b0e7cba06d158c06d91c3f641aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553456, "uuid": "d982e3fb-6fca-4e85-b21f-2eae23ae6505", "comment": "Malware payload (ArkeiStealer)", "value": "b2efd88a72b229a64d55446488a100252d49370f3e45108dbd3d07c4cb154ecd594e0536b3a98cda7ea7ae1df0155bc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634553456, "uuid": "565eabf4-2c9f-41e8-9da8-e2912d1d6332", "value": "T14B83EAD2AACD949FC470D5F256C293D305FEA9F099720607257BBF581B2680F6A63F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634553456, "uuid": "9f77daec-49d6-4a82-abc1-71a67dd9ea46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634553456, "uuid": "369f64d9-a85c-4d07-8be0-a68a6dddbcf9", "value": "768:SzEqg7wuiDiylCw1VvMQGIl7Q+DLBLaoUETTlzDI0soq2ZiGVGHGQG/4GmGhG/GY:4g7wuiGy48GI17LBVpU0sh4BGaL3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634553456, "uuid": "42fec25d-acbc-4654-a134-c840a040718d", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634553456, "uuid": "418b6abf-b397-4804-8ae7-a3f2778de86a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634553456, "uuid": "d5a7a0f0-ef70-44db-b51c-736586c1107f", "value": "be89eef16c6bff3aeba20d44c6fdd929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cbc732-300f-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1634560341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560341, "uuid": "f5839692-6c50-4233-87e6-2d819cdc59a0", "comment": "Malware payload (GCleaner)", "value": "fcb755961054f48694eb13170b93a195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560341, "uuid": "89e455b9-24a2-4f24-9553-3450d633d6f4", "comment": "Malware payload (GCleaner)", "value": "c864ec31f34d9628ff59965b1a43eb4ec2fa511a30d36fd45a862ff5efd7ad8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560341, "uuid": "cf1ab338-1cae-4146-b76c-c7e9db71f4b2", "comment": "Malware payload (GCleaner)", "value": "42c2269f390a22b283ca72158a0481416a139107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560341, "uuid": "58b69155-622f-4dd0-a08d-990c5e8c1241", "comment": "Malware payload (GCleaner)", "value": "f0557e1c2525da0f5b61aaaaa6a532de14197d050f45e3a3af1e0e640d77fbc70bab3a60f84cf1d9ba8f06135fc4df1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560341, "uuid": "ed9b3d5d-c5af-4243-9402-60356c4f9a0b", "value": "T11594AF10A661C039F5F252F98ABA9378A52E7FE16B2450CB53D51BEE97355E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560341, "uuid": "7d9db281-77dc-469a-8db6-aedb941d3857", "value": "f62cde959e9e12a6ba3449e452359154", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560341, "uuid": "a505a936-65c2-4524-ac9c-08f7b168452e", "value": "12288:6H2Bc9c+G8OVZqkPQItMi4IUbEbmEJyNVlmWweMMM:6HOkQPqkPQIB4IjJyNVNMMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560341, "uuid": "8b279510-1129-4b4c-9eeb-fd2614a76aeb", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560341, "uuid": "25b086b6-f198-4de1-a26a-43c1c8deee04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560341, "uuid": "5023a08a-c77f-4a02-85a3-0db229514f30", "value": "fcb755961054f48694eb13170b93a195.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fa5315-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561266, "uuid": "777a4771-dd4d-4c68-80a0-f68a59bd644c", "comment": "Malware payload", "value": "379d8c010b00c6a47b9ced3457eb9f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561266, "uuid": "e89ed594-dbc6-408d-90c3-23c31a60d310", "comment": "Malware payload", "value": "c86991a124ee494fcff2d7d0a9986436a569b29279df2d475ae236c3bf98570b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561266, "uuid": "16da1675-7600-4aec-a854-f31e0c2b337f", "comment": "Malware payload", "value": "debf52434768c5c7a50191b936053710f299bc85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561266, "uuid": "b7f59445-4789-4028-a126-dbc9dab4f2b7", "comment": "Malware payload", "value": "4933573101f7c714870b2852b1221e76c244ee4c1289f99b1fea044ef990bef82813d6086d97ab947dbbfdc6cdcd35e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561266, "uuid": "5a28ebd1-a57a-4e61-9788-e6ffd6391096", "value": "T1D494F10672659F12D9F967F6403895A303722D278051E2CA6ED43DC73E78F8285AEF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561266, "uuid": "23ccdc0b-74c1-4de4-ac61-7f23fba1708e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561266, "uuid": "1fbfb262-99c4-4865-a823-a3cc060e8849", "value": "12288:oieGrH3ZsNFzu1snxykIQVyXWG0qwEjQupf:owXZsNFzu1/kPYXhwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561266, "uuid": "af39c46d-0552-43b4-9bd5-72abbdae73db", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561266, "uuid": "23a6ed53-1bb8-4f4f-ac2c-5b689b284bdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561266, "uuid": "9ef251aa-64e2-4aaa-8907-6d26af38d72b", "value": "MT103 FOREIGNEX593935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d8859d-2fd6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634535761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535761, "uuid": "4ac3968a-7b2f-4ed5-ac25-a24fdbd736b9", "comment": "Malware payload", "value": "3f752c8a381867dabe1974e910c5e0d0", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535761, "uuid": "74e179f9-275c-4d6d-9a34-2cfe71464a30", "comment": "Malware payload", "value": "c8742d769b29773ad49ec4f4f86c68a8195e327ead54099a0ad6dfd85a7eb597", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535761, "uuid": "6dec8d88-f35c-41d8-b27c-80e1c91107c9", "comment": "Malware payload", "value": "2c9f4c8e7c093a7e9d58c02fa9877f631c7d021f", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535761, "uuid": "5f40ee4b-605b-4af8-94cb-557a65935960", "comment": "Malware payload", "value": "a9891e77ac678655bb95fb9e3f9f81a2759f2c43f30a7be4861b3fa5622b86584ea8bb884872330894ef2d76a0d70c5c", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535761, "uuid": "d1e74299-38b0-4fe3-9d92-0e984d3c2f97", "value": "T10863F8103395C52AE03A9A338FD7D2DA6735FD60BE51832B3189335F1D764A09F66784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535761, "uuid": "bcbe481a-c6fd-4481-8ac6-65a1fb6fd501", "value": "384:Zqr1C6FsGTdjtEiGwoKUPPv6DLyg8/tclFo39D:ggSFTdjtKwc66gWtcjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634535761, "uuid": "19a83682-05e1-4efb-92e8-5fc371b6c6dc", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634535761, "uuid": "d2967e3e-e453-40d5-8c29-ee44b5412300", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535761, "uuid": "5c65555f-0f49-4fc2-9f55-2f2341239a39", "value": "PO1399085.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e85836e-2fc5-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528394, "uuid": "a8635835-165e-483f-a7c3-4ebe4791fbf3", "comment": "Malware payload (Gafgyt)", "value": "27d0e5544f1666a4289df4bebae245a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528394, "uuid": "aa0a9a97-bdfc-4d8b-ab83-e20b166d0f5d", "comment": "Malware payload (Gafgyt)", "value": "c8ca0ef21f373f05ee0c95d9aaf7b3291bf67c149ba3e05c0a52369551ebaeca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528394, "uuid": "5a5a69cc-4468-472f-b8cf-f11739d963e0", "comment": "Malware payload (Gafgyt)", "value": "2404c92b01711e36fe8febd590a9f68acf8670f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528394, "uuid": "e48b7c45-a8f3-4862-a915-b93bea228521", "comment": "Malware payload (Gafgyt)", "value": "5d8c9f903814e00ec87d4e295360f58c4aa87374a13814224cb5a48150d267c48059425cde8a08b4c5e7bdb560e2582a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528394, "uuid": "ccd693d5-8e07-41cb-a296-ef409249d26c", "value": "T13FB328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528394, "uuid": "64a267cb-4ea0-4a13-b8f1-c87afdbec70e", "value": "3072:WD3l+XQzPeV91310pWudBKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCBypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528394, "uuid": "33cdd788-3631-4d09-91e1-e68c039aaa08", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528394, "uuid": "aedc2dcf-3d56-4143-aece-dd208244b642", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528394, "uuid": "fa93080c-0aa9-4a98-8685-89ab69730ef8", "value": "27d0e5544f1666a4289df4bebae245a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e514422-2fea-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634544365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544365, "uuid": "7efcb2b8-51ed-4e80-a264-74bdfea6fd20", "comment": "Malware payload (Mirai)", "value": "5dfa73d95b3e65f68c6fb46af2c98299", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544365, "uuid": "d3d3797a-f460-4a38-bb2a-64632b6f587b", "comment": "Malware payload (Mirai)", "value": "c8d92bc7a73b5669346e06951f80e4ceba4bd99e949893602f3f81b2412719f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544365, "uuid": "0f307940-834b-4215-a0e9-17b458763b3d", "comment": "Malware payload (Mirai)", "value": "36fb6fa05506d03e5c400671c3ba5ff42afde3b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544365, "uuid": "daab4ede-56ae-47b4-b7ec-3c726265ed10", "comment": "Malware payload (Mirai)", "value": "ae8cf6f3ab679d42ba0a0acb883b7ff19e7b88f8db3735c9dae80ed9384ed56ef272d57c6438763cb8c0cc9cbd3fae32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544365, "uuid": "eb3b4494-f4bf-4027-af9b-cf5513446af8", "value": "T123636DD5E8028E3CF54BE6BE80164B49F921235456D30F2BEA6BFCE36C720688E56D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544365, "uuid": "cbaf0722-375a-4d53-8e36-cb07b5f05496", "value": "768:NPLjcu/FAVAjNlGNfkL21045UOluaEAM4fhudHaeFxSAAoKP1SktL85POw:NxpjNlGZeiPPfwpaDAAoK9Skx8xOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634544365, "uuid": "68f2a862-31cf-4e35-aeaf-df4a8fd42081", "value": 70068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634544365, "uuid": "e06b168c-3e10-497d-af48-9be6f197100a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544365, "uuid": "3c7e5eec-f1bd-498c-91e6-f46142c579ac", "value": "5dfa73d95b3e65f68c6fb46af2c98299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588720f5-2fd1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634533672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533672, "uuid": "cd80a519-3827-4618-9d98-8f029fa11fb3", "comment": "Malware payload (Formbook)", "value": "4abd8d3ec12d6ff657f7c72d39cd68f5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533672, "uuid": "6ddafb18-cf70-4601-ab4f-54ea8f94e134", "comment": "Malware payload (Formbook)", "value": "ca74d0e5b26cf6d8d5e3b04c607f4dacaf6fabc78d369dcb8d3637d6ce72e6bb", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533672, "uuid": "ea77fb72-cc1c-42dd-8ea9-6e4220059c67", "comment": "Malware payload (Formbook)", "value": "ce06dedee28fe8dce78a915eba8f4cdda6e3f287", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634533672, "uuid": "e676fae3-9293-4479-98c9-53c4841c2547", "comment": "Malware payload (Formbook)", "value": "40f75c78d07d32080ff64ba9f53162effbc1f45251f64a686649c030f970400f0aeb8d552ed0c5b8ee96e160703d76ee", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533672, "uuid": "b41e5522-cc65-45d0-b792-5929cb21c9d9", "value": "T13EF45C5DA3D0543FF1329539FB3AE27C19196D848E08C98136EF7E8D977CA8226246D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533672, "uuid": "8fde9c34-4704-4de1-898a-684eab71f649", "value": "c27a46121fdf0c7d592b2676dec19736", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533672, "uuid": "1cef6007-0393-4f91-bd11-acb3d5e9e5f6", "value": "12288:U2QfYldSyZTiq8WIPK2gMrKSuAV/LFLtF/ULvFfji6O6BxB:UrfByZKz5gexDFLtF/QFfji6O6BxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634533672, "uuid": "69827de9-3ef2-4274-ac62-f1c8ea4e857d", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634533672, "uuid": "8c0a9af1-2663-4e36-a606-e7c377731687", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634533672, "uuid": "d17a11da-84ca-4ab4-80dc-fbcecef99d36", "value": "DHL Confirmation CBJ211011128996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e3d82d-3028-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634571193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571193, "uuid": "377ed007-c15c-4253-9d7e-5757935c73cf", "comment": "Malware payload (SilentBuilder)", "value": "a5e43e6fefbf9a6215abc7d568780690", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571193, "uuid": "91ebe037-cce1-42a6-9d4a-e1919b88b906", "comment": "Malware payload (SilentBuilder)", "value": "cc6ea11f62247ad3a41ff02de39f5968b7c0bbb580f07aacfdd55b837429bdc0", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571193, "uuid": "2d719f80-4bc1-4266-96fa-a77a3263a5b1", "comment": "Malware payload (SilentBuilder)", "value": "e42086dbdf02959599b9347f37edd4cbe9db4286", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634571193, "uuid": "ab673161-9e9b-4a64-bc43-c45a9e9ac4f9", "comment": "Malware payload (SilentBuilder)", "value": "fc46029284e51efca77456f25ebfb69757f6974b4df4e6211154cf3c81b1fd8e59ce9c5ebbf747542c73c8a0b583b834", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571193, "uuid": "6f93db4e-3f96-4ddf-9f6b-60ecc1ad9ac6", "value": "T1C144E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571193, "uuid": "88340696-1da0-41e2-8495-600135f9b2c5", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7W:U9jFrjmkD7IvLDK3vLvfn1+2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634571193, "uuid": "604d404f-beaf-477d-981c-6298f2ffb808", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634571193, "uuid": "b684283e-5f00-4d29-bdc3-beff726611bf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634571193, "uuid": "6514d4cf-73fc-411e-87ff-41d1e47b767e", "value": "a5e43e6fefbf9a6215abc7d568780690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f7ac3a-3064-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634596775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596775, "uuid": "eeacf75a-0994-46ed-910d-d53c1c45e363", "comment": "Malware payload (Mirai)", "value": "e48161cde0579d87b851310e5148963b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596775, "uuid": "7b4b8b56-dceb-43f0-a4d7-ae60b1bbbec8", "comment": "Malware payload (Mirai)", "value": "ccb76175d317c1e0e6d17d5e4a473f0e8dc507269598b453ee62f253df1c2b0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596775, "uuid": "e878974e-5d84-4ac2-9f1a-87a0a38bb4e1", "comment": "Malware payload (Mirai)", "value": "8a926f07b1991de186e10f5c68a5e7c25f21162b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634596775, "uuid": "0575c4f4-4ab3-46ef-b962-daedca8e72f0", "comment": "Malware payload (Mirai)", "value": "bee5bddf15d09fcc006ce7dfce569f770740f47592ff25b317d3603943cbeb02d3bd7b7c11e2feb280663864a2d923cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596775, "uuid": "ae95eb63-f3f9-4fec-9047-0eac842cffa3", "value": "T1ECE36F8ABF903FFFD81ECD3341A49A06129C890953A4AF7B6F74D408B65B10A59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596775, "uuid": "fa1bb3ad-1613-4094-b853-2c5621de4a6a", "value": "1536:1HhJyAyhsKq786SDAbCvBEYktvXEgbDrar7CCTh4DTVTsEl6ilASr:1HhJyAyhsKqI/eOkfW+CT+nPlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634596775, "uuid": "32156a4b-b371-4f40-8610-8aedfe8aa673", "value": 153396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634596775, "uuid": "1f89bfa5-bae7-4600-9e32-3e3c302506f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634596775, "uuid": "283e1e64-6ac4-437a-ba48-f08b98040043", "value": "e48161cde0579d87b851310e5148963b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1491136e-2ff6-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1634549449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549449, "uuid": "199bf686-a0d1-4446-80f5-72dff15a5957", "comment": "Malware payload (STRRAT)", "value": "94c622790b53ebc89c7f0837d95e9d8e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549449, "uuid": "cbf4be66-bfec-480b-a913-525ee278ee20", "comment": "Malware payload (STRRAT)", "value": "cd2b9d9baaab804facdaec1e54b2d1606c1fbfdd5372f1965631a26f957bcc6f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549449, "uuid": "928cbce3-61a7-475e-9754-e2a5bb37b68a", "comment": "Malware payload (STRRAT)", "value": "12eeb397fa6559dc25801c814a673db269777c4b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549449, "uuid": "e567c838-4c05-46ef-a22d-617365acb1c5", "comment": "Malware payload (STRRAT)", "value": "a0b787096b29d2fd76606a1d5975fefaa6b15eaa109b2efece29e63a65fff35d75e3f3b6359d7429b4491acf02721f4c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549449, "uuid": "eda546ad-3115-453d-876b-802be01f8659", "value": "T10004014FBEDFD0A9E4032176690EB0A2D51C2678D996D82F11FE55884C70D7A1B02BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549449, "uuid": "8e59ecd4-36e9-4661-a26e-78166618d95b", "value": "3072:NJWzA/RLMAwi1TPuEN2RAilVsSrHjlfP8o4yH1e9A7mM0gHHWg6mFtGuWHKj9x:DViCT2o/iv3DlfkOmA7d0gHoEtVWU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549449, "uuid": "d44a7d96-ce46-4d7e-b00c-5a144afe72b5", "value": 188777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549449, "uuid": "bba683a9-5882-4f60-900f-5a132fc1c9f1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549449, "uuid": "38d2fd98-2795-4721-b117-1278933b0b52", "value": "PAMENT SLIP.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011cd39b-2fe8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634543403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543403, "uuid": "f7437581-ebda-4d2d-bad1-d4f7a7a7c3f8", "comment": "Malware payload (Mirai)", "value": "9f5285d74c8e7ee2e900b89f850604ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543403, "uuid": "c2f51e78-1bc4-4c14-acb4-031652341594", "comment": "Malware payload (Mirai)", "value": "cd9c621c0398dd8935890ffbe48a6cb1ebf8e7170b58b2a4981d98813d121282", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543403, "uuid": "80678f0a-6668-4698-a02b-8e1bcf77ed89", "comment": "Malware payload (Mirai)", "value": "89a18a364ca2e4dd382c57f50cdb4402b92a2bfb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543403, "uuid": "5cd3298e-43c4-42fb-b7eb-a8fb3b0c3e1f", "comment": "Malware payload (Mirai)", "value": "0abda4e87905073241fedebee396dd77c6470ecc223d4ad849f10dc5ba152c83db753edc4eda234c840f96bd30b69f1d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543403, "uuid": "7fa36acc-e253-4158-8bda-a2580cb887e0", "value": "T197F2F15659DC4D1AF5AA203C1AEE7D43ACD0BB161144A33A6F80323328F8F056FAA205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543403, "uuid": "fceca330-2c3a-43d8-b0fb-eeda30821167", "value": "768:5kJ7XrGvV2XQ6bbPRlMzVxLrGHGL51bkunbcuyD7UHQRjI:5kpGcTbbZlMzVxLrGHkf9nouy8Hyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543403, "uuid": "76489a24-9c97-422e-99d4-9a00152b2e37", "value": 36152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543403, "uuid": "d3cc4efc-a5e3-48f4-8a0a-04fc4b692587", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543403, "uuid": "75bd9820-4198-4e64-9fd3-bc722fb51f30", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f819f552-3025-11ec-843c-42010a9c0014", "comment": "Malware payload (LimeRAT)", "timestamp": 1634570017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570017, "uuid": "51a1bf31-025f-4161-abf9-3bd689ae796f", "comment": "Malware payload (LimeRAT)", "value": "b45c61350ecdc4abd20c7b0647de3e99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570017, "uuid": "0807d649-da5d-4b3d-a664-bb85ce43a812", "comment": "Malware payload (LimeRAT)", "value": "cda57d12ed16414f52bfcfe2f3234d0fa5eb259aa20a59568cf040f6958047eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570017, "uuid": "73fc024c-e1b2-4263-9987-f61aecd1ad1d", "comment": "Malware payload (LimeRAT)", "value": "7e41c5a900ad51626d37a3355d245eac826a1509", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570017, "uuid": "a820a909-725a-4037-820f-979fbd8bd8f4", "comment": "Malware payload (LimeRAT)", "value": "b22c602cf0efe4531880c6c92b3848e88cb3f7e4fdfae130ff272678b2c389b1c8b9fe02e82577c49d660bf08da94a31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570017, "uuid": "60879d71-9ac2-4f3e-8b18-b8cd6495017c", "value": "T1AAA4933A6CE8127BB5779AB0DFF505C7BD1AB4933A41084EA49E03420A13F53BDE616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570017, "uuid": "05a24d2b-b19f-4dd9-875d-74a0a8525de0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570017, "uuid": "0dc4080e-ab57-4bb1-9d24-72162986c38b", "value": "6144:sFSkF/Kuq5K1GRVNXjEuZFkLMk/lOF4E91cQoO4s:eSkFMo1CNzEusLMkdOFh9/oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634570017, "uuid": "44a11a58-3809-410a-9e28-81f7628c96df", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634570017, "uuid": "f9cb6055-8a08-4249-aa51-82f3ecf700ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570017, "uuid": "b88e5ab3-0ea2-4fa7-9c63-53fe60965bdf", "value": "b45c61350ecdc4abd20c7b0647de3e99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3456ccbb-2fd4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634534899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534899, "uuid": "a21e3bc2-4e8b-4486-a330-f53f40a8d59a", "comment": "Malware payload", "value": "92a163f9e4a6908a32e5369499d5ff18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534899, "uuid": "336f473b-071c-4456-b75b-4071681ce6ad", "comment": "Malware payload", "value": "ce03067e95f06e37315475ea0a5732c358f3f4fabdbfe9d128040fdfa17d3a27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534899, "uuid": "cb8e335b-ad97-42c3-b9d8-0619f0fc8271", "comment": "Malware payload", "value": "cb2f7833e76b56381f593d7842c3e4ef7c13308c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534899, "uuid": "714174b9-0157-49f9-9f9f-789fa127a3d6", "comment": "Malware payload", "value": "77c9711116f53c22eb0dd48da0f8dece0d604ab4c685a400af25cf023e987a73795b7d6ab45d3d0f292d1a8b5afd3813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534899, "uuid": "33303d42-cdc3-46af-a3bb-8e424417ac09", "value": "T11E833911A7F90068F3FBAF70A87244945E73BED1BD75D91C0549028E0976E69CE78B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534899, "uuid": "9c3aa6a2-5c9b-42a7-bffe-b2581b03c068", "value": "1536:lIkbrUXP+d0ylFTSy9hbx9PSvb2E2jrrLhfursGdrE:ek0XP+d0ylFOy9hbx9OePrVW7dI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534899, "uuid": "fbedeedb-15e0-4d22-bfa2-c2ac56efe8d4", "value": 86566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534899, "uuid": "2e48376c-248f-4b81-ab99-4d2bfb085205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534899, "uuid": "15b99222-a568-42f4-a2e1-2166f112e0f9", "value": "92a163f9e4a6908a32e5369499d5ff18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa673138-3054-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634590207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590207, "uuid": "300f5e99-dddd-4fc2-be1a-591b9340f91b", "comment": "Malware payload (Mirai)", "value": "f3886a7c80ff5f7b6f84bda3a9aa4cb3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590207, "uuid": "dabe277c-8086-4725-8796-f9a5c42a41bd", "comment": "Malware payload (Mirai)", "value": "ce27c42c402cf0683692545b454866d7a1daa2c417e9631c70cec0d2a648c3a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590207, "uuid": "07708b59-579f-4e85-aa80-bb5abf74229f", "comment": "Malware payload (Mirai)", "value": "f3b76d420fcc24eed78c592d464d5cb5768b758d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590207, "uuid": "1237522a-43e1-41b9-99e7-9bbd6b15b909", "comment": "Malware payload (Mirai)", "value": "581b2ae04fd247243dae5523b070d36a074e1661cc319770a7829319a0978121c4aaad64a5910103b2d80b821f9b2070", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590207, "uuid": "c0ffdc26-20b4-4de4-9686-ad401e56d8d4", "value": "T11333D795B8D25A2AC6E4237AF9AE40CE332073E8D1CF3217CD151B147AD592F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590207, "uuid": "b340180a-9d52-4893-bffc-7f7f31f6ef8d", "value": "1536:S5Z4fJ6tL/yXFeL5zvL5nrHwcA7WhKpQY:S5ZIs5LL5nEcAihWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590207, "uuid": "04782d83-f1a8-451b-8868-487fa2228a98", "value": 51168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590207, "uuid": "9584b1aa-cb3c-4340-9555-89601b6302d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590207, "uuid": "87827649-b945-4e0d-bac3-e3c0600a228f", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cc2d36-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561257, "uuid": "acd407c6-c8b5-4d0c-82da-7208c9c2bdee", "comment": "Malware payload", "value": "61bf33ab98f87c8ce63ac071fee5694b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561257, "uuid": "a603ef53-fdba-40a0-a063-991d704d6ca2", "comment": "Malware payload", "value": "d0dcb9acc3a86658c7a855468a788d3d2fec3dd641afa1190d54f09869f59432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561257, "uuid": "6cc3f31e-e5bf-4188-97b1-9514ff004967", "comment": "Malware payload", "value": "63fbd443feeede31d8948ab0c4f653bf2359f3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561257, "uuid": "4579d3dc-8711-4d9c-9c3c-36d374380cb2", "comment": "Malware payload", "value": "ec6b4ab8c5fd77bcaba86a4b36b4070951cb42b960b9632c8160406e5e42ec786ad5bf6b240dc083622ed2871b4e349b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561257, "uuid": "7afb3a7e-f03b-4ad9-b081-fb68146ab5e6", "value": "T141A4F19671269D3BC5A510FA843D229F077359178056F6CA8ED6BCCF3AF8F829129703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561257, "uuid": "5c671dcd-e51a-4245-83bc-447acf6ebf56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561257, "uuid": "f26aef99-1f4a-4014-b86b-eed1d03011a6", "value": "12288:no2mbvG6g2VGibclvvMMnnahvQVSXTg7IG:nwVGYWahvlTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561257, "uuid": "3257fdd9-d25e-4915-8584-b6a25c9d5ac5", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561257, "uuid": "7462d7c3-b30e-4da6-b98a-6470fa0eee25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561257, "uuid": "24c24bd9-914d-4d6b-96b6-f609e5cdc52a", "value": "BK-I 211018-901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d522b096-2fd3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634534740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534740, "uuid": "ec80806e-9b94-4de5-96a2-f927821214ad", "comment": "Malware payload (RedLineStealer)", "value": "b0be1a6928316ef41ef9565e34043198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534740, "uuid": "e7fd3257-a90d-4632-a331-9bccec154e3e", "comment": "Malware payload (RedLineStealer)", "value": "d12b53aa0b3111263adaf71e51eeab2ba64ca6c4525800af541767fd90346039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534740, "uuid": "41939c2c-91d4-43b6-bf20-5879b5062ec2", "comment": "Malware payload (RedLineStealer)", "value": "a3b6b3d4874388a3100360298bf91a0ff8df8115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534740, "uuid": "1d0c0010-2df6-4207-8f00-2c22fa90a458", "comment": "Malware payload (RedLineStealer)", "value": "c4db4d305c86e0d002e8f6dcacadcd0b27fc92cd1ccfa0d8577df3f56b01348f210e69cd4a34cf7afc7ea2673cb27547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534740, "uuid": "f993f032-2cb0-48f8-9bea-801fac52af98", "value": "T1C1949E10E6A0C035F5B662F48DBA9368A52E7EE16B2460CF53D41AEE97346E1ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534740, "uuid": "af8406bc-d00e-42f4-af20-1c3a80d5debe", "value": "578dc7dab5389346cbcc286cae0d11e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534740, "uuid": "05b958cf-b291-4b00-a0c5-1a9d04cec311", "value": "12288:pl4/h+lXvk1Ua37fkVHYkldnS57CvaamH7XL:pl45+lK337iHA57CvOXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534740, "uuid": "98a28092-14f0-452a-8271-bb26cbca16d2", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534740, "uuid": "f7b3c289-a54b-44a5-8f81-e44b754fb148", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534740, "uuid": "007e1ef9-111b-4538-8a11-684beffd01ed", "value": "b0be1a6928316ef41ef9565e34043198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10f24c1-3034-11ec-843c-42010a9c0014", "comment": "Malware payload (DBatLoader)", "timestamp": 1634576394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634576394, "uuid": "27a147e8-1714-47d6-b8f5-face47a65dae", "comment": "Malware payload (DBatLoader)", "value": "c53a2d5a0879fdf9185e6e2f515172a4", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634576394, "uuid": "36a8ae80-30e8-461e-9d19-e03fd4cf1947", "comment": "Malware payload (DBatLoader)", "value": "d17126f7455b20a86a6dc9a789dbdf2a1cc366654125a70edb54864f2669cf00", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634576394, "uuid": "390c6372-4220-4b20-a069-b4ec13c34181", "comment": "Malware payload (DBatLoader)", "value": "8258d5269406605414379469159c4f553c7b3c41", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634576394, "uuid": "b557fdcd-9378-4f05-9eeb-d3217fd22ed1", "comment": "Malware payload (DBatLoader)", "value": "479469c18da6668cc630a2c8f8ad2c6254d95bb53434f826066a7d2beca4dc37a266cbcf36f2ab09cb30bef67fbb6db9", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634576394, "uuid": "c250b12a-a170-4421-9756-a78807dea4b1", "value": "T1AB059E9EE59004B1D2E922396E2B3767E02E7E645EBA31859FF8781D4F7C74021386C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634576394, "uuid": "e7b4e249-add8-4c98-8f9b-e8c58dc286b2", "value": "9d6254f1666ec7df9c70515cf5807dca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634576394, "uuid": "45e535aa-84aa-494f-9d58-f3b4a5986a13", "value": "12288:ngXbE33TJYei20w6R5ghlWIWeePcfzqzqyjFPKncY:ngXozJzix84eeP5H56c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634576394, "uuid": "e9473c93-075d-4735-a637-fac2391683cf", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634576394, "uuid": "b6cb5ad2-d76a-4ea2-a94f-2e0ef1464fc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634576394, "uuid": "39d4f2c0-6bbe-4046-a851-852a7f54904a", "value": "invoice swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04496ee-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634561333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561333, "uuid": "ec578b17-5f70-4bb8-b917-e5dda214bb32", "comment": "Malware payload (Formbook)", "value": "a8e3b5b211ec454517c8d8fc7b0739e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561333, "uuid": "e9f22eb5-7e54-46bd-a27c-2d10806cf1c0", "comment": "Malware payload (Formbook)", "value": "d17dc5760a94c6a8d85b462dfe3cfdf40917e670513dadd5fd5eeaa9941106af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561333, "uuid": "58099ab7-2607-4d18-8f52-70dc8c65fc5d", "comment": "Malware payload (Formbook)", "value": "b4193534f86bfd3e1a46530b3b129249eb463495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561333, "uuid": "b478c715-4f1e-4de5-ba0d-ea9dbdb4897f", "comment": "Malware payload (Formbook)", "value": "109ccdd37f20850b5a9d775f4aacab2a4790258597b9bb88c99ff0e2ae43e52927a905185ccba24b5f1551d85de9ca5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561333, "uuid": "e12021c9-5726-4b53-943f-8fa994a515e5", "value": "T182B41245F744861BCE2907B060B39AB80376BC797EB0DB9E5ED930B90F737820926567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561333, "uuid": "8efba410-10ce-4080-b338-1fb657f8d71f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561333, "uuid": "fa55f9ef-cfa6-47f1-9eeb-c109aaeafede", "value": "6144:ic5qnIgx6xXb6O9O+9kwLuHBPNTTPNl7qpNVDD4jzhA9lJpUxvAxfkIYV:iDzwJWOhRkBVXNhq7NDW4pUxIcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561333, "uuid": "7b0170ab-b8bb-4199-afb0-df0eb5fee0e3", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561333, "uuid": "fcc540ae-dde3-4395-8ea5-00be32305a42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561333, "uuid": "9b747d7b-21ee-4fb5-abf6-272c9ab72066", "value": "REQUEST FOR QUOTATION (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f350e08-3005-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634556070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556070, "uuid": "b3f1d083-d15f-4b99-b8f3-1dadd3742bd2", "comment": "Malware payload (AgentTesla)", "value": "06ca1a5736b494936c1be9d3855a7c3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556070, "uuid": "a0cfa622-7110-4545-92dd-7fab4d1d1efd", "comment": "Malware payload (AgentTesla)", "value": "d240fe59e56ffa5d4a0f46043b6661f4842fccfc284e6b4d12ff59de67b3a162", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556070, "uuid": "43774cde-05db-4e75-a5de-d85896860a60", "comment": "Malware payload (AgentTesla)", "value": "6337e0b8e7203e1fa3afd6fa0bc95028686797b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556070, "uuid": "5fc61eed-231e-428d-a6ea-e6356a0bf093", "comment": "Malware payload (AgentTesla)", "value": "58a5458906ed0bdf8d7178b3076d39af2cddff4fbdd3347bb5f1c76e9ba4558b8f6db15905f5d7405032614c49924a96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556070, "uuid": "b9ef10a5-d877-46b7-b33a-5a0788e1be33", "value": "T1E074C061998C77EBFDA54434948985F2956CCE9C66293302FB8C366A8332DBCE1417F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556070, "uuid": "e8d851be-3970-44a0-90e4-e43ea30a96c4", "value": "6144:vjiBm5BqBOFNODlvN+DSUwfdB2UPBQM+5Zl45d71dZpz2KAbTVxDbqiKKTHvy7:z5sOylvN+WUwOa+5sd5b0CoTHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556070, "uuid": "9063ec86-10d2-4ae2-b627-ffc9f2e4d828", "value": 351352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556070, "uuid": "d31d005b-b4b0-4b70-9731-f7afdb967f1b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556070, "uuid": "e0d516f9-4a15-4d01-9468-486600268520", "value": "presupuesto.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5afd2de-2fd3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634534714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534714, "uuid": "f1ce92ed-9231-4051-b186-ad2586ff16cb", "comment": "Malware payload (Mirai)", "value": "cb8844c8fd2a48759e06b5e9751dab5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534714, "uuid": "972466ae-e3d5-457e-a93a-453f0824d384", "comment": "Malware payload (Mirai)", "value": "d24282acc6baac0ac1c381503da1fbc95d85aa9648f2f6f611e6932f9a9161c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534714, "uuid": "5bea3c3f-fd88-4c06-ac0d-a972c817cba2", "comment": "Malware payload (Mirai)", "value": "f970ac50833e34bda8d68f80f4bf55a7c3609ff8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534714, "uuid": "1f7ea6cb-3ef3-416f-9002-1b6aa932edc8", "comment": "Malware payload (Mirai)", "value": "08e645ae002662dcb65a677ff5a8c306d3fde878a0152d3db86dc430f787482109aafa796484c3d0da6071d23776bf12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534714, "uuid": "3fa09a80-1e5d-4a15-9026-b49d17233ad2", "value": "T167D2E0B87816405EC97AF07161680F580BFA7FFA964B8C42CC0AA746AD943F43E577D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534714, "uuid": "3967485f-fa44-4dbd-b62f-451ceb70462b", "value": "768:Eo8Q8UyQnJeTH5L5d9G0CZSmdACO1F8JgGlzDpbuR1JdM:E5UyVHd9G29CO4VJuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534714, "uuid": "40b930e1-8de8-4e5f-92ac-4d1d274de65a", "value": 28804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534714, "uuid": "ea46618c-9de8-441e-98c9-506460f3974a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534714, "uuid": "c5125152-83cf-4035-a36a-7ddfabf426fb", "value": "cb8844c8fd2a48759e06b5e9751dab5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd3e4a2-2fff-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634553302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553302, "uuid": "76f2e2f0-46c4-477d-a893-2187ce8d17d1", "comment": "Malware payload (AgentTesla)", "value": "cbc2d2fda4346646489382819fb07d61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553302, "uuid": "0257cb88-9211-401b-8577-311ef97e1299", "comment": "Malware payload (AgentTesla)", "value": "d2606cc6318b1e0c21de14cf79f8e06652e783e9239c84eec8bd2b0582ab6cd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553302, "uuid": "b16edb32-b0b5-4919-9b30-772498336856", "comment": "Malware payload (AgentTesla)", "value": "9b3768e6676984c90a0ad251a588e6b0ecfca365", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553302, "uuid": "697f3a6e-aaee-416b-89ce-36689fdb91a1", "comment": "Malware payload (AgentTesla)", "value": "4e15a9cb9b83a7094e9002fdfb9842a19200a070e54a3d1292fbd7e06dca9761a39cd01f80f2320faf23262a291aeeb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634553302, "uuid": "effb1c25-748c-4422-876a-77b4550363dc", "value": "T1E2F4D0B6038047AAE3C90BD0411AA10F15F2E5167564259DEFB36EEFBC2ADD35878273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634553302, "uuid": "b0bab011-543f-45b0-be04-7d433651b100", "value": "1536:H0DwVcA18t9LMTdDBaUv280jUSDrBlmpVs7ab/vD2uBgubpvG+K3LTbPdTfnX4mB:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634553302, "uuid": "fe906bff-195b-44b6-85d0-58baebe62697", "value": 778222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634553302, "uuid": "5905c232-a43d-4fd4-b918-9c48520fdc36", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634553302, "uuid": "5da7de9b-903e-40bc-8520-4ce0cb152b5c", "value": "92c492_8f22087a2c0740eba07c3aea05e107e7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf59afb-3007-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634557058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557058, "uuid": "ad79877f-3cf2-4be7-ab70-6fcda3a872e3", "comment": "Malware payload", "value": "f480fc1afe995ae4cafcb89b83295d88", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557058, "uuid": "21e0b743-de88-41db-9dfb-1ca65d03e8cc", "comment": "Malware payload", "value": "d29f6c42fa70b462166272142d33012c41c471ea2c02943fae147fbccd5420aa", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557058, "uuid": "332eadcf-4543-4e09-ae47-9f765f0a2cd8", "comment": "Malware payload", "value": "441f53d97186305891267b6b98382f2a0fa180b7", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634557058, "uuid": "25c0c04e-d8bb-4558-af8e-3953ee07384c", "comment": "Malware payload", "value": "fa676aea149058a148e5a6177a50a2b39c481926301e31520fae15f5b1738fb22e3b524913c3b7e6b2fd5bc6ea8dd0fb", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557058, "uuid": "e1c5c448-fd82-4617-b723-ebe80f9048a4", "value": "T189432A657A66C98AEA9657364DD2C6DE7336FC519F5B43073204B32E2EB92C0C903707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557058, "uuid": "2b5f4975-f712-4d7a-b9ce-45126be59bdd", "value": "1536:SsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0zCoyp6p2UUaVgO8f4QmMC:ShlYkEIuPm3fNRZmbaoFhZhR0cixIHm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634557058, "uuid": "97812cc4-2e59-422b-a632-fdb5b18cc74e", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634557058, "uuid": "0e89429c-78e9-401c-9aa4-36e64e34c472", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634557058, "uuid": "869788a1-475a-43f1-a798-a70a4a7268e1", "value": "004134747985_4.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d4aa8b-3004-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634555751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555751, "uuid": "8a11d7de-03c4-4061-a3b2-53df08018b5f", "comment": "Malware payload (RedLineStealer)", "value": "bb579d494f480862e4c289a42b069532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555751, "uuid": "d527112c-9ac9-401e-bcc3-41a78b1a19e5", "comment": "Malware payload (RedLineStealer)", "value": "d2e0c9a267c6b765783c9ba17c2265571fc6681010582fb0d1c7f51c6a2ce6ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555751, "uuid": "e135068e-f9de-4280-a8d6-8f8635697e42", "comment": "Malware payload (RedLineStealer)", "value": "837670cd86fb9c32dd7ca00946fdc1ede1646349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634555751, "uuid": "c4a62ff8-fc5c-4032-9b67-bdea95fa29a3", "comment": "Malware payload (RedLineStealer)", "value": "57283d50d0e90ab7a171d4c423327b43ab31af082d2096b3c3f3776ae236f8f2fc45df3dddc7b6e925566fc74c0a8975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555751, "uuid": "1a3aa605-06cd-4ef6-a15c-38986302fa4a", "value": "T1B3C5238796645803ED9BA8B031EDF6136D36BB911BA1C1EB1499F0891F637D03B6C31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555751, "uuid": "a1b8459e-addc-457f-8a55-6df20479f232", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555751, "uuid": "282a450c-8371-42ed-9683-28d40c043113", "value": "49152:6eYNgxxv6FyJgJQ4n0PHuDSFHMacvr+YLhl8rvKIuB:66xxvV3RvkKpcvr+Ydl8mF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634555751, "uuid": "f03f8f2f-52a9-4d1f-9ec1-a4c03234972e", "value": 2726416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634555751, "uuid": "4eeecc0c-ab76-4f5e-bdba-87a0fe818a1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634555751, "uuid": "9a6048d0-de45-4a07-b3b3-5ce218c99982", "value": "bb579d494f480862e4c289a42b069532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420ba923-3013-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634561981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561981, "uuid": "ed351c3d-e6b2-4bac-90d3-16d836d9033b", "comment": "Malware payload (Smoke Loader)", "value": "33eeddd38b08c28a5466eb357ab2401d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561981, "uuid": "de5e0369-6289-4ef6-bb67-5a5f5faad070", "comment": "Malware payload (Smoke Loader)", "value": "d395decedde3ce22737a67d9b4c781e591f4c3cd2755da66dca9d0b2885fae68", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561981, "uuid": "c99e1e0b-8421-4b95-9b01-9477c865f021", "comment": "Malware payload (Smoke Loader)", "value": "44a043cae0c9a07cf27d6cdf22f6a2e3ae9465d4", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561981, "uuid": "2ae8d676-3d99-4755-90d6-35b1323d594f", "comment": "Malware payload (Smoke Loader)", "value": "cb62a1283675ecc4e03234efe721229ef2d193fbe976a47a49b9d6a7aee1e525055e01257987b959dcb061f5ee72d34d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561981, "uuid": "6f174b20-dc59-4f2c-9e8b-0763e6e4ab37", "value": "T1CB747C10A790C038F5B362F989BA5378A52E7FA16B2470CB5AD526FE97345E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561981, "uuid": "8be3414d-f380-42a9-8b0c-d8937f375f60", "value": "d29112deebad1bc2847e7571006fa346", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561981, "uuid": "fdaf492e-5c67-487f-928d-c1d8022913c3", "value": "6144:t+XWS1QsItYALGhaf/v7dz1jKTznx7+I+hy0lGd4ZX/:tMWS1QswLGcf/vRJjKnnx7mhLGWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561981, "uuid": "4885e6be-f67f-4a8d-8587-98097fb0bce2", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561981, "uuid": "672e3cf8-b56f-4698-bc9e-7830472269e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561981, "uuid": "62db2e4d-d819-4fda-b005-82bd64a32eaf", "value": "33eeddd38b08c28a5466eb357ab2401d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d65731-3054-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634589965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634589965, "uuid": "2dbb03fd-bb17-443d-9815-5fbdea5196cb", "comment": "Malware payload", "value": "e45200d0fbf1f466a956725610124eac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634589965, "uuid": "f9422e52-ddba-45d0-a172-b72e88b3d87b", "comment": "Malware payload", "value": "d3cfc436366c9d127c7a6233f6531cf6e5863153b41ba4ab6f8fe87f473c8c9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634589965, "uuid": "1f9d26d2-5b87-4b76-b74b-86128a6d5893", "comment": "Malware payload", "value": "e272e2d6c2bf6a9497fd48500b1c088bbc90b9c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634589965, "uuid": "99a54f67-b5a1-4f01-b18e-41c3c0e19c5f", "comment": "Malware payload", "value": "70e1ed7e3c71bef1da30039a9e47ecd4007fd13eae34b0604cb59002af3d68a4ea19def96635622e061a2cbd19f098d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634589965, "uuid": "617c7b14-b1b9-43fd-866c-869465d1d222", "value": "T1524533B6CC181C0ACD2E877534C1C42FDF5C7315A3701936962FE9A4AAE9FE6511C3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634589965, "uuid": "b9ae3c2c-d14f-4693-972e-5dcd3370bc3e", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634589965, "uuid": "9109992c-8a9d-4de0-9605-dfc2b8c10995", "value": "24576:vpeyqYiQGwbogMvsJY1eI0HUYIXpxAax1Rp5RdifBG8sh/Z44juzr:INwMg1J7xtoLAax/zRhRRSzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634589965, "uuid": "9a28533d-d854-412c-927d-139815aa9d04", "value": 1185760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634589965, "uuid": "1b24fc72-f00c-41b6-be77-c5ba256092a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634589965, "uuid": "b39df59c-b8f0-4cde-8878-e04d96bc7d73", "value": "AxieLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346c5554-2fee-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634546066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546066, "uuid": "6b00fbd6-4065-427f-8179-f47deae6861e", "comment": "Malware payload (AgentTesla)", "value": "990c9fb69884ecca7649e09a19a1fdaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546066, "uuid": "c5729c6d-72aa-4db3-9e0f-9536f6d47054", "comment": "Malware payload (AgentTesla)", "value": "d4023ad4b61e07c4b45673cde0069e4acff8096e0578083ed614f1143a434c40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546066, "uuid": "c60144b9-bded-400a-af4f-9f6441127de3", "comment": "Malware payload (AgentTesla)", "value": "730d6bc292b7e9d0777d1499d376109220d4db06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546066, "uuid": "57c7a3db-23d9-4799-a6b0-bd09f3f36379", "comment": "Malware payload (AgentTesla)", "value": "003c2bb659a6e61d59c6093c88ec9d329b55d43af408a96c4f787112fc72a003dd59926e67b760bb522448f933a05be6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546066, "uuid": "519e07ae-14f5-4515-97e7-bcd289723e8d", "value": "T16705B018B7086954CB188E77C237425993F8C0A7B36FF33A34DAABD49C97513AB0A5D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546066, "uuid": "45d91cbd-08a8-4f88-9bdc-aca7d2b21695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546066, "uuid": "3de39727-4be1-4897-abcb-c0b258eae256", "value": "24576:znN+C8bmOKhtPU+fmaB98IfLSe0uFLG8/R+qChZUMkLz+qcPNciJD9iumhZ0s/Y1:YZbmOssBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546066, "uuid": "13f9ce09-ec3b-4b8b-aaa7-351e11a74a1d", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546066, "uuid": "836b7d79-9999-4a50-98ab-c16cb1c998d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546066, "uuid": "e5b9fffa-5252-4aed-be3a-fd5934b8f458", "value": "DO1021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460e7dc6-3056-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634590764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590764, "uuid": "3f060a0b-19d0-4095-bbf0-6a309e1589fc", "comment": "Malware payload", "value": "617fa0179305135efccbd9e59b868319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590764, "uuid": "27a6035c-c9d6-4779-8e61-731cd84f2b9f", "comment": "Malware payload", "value": "d4175c950334f24c3c25cecaef91bc0fed5d8004a2bb735a9c1376109c5b7b31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590764, "uuid": "1789bfba-05dd-4d37-bab0-74d27e88dd5d", "comment": "Malware payload", "value": "136082a7415de99a6790f8d25e5d11b10401dc8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634590764, "uuid": "14c37db8-2b31-4286-b1ed-0313f30c7844", "comment": "Malware payload", "value": "30de7ef20c39c724ba83d114c10386e116f05f995dce47538524df2985a09f53e6fe38a32c04cb7138199ac9005f63e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590764, "uuid": "336ced64-ae1a-40a1-b5aa-058fe8e19819", "value": "T165238D126B9C4122DA1B0F3680F45101A778239A3709D73EBE55E09CEED7BE25B6237D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590764, "uuid": "f3a33782-29c0-445e-9f05-b8c8cb5a53b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590764, "uuid": "dd940428-def4-4f4f-9a3c-9a8496768a0f", "value": "768:U28Cndv6/864W/+JUpqYE8c13fAFNM6V+t95pwMeKWPNhoL0PIzRshLhK:jFv6/86BGJUw13oFh+kKWFhowIzRsh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634590764, "uuid": "4092057a-d568-423d-9d53-85bb0d40e193", "value": 50104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634590764, "uuid": "83dcde41-76a8-4f97-8de6-2900a79fcb1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634590764, "uuid": "5a7e3e80-65e7-401d-9e9e-c441775fb994", "value": "Updated Soft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2213791-301b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634565605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565605, "uuid": "df2f2c70-0362-4a17-9600-68ebced290c7", "comment": "Malware payload (Mirai)", "value": "18009ac70683b98231679e7034a2104b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565605, "uuid": "e08025a1-731a-4b70-85c5-29d024ed4a56", "comment": "Malware payload (Mirai)", "value": "d44a1f96246ddc985311fbf863a06d5d60f459149bb0a07f5fc16dcd3cff3d7c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565605, "uuid": "ce9d1326-c87a-4086-9c25-f4e60b695f69", "comment": "Malware payload (Mirai)", "value": "9aea4e20c97cfae19d71ad4985ea615baf82536d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565605, "uuid": "67e9de2b-ba1e-4ded-b151-03267dad1342", "comment": "Malware payload (Mirai)", "value": "b9f928c53e8dfec2235ae4e9469d72766d9d4a89f68ddf5581f7325ed798c834be00e13afcb6e0c487cfe38ecfe1aeb9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565605, "uuid": "8f2886b6-6fae-4fca-a474-80b24e51d6aa", "value": "T1FDE33B86EA408A13C1D5277BFAAF014A3322DB55E3DB73068D185FB43FC6A5E0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565605, "uuid": "dd2bcbc4-caf7-45f7-a7e0-5d878f8bf1e8", "value": "3072:t1a5fdUEjnBGrYkRaaWgV9mrsplDKZUmQBKXAVanlX+F8JyvG4hLnAVIl+3jJNxj:tc5f2EjnBGrYkRaaLV9mrsplDKZUmQBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565605, "uuid": "3c9030b8-5660-4229-9a31-c2231797e949", "value": 152486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565605, "uuid": "e32552ff-7240-43e5-a8fc-ef239dad0bba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565605, "uuid": "42282b7f-665a-4e34-b6c3-953a0c08974e", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f33d694-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568445, "uuid": "4a1db446-76d3-4361-aa3b-b5970acf269c", "comment": "Malware payload (Mirai)", "value": "b2d9c1cf2d282947f0fcae56b0ec58f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568445, "uuid": "85213d2d-fee9-42b3-b978-1489a2ca4f82", "comment": "Malware payload (Mirai)", "value": "d48153f732a7c0bde9b6679c9b4c501e159d9b758aad95b9881329177b7e6740", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568445, "uuid": "fef897a4-d25c-4aa7-af7c-5ff86ece6e08", "comment": "Malware payload (Mirai)", "value": "5c80ffdad1f259a4e91f3312edcdcfdc64f26d21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568445, "uuid": "310b2232-dd61-409a-9132-f4753f8027b9", "comment": "Malware payload (Mirai)", "value": "476ae8d9cd913a38ede6d25e7c9171c8e7c54d0b263b237da7a1351c912deb327cf2c06b2c7de890fef99cbfb48720b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568445, "uuid": "b0715c53-65df-4867-8354-9c7283666f90", "value": "T17B73AD33D1686DA8D0664B75B9988E309B23A28416937EF6D794CB784013EECF509FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568445, "uuid": "8b3dcdc3-7ba7-4854-9e58-2b58b9578b44", "value": "1536:9aD/MEGvbwt+i7EhH1Wn8C/0rrnmFllrKkNGIkFgCJl2c:9OkdzeEhVe0rjElOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568445, "uuid": "fb5b7830-27eb-4baf-9bd2-6c09ac61833f", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568445, "uuid": "655a23be-894d-4d3e-bf6c-28310ec53598", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568445, "uuid": "04d6e5d5-ef8c-44a2-8f60-059733d4b616", "value": "b2d9c1cf2d282947f0fcae56b0ec58f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285a4064-3042-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582124, "uuid": "15ee810a-9d1a-4e2a-a670-4d73a7de0449", "comment": "Malware payload (Gafgyt)", "value": "3bc19d12a1e895d9fee065601c8c984b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582124, "uuid": "19868ecf-e5aa-4cfc-82d8-acae000661cb", "comment": "Malware payload (Gafgyt)", "value": "d52c6e2bc002758945509abf5919d803c75b7a32290d274bf4e2daffda9957a6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582124, "uuid": "9f9c1041-4802-47b1-8063-702f8eb56d06", "comment": "Malware payload (Gafgyt)", "value": "f44257b51aed9c9ef3723c64199f2d19487d3f9b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582124, "uuid": "3b425db9-3388-406f-966d-17a0dbeb40d9", "comment": "Malware payload (Gafgyt)", "value": "6f7aa8129b4b21e849f75430aa4027c2c57bd2221e6ad8233441a5380b0ce4bbc32b6b7094787bc07a98ed6c369697a3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582124, "uuid": "733f4557-febb-4943-9796-a6329d735f46", "value": "T17F934B23A452C6B7C4C787B62BCF9A55AC33B4B90B32220773D87DA46F128D95D5AF40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582124, "uuid": "96d3ba0f-d45f-4925-94d1-248de1f28e31", "value": "1536:r7i7BoKPb2aMeYDIrVc3+eTjmdbc023SgSphbddddd5Z+Dum9HiVrHjDFZS5j:vGPC3BD2c3h+dbc0aTSphDrmFiVrHHFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582124, "uuid": "373c44aa-4553-4dda-b3b0-1e0815510b3f", "value": 97336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582124, "uuid": "8328a118-d74c-4192-9b06-9326cdf2965a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582124, "uuid": "e262a9d3-2bad-434c-8d2d-18d3439903c1", "value": "3bc19d12a1e895d9fee065601c8c984b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d604f7-2ff6-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1634549525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549525, "uuid": "889ffb4f-2f3d-4fcb-8cce-d9b4af1fe942", "comment": "Malware payload (OskiStealer)", "value": "a2b59b949e7086a618beddf77d0a9a43", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549525, "uuid": "541e5464-53b0-4211-9c2e-41b0dca48c4d", "comment": "Malware payload (OskiStealer)", "value": "d53af79b3996389ff73ab33578448fd5e6ee2698251451ed3df7c63ba025fd21", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549525, "uuid": "f0c85a72-b1c8-4d6e-beed-1628795ac0b8", "comment": "Malware payload (OskiStealer)", "value": "ce2a3b2c77b36b090f7610bcd874ecfb01038d69", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549525, "uuid": "d00388cb-0479-4eea-9f6e-f4d37d819d23", "comment": "Malware payload (OskiStealer)", "value": "6c541bfe69c21ec1a29e258abeef0d36d05ca50688edca87ac9daa9f3f9f53c49a5f49cdf95ea2eba37eab39ed2e0fdc", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549525, "uuid": "050883d6-0b0b-4cc1-81ef-ef070e4c24fc", "value": "T12632B054F493090DCB37453143F89F5AA4FED0BD8C5636EDA56236A58C22A7B83A847C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549525, "uuid": "0962193d-39f8-4c0c-bb11-3186ce5a4569", "value": "192:x7XqKrZUMzZtEmIMsP6LrEDw1rDmlMxIqAR0A1L6oQZmFweOioAGiLDxXDCCJPlT:xCMzZtOP6LH1qMxIp1L9QUyeOVAGiL19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549525, "uuid": "2e9b12e1-d2ea-4225-9d03-cc0143b0fce9", "value": 11509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549525, "uuid": "a124cc55-39f8-4e91-9f3c-145415a8299a", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549525, "uuid": "4f607fde-f996-45f4-8463-268c0a4f1050", "value": "CoI 018629F001599111021h154247.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9c0622-2ff6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634549808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549808, "uuid": "d355d8e8-1a84-42a3-bdb8-eff7660d2a1b", "comment": "Malware payload (AgentTesla)", "value": "5ab962a85e0543af57e847973fa3b492", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549808, "uuid": "1124c03f-b540-4158-83bf-e0844405fac7", "comment": "Malware payload (AgentTesla)", "value": "d71e3549a3aaeacbdc919630dbd1d5f67777d3fd7ec10eaae36099f1bdeef50e", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549808, "uuid": "1898ba1a-53eb-4a3b-8d78-93f890b25eba", "comment": "Malware payload (AgentTesla)", "value": "17ee48d5c148c7a9ccac0fd0f565caeaeb656a5e", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549808, "uuid": "98274e38-523d-49a9-89c7-879ffe3726f8", "comment": "Malware payload (AgentTesla)", "value": "14ad487ef9661b00c485489c3064dac6974c9cc2fbbc9f398912005e643b21a892310fef6abef2a22cd44ed98e35036a", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549808, "uuid": "3cc21342-ddc7-4dca-974b-681ef489d938", "value": "T11D43F1C99D72D27EE28145DAAE444B0686BD771FB482D2DF4B08D2D1F5EB00F85C88B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549808, "uuid": "6663d5b7-b5b4-4c22-b8e4-7f51b4b13ef7", "value": "1536:bpGlmoYyXhOMLjX1QNB4KrRpMPb7uyygfAbVFhK6:bym+XcImwMCfuyygIXhK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549808, "uuid": "f07e4cae-994f-47f4-bff5-c2a39d2ca915", "value": 56732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549808, "uuid": "a081c02e-e9b5-41b0-87ab-bb3581fd86a6", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549808, "uuid": "a5c8bf07-247b-4a4f-99fa-3b21c41dfb92", "value": "Proforma Invoice PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69a2de2-2ff5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634549399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549399, "uuid": "b6a8373b-0d83-4104-82a3-d11513cd9e48", "comment": "Malware payload", "value": "c8130d3aa0270ea8159e94da7aba383a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549399, "uuid": "f776134f-cdf9-456d-9239-3b54cb02ff93", "comment": "Malware payload", "value": "d74f18a83f3d458bcf416ce7d567e48517310259b30b0c6762624ddb4fe2db72", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549399, "uuid": "4f88c7db-54fb-4373-972b-8937afe9fceb", "comment": "Malware payload", "value": "b0cdaf5c3ba66d2ada78cb1982252126f1a4d13a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549399, "uuid": "ce0e3c9d-506a-4d86-b66d-efae2d6757d2", "comment": "Malware payload", "value": "1b920217b8c055bbbd72bb0f01dd997ae44a318d676d4931010f33adcae79fd0d5fb7678f6f6ec5b2d579af431c4c92e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549399, "uuid": "bcc06c3c-a6da-4b4b-888e-840a470e96a2", "value": "T1420528392CD1517BF1B7C972CAA659C5E821AD1339015C5EA2CE324ACE73B837EC611E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549399, "uuid": "eef2a550-f659-46f1-8b06-3ed1d0104e17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549399, "uuid": "5d591cc9-daa7-46c3-a564-7f4aa2c1d289", "value": "12288:zSkFMo1CNzEusLMkdOFh9/+9cXwxXr7ypm4eSs1k2s5YqK7:zSUeA6kdOFgcXw7KeSsQY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549399, "uuid": "1c01111d-2ad5-4dc6-8ac7-03aeed974f22", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549399, "uuid": "43b7e136-a01c-4827-9f02-5e6a0ec29d77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549399, "uuid": "17da3f3f-8ad6-46c7-8251-a52599e14f9b", "value": "DHL_document11022020680908911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bc7b8b-3017-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1634563732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563732, "uuid": "a6ddfb70-b1eb-4707-bf68-6701734735be", "comment": "Malware payload (GCleaner)", "value": "2b53286bb7ffd5815d84282d4011d66d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563732, "uuid": "8084453d-eb00-4c55-951b-368117d55145", "comment": "Malware payload (GCleaner)", "value": "d7b0380241e4d47fc00e72faa08831b51b0ae360d5ccc45717f39f3106c3020a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563732, "uuid": "a2fe589c-9d09-439c-b4fd-929835adc6ff", "comment": "Malware payload (GCleaner)", "value": "dc94c45a64975a66edfa975f8adb7fbcaa98ea51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634563732, "uuid": "0d42014b-30d7-4b47-a5cb-7c75195395c5", "comment": "Malware payload (GCleaner)", "value": "9f1f9f4a6a79c8cb3c57dda6575fc59c502fce3943fe597d41318833722d1ea834c6e7b3e42ef9e99bc33b2166f9eff7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563732, "uuid": "635be928-a2b3-4104-826d-2f2d2f0e5d72", "value": "T1C82633A9D2A86CA1F5A7A9FCE13BAAD2D0F5CE0C306D50531B61370B6C4F1D5C98CB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563732, "uuid": "df5e7340-267e-471a-a86d-4044270af9ab", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563732, "uuid": "ef3f53ba-b83e-4fc8-bd41-8b4ad8b3fb48", "value": "98304:JkZlS29v0XERypMbYCev1eRcnRVh1j/1KspBSXGNt8lSOl7V56S3:J+WXEREmYrNeCZ1jcW8XGb8IO5T6S3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634563732, "uuid": "da21a3fb-4611-40d8-9807-13b9b07dfa31", "value": 4766878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634563732, "uuid": "564902a2-2ede-472a-b0db-d7af771dcad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634563732, "uuid": "db69b435-5f29-4ce1-bfac-2251071c6c54", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3575ff-3007-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634556762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556762, "uuid": "47076a7a-fde5-4891-9eae-127ce1541161", "comment": "Malware payload (AgentTesla)", "value": "4114e15de65a9ec4b8eacc3ef60804bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556762, "uuid": "0e2720f1-bdbe-4ed1-80d3-de37da779277", "comment": "Malware payload (AgentTesla)", "value": "d81e35754aa34fb2fd0b850b4f1d8080a64a8408623303d3a8abecea5b0a30de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556762, "uuid": "3c7dbe32-2f78-4e38-93ae-8781caf2f2a4", "comment": "Malware payload (AgentTesla)", "value": "eb450264abe3b3ed70167f267cb974ea13d60260", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556762, "uuid": "061dab96-2242-4c0d-b298-4fa02da86666", "comment": "Malware payload (AgentTesla)", "value": "e2f5bdb4085fcd6857b68678df7ff24a3ccf2b02e4336625a53eda4d3861d968a738cd0b0857fa92a48cc1769ea469ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556762, "uuid": "5557aee6-bdaa-4a54-a1a9-71d667495224", "value": "T144B49D9C365071DFC857CAB2AEA86D64EB607477470BC203909325ADEA1DA9BCF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556762, "uuid": "94d8b577-32a4-4a17-88dd-b35cd416425b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556762, "uuid": "9dec0687-126c-4a25-8040-c0a4a265153b", "value": "12288:TqjW1t5eTrNd9jomHgugG3ShVY9gzkrtqpWOEsb/hyDVebA:TqjW1t50rNd9fblsb/hyDVeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556762, "uuid": "57b78815-388f-453a-9c51-4c3a28335fe9", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556762, "uuid": "d23809a1-4617-403a-974f-9030a4792f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556762, "uuid": "35bef6de-d85e-4b67-b18f-59b1a5021012", "value": "[Schedule_&_Booking__18th_oct.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c895bb5-3024-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569327, "uuid": "7b40a2f2-abfa-4e05-9b3e-fe6eae93b5ac", "comment": "Malware payload (Mirai)", "value": "6b593fcc570cc435b5ee9462ce32696b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569327, "uuid": "e46764db-366f-47b5-ac88-bafc8a037d5d", "comment": "Malware payload (Mirai)", "value": "d85321e1aaf44003c4d96994e98a70acba356e79130e7f3520bad2e45ce08ccb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569327, "uuid": "d35b16cf-b739-4c35-84cd-97e6a20505f3", "comment": "Malware payload (Mirai)", "value": "f3b67ccdc96c109889c5244addcf4ea739d26014", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569327, "uuid": "0b1d0ee0-b116-44b2-a0a9-182b8c7dfccb", "comment": "Malware payload (Mirai)", "value": "1d4f920afdcc6150137380fcb0c4840cf49e98b9b55a332103a3d650ff99fbd4c297f43e51f2089ece62173a1036bf8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569327, "uuid": "cc2ec468-6043-4fcb-9ea4-c2ef1604e6e3", "value": "T106D39E9BB34715B1C86206F007CB4FCD2F2332A15E6BC8E76D5E657E68B90CB4506BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569327, "uuid": "858e01b5-0582-4a3d-9ad4-0fd50f18cd4d", "value": "3072:vQ9acVoLkb8AKZFqtnD2u05KHcEMt1gupq:MVoL4xnDRDHkbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569327, "uuid": "b0be9c94-6fc2-4993-8619-3a8426dde888", "value": 132376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569327, "uuid": "056b0c4a-67b2-4900-8086-e467e391f0c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569327, "uuid": "546279d9-0b98-4cd8-9e0b-0b7d3da4a94b", "value": "6b593fcc570cc435b5ee9462ce32696b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f23074-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634561053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561053, "uuid": "a6ab45bb-5995-41ce-b1f7-1dfd353d53e4", "comment": "Malware payload (Loki)", "value": "693cb248cee194ce86e8703f5cee9a0a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561053, "uuid": "e6ea6767-4c92-45b4-b6f2-bc6806095ca1", "comment": "Malware payload (Loki)", "value": "d8af0c0961e6c2fa396163b164d74afb5c6c26447462de65dbc0086d331444a1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561053, "uuid": "69e1fb73-bf3d-4b5e-bf54-eab8df8dc9a5", "comment": "Malware payload (Loki)", "value": "d2eec20839b36d19fd3d85ede010377f585d29ac", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561053, "uuid": "d1525dd6-d655-4806-8445-5d2009a7e41a", "comment": "Malware payload (Loki)", "value": "9bbbf2f2a4159a3efe5965bd16f4424eb0d0a5ba222c03f0137c50e0ff21f8eda50fbd88ed29cf405ba97c24ceb10aeb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561053, "uuid": "e8d160a9-a2bc-489b-94ba-c2649ad9fa2e", "value": "T10F74C040B63216CED116873AEAD55BC872EDEFBA70369F1D3B0274ACECBB12054241B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561053, "uuid": "b39ec138-2e9f-46f4-87ac-f825edf52d6e", "value": "6144:lDy2h7Fc0XdKr8E6ioGgiQ77euOcHFg5idt1JGmXhzrc:9y2q8EnoGorsk511Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561053, "uuid": "9b66a4b0-ce1e-4582-9dec-7e87d7803827", "value": 351160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561053, "uuid": "e0ca346d-f0e0-4b42-ae52-7ce5cff5482e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561053, "uuid": "64fa7a42-009f-4d7b-818d-72014d4cbbad", "value": "Ricevuta fiscale.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6433c4-2fd4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1634534936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534936, "uuid": "d1c932a0-6f8e-46ee-82fe-b0eed3924b89", "comment": "Malware payload (RedLineStealer)", "value": "3bba0cfa92b41f567e442fa2b03b5441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534936, "uuid": "6e5e4e18-ca11-4544-bd88-588b6a5ff875", "comment": "Malware payload (RedLineStealer)", "value": "d93e219706876d60d22404d26127ea8e438f528d555a018f115acdf3d672f1ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534936, "uuid": "7bf17e8e-5372-4875-97a4-16c03c616a5e", "comment": "Malware payload (RedLineStealer)", "value": "4ad3dad53eef318df43fa56e793ceec15399722b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534936, "uuid": "c2e0158e-3fa4-43c1-8ea9-dab42f88a152", "comment": "Malware payload (RedLineStealer)", "value": "2ca674810cf4981d5c1334555979742d16a75e6b8917eb5e6471aa7e0c789f2ef20ceaf61016951eb07b6738cfac547d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534936, "uuid": "5d9dced7-3cf6-41dc-a57c-a6107791f2f8", "value": "T199C5238697645803ED9BA8B031EDF6136D36BB911BA1C2EB1499F1491F637D03B2C31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534936, "uuid": "79ef005e-4860-4665-a983-c1c5a95c46f7", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534936, "uuid": "b56ae127-f283-4485-977c-938b6824b752", "value": "49152:JeYNgxxv6FyJgJQ4n0PHuDSFHMacvr+YLhl8rvKIuU:J6xxvV3RvkKpcvr+Ydl8mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534936, "uuid": "88d01661-c387-4b36-9d4d-c3dbb4dac977", "value": 2715152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534936, "uuid": "0623ecd3-601b-4ef9-a3fc-989868edbd37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534936, "uuid": "d2174d69-4900-48af-8c21-0758a0eb99f0", "value": "3bba0cfa92b41f567e442fa2b03b5441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e94c162-301a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634565008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565008, "uuid": "e0c27cbb-5148-46da-93ff-3963dc37fdd4", "comment": "Malware payload (Mirai)", "value": "9aabb06a5630b7de444f7c115d5ae2aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565008, "uuid": "590e9b3d-c025-4ccf-893e-0c0efa54b58e", "comment": "Malware payload (Mirai)", "value": "d9428366eb255ed6ab320a5b6f91206fdd195ec928c09123f928e2228087d55c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565008, "uuid": "c47d7f18-da74-4882-898b-219b22a6180e", "comment": "Malware payload (Mirai)", "value": "41a5bb536dc85569f2ffa88634e3c1001ff4d03c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634565008, "uuid": "6af1b9e0-97b7-4365-9659-fb958312140d", "comment": "Malware payload (Mirai)", "value": "2424fe95f46a00c4b63bd0317cac26dd64e35c216a4dee0da6b6e7dff921f8756ff6494c04313dda0ed09eb47ef5a28e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565008, "uuid": "0740015e-4308-41bd-b8a0-402c3e206455", "value": "T174832981FC41A622C7C11777FE5F018E371553D8E2EA32079C285FA03A9F95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565008, "uuid": "998b1b65-d87a-4a30-8671-873506e72a66", "value": "1536:NySHwrZKkRozEsK38U33eZtU5SWmAHPeTriW/SnvL:NySQ9KoI83w9yPe31KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634565008, "uuid": "de19b501-6592-4bfb-a9bc-d5ca95599a49", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634565008, "uuid": "5257d5cf-8471-4ef9-93df-56dea40a4855", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634565008, "uuid": "b04515ea-77fb-4a16-a44d-defa0aeca1c9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d23f358-306e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634601003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634601003, "uuid": "d94fa9f8-a560-4cf2-b86f-13b7ac8085f0", "comment": "Malware payload (Mirai)", "value": "a83478f50840f38ed1aa853142d91b19", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634601003, "uuid": "0f75b928-cc1a-4f34-9982-2749e5f6e897", "comment": "Malware payload (Mirai)", "value": "da610abb7f984dff4c7422298ecdc53a8b0563bb9b22b55174892764dedeb29b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634601003, "uuid": "107ae716-7356-4a9b-b6e9-82f8caa9b454", "comment": "Malware payload (Mirai)", "value": "edf7982b1d3b1d480cfaaf79c805c19d7471bce2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634601003, "uuid": "16b2ea20-f4e7-448c-a14c-8d377dfd0de9", "comment": "Malware payload (Mirai)", "value": "5fe582f7044badaf8e2d26889bc2ea32ed0925195391bb0a3ec7a3e912e8c64e5711549abde5dfe0c78b2849f7bd45bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634601003, "uuid": "dc2ebb66-10d9-4b37-87c4-c3c510e69d15", "value": "T1C6C2D0701A927A21C6301931CC29C7CA7B3727B9D16C78D6247806ACA0DFA4F697DBD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634601003, "uuid": "b2dc0212-d525-4baa-9fc5-fd559c11f1f0", "value": "768:eQaaX8dMsZUIj84/11d5PKBEVXjvI4MSJs3UozbT:eQaaXP+Fj7t1KmFwSUzbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634601003, "uuid": "258fd43e-d296-480b-8705-5329b6f4f42b", "value": 27928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634601003, "uuid": "5721bdc3-4231-41ed-a36c-c2f5e76046bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634601003, "uuid": "7e09940c-6dc0-41ca-80e2-2fdd66bea9a2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d34ef08-304c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634586400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586400, "uuid": "35957a09-70ae-4b01-874e-5962f58edd7f", "comment": "Malware payload (AgentTesla)", "value": "ba36220554ab830aad2ce4f4a0a2acb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586400, "uuid": "eae1c4f8-08a9-4ddb-bf8e-a78b25ae07da", "comment": "Malware payload (AgentTesla)", "value": "da7b242a5fac33fd8bc5ad7650f4e0a946b0b07c01a239d778ec289c63b5be18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586400, "uuid": "13bce5f2-2c42-4720-86ac-3eb0d1c713c5", "comment": "Malware payload (AgentTesla)", "value": "f54bb00c862d0f1f0e883e691a87da8285e1997b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586400, "uuid": "e558cc95-3f22-4aad-9b16-8760445815b2", "comment": "Malware payload (AgentTesla)", "value": "3535ec8646dfbb9563b3ff9930875be55c54087426494d4925c859f523c82c1457682b8b1d8ace387dde21c9f13c5b88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586400, "uuid": "3370439d-0169-40a0-91d8-a069d887945c", "value": "T172028E13C28F174BC9E76ABEFD5D3D99BC63EC135A72761642401D68F7206932A43115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586400, "uuid": "ba308ce5-a48c-40ac-9b51-89a1447b097a", "value": "192:q7XHPAl+CEmRaHHa8dOTid87AvlBWv3CIMhGfy9mBB7uuRAEBlv:qLPAgs0BKGWJMhSy9SB7uUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586400, "uuid": "afe7bf3d-ecda-4c02-8b62-626afe152ed7", "value": 8324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586400, "uuid": "d206dafb-ec50-4a93-83da-4faa0717742b", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586400, "uuid": "b8fa9fad-823a-4885-99d4-cdeee9a72a41", "value": "Purchase orders with bank details.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b008f8-3050-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634588082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588082, "uuid": "91b7c716-d8d0-4b30-8156-9cf4be7f7afa", "comment": "Malware payload (Loki)", "value": "438c7099d2a7a5711c7f04e1fd1ae1c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588082, "uuid": "b0cb27b1-9a3e-4bfb-8daa-823d1b3ad40e", "comment": "Malware payload (Loki)", "value": "daad8d72469b40a070a2392c8961a11501b1d1bc64075931c4a15ac04c44c07d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588082, "uuid": "b87f3371-b70d-4f3e-9660-33b3afa932e6", "comment": "Malware payload (Loki)", "value": "5ca34ec712b5cc95a97701beb7e12d2035eab09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588082, "uuid": "6daa48ef-92de-453b-95cf-89f33fdc6a67", "comment": "Malware payload (Loki)", "value": "35dfe0d24d27dcf1d25c8c74e15a39b107ea63275e3e9c3a5d8c83404fcd4005992b5f4ce0624657e651d1aa6df0e28d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588082, "uuid": "536bb857-a07a-4ef6-8f9f-78edf682df3a", "value": "T16764D00572658F21D9B953F64038E5A307B22D3785A0E28A5ED17CCB3E7DF828269F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588082, "uuid": "13c923d9-1481-48ae-a021-51ae802194fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588082, "uuid": "ca271262-438b-4591-a251-2acee92a6c9a", "value": "6144:W34Ca/GvYdGoIbyDo85ThHxlesuGp2DGHN+7TyoHyhMB941Lwx:WX+GwdGoI+s81tTuext+vyofB9WE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634588082, "uuid": "4a30612f-55a7-4ebc-9424-43927e12d19f", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634588082, "uuid": "1a91d41c-9694-44ce-b322-bfc576f003ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588082, "uuid": "a102cf2c-70f5-4a90-8983-a07bb843c51f", "value": "438c7099d2a7a5711c7f04e1fd1ae1c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175378f3-2ff7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634549883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549883, "uuid": "d6c0d76b-174e-41fd-a901-a4ccd7edee71", "comment": "Malware payload (AgentTesla)", "value": "e2a4d4c11386806bce8e5d8d5e8e8371", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549883, "uuid": "80b29e97-d5de-4953-8277-28653e3e4539", "comment": "Malware payload (AgentTesla)", "value": "dabff599f798510f8acfc9067feddde27050ed506d55adfac28cc2f938574002", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549883, "uuid": "424511f3-8455-4008-b6b4-170a38ecf8d6", "comment": "Malware payload (AgentTesla)", "value": "9c94b32008c907d15149dd1740ef4a92a7edbb88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549883, "uuid": "b6202c67-456b-4ab2-bb42-98f4383ce027", "comment": "Malware payload (AgentTesla)", "value": "1b0ef3f1ddbe8d2a555df48286e41fabf32a064066574e470ee7695b5d23d14f4ee358f8f3eb87257cf4255e45b04b64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549883, "uuid": "c5225822-357a-4ad3-b4d9-09c3b898abe9", "value": "T12AA41246AB848257DF2806B56497E39463B4C8336E46D35B1ED231FB8EF33C18D911AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549883, "uuid": "0c588b92-1146-4bd3-843f-035152210d65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549883, "uuid": "7cd11bc3-574e-46c3-ab66-f7459bfbd7e2", "value": "12288:Qqbn7OiihFoGzjhH00qQOy8KGNG6pDA76t:Q47OiihFH3hU0qHrKGNG6pDA76t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549883, "uuid": "73fc99e6-aba1-4082-b98b-9ceeb7023594", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549883, "uuid": "fe95bd56-b1e4-4a5e-8655-a11f5076e9c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549883, "uuid": "19048808-3be5-4904-bf79-f0d337d6e429", "value": "PO#6012001198 54387-403 A#800779222 LAMBERTZ POLONIA Sp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65d1798-2fe8-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634543761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543761, "uuid": "c26d0b56-b5b5-4bf2-b71f-87bc1fea2a22", "comment": "Malware payload (Mirai)", "value": "08a27949f1fa1142936051d4316d357a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543761, "uuid": "ff97453f-7270-430f-9c40-56c73198d915", "comment": "Malware payload (Mirai)", "value": "dc880f0fb4ac7b1524ad8e48283c1907c47dfd38f8b0ba5cc2845df99b72092a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543761, "uuid": "806daa6c-6cde-4f51-9518-031844223263", "comment": "Malware payload (Mirai)", "value": "1a894a6fe09ce6c769addba80b15d0dde699e032", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543761, "uuid": "374a78db-f440-44fd-809d-a9a4291992c4", "comment": "Malware payload (Mirai)", "value": "7835e0d8fbac4f8ed65f8e0e0dc8238ee225c850c2fcfcb006f49cc0d4d20e9d2c9f1c2f237bcb7be7d0edfb56414f5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543761, "uuid": "789fd7fe-adfd-4510-a9c7-7bdec31b9ea0", "value": "T1DC23F262464ECEB1C5619076EFD9524A7A630AF1E5DB7EB618F81E0830CF75320795C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543761, "uuid": "7c816f35-78b3-496a-a9c7-b8b47dd887a4", "value": "768:iUy5kGE5Gu4liUDMYYYufCKfex0tEfD46ysNEL5M2mZ+5NOGG9y3kL+919q3UELv:iU8E5bwOJHM0oysGLW2mZ+5k9y3kLjLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543761, "uuid": "8b4bdb47-0c21-4bb2-9459-7d90299b534c", "value": 48372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543761, "uuid": "dee33dce-dac1-4f96-bcfc-abdca9d44eaa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543761, "uuid": "2d74393c-fa15-4c15-aac0-4351c7abb96a", "value": "08a27949f1fa1142936051d4316d357a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b722b8-2ff4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634548617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548617, "uuid": "4fee4c64-6032-4d10-905b-be60047cb151", "comment": "Malware payload", "value": "d751b10fa57e620bd35f0b11a30a39d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548617, "uuid": "253dfb7b-b2b6-4bbb-945b-00c18fba77d5", "comment": "Malware payload", "value": "dc94dcad12ae4f8a4f2d1a79e4e653037def2c1c80b521fdbcd8469e5a2a9a47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548617, "uuid": "d8a35a34-cbbf-45e5-822f-7e26cf7f98fa", "comment": "Malware payload", "value": "1565294f9e24e177d47442c526fd1157fc40d984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634548617, "uuid": "955bd190-7b77-49b6-846f-1fb6b143cbdd", "comment": "Malware payload", "value": "0a6907c7972a1413c41896292a995b0b59bad98e64898cb7f5f5aa35a579bc50c0bd2ebe21a463f8c3690caec26c4790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548617, "uuid": "45a4ceb7-c5d8-4737-b685-efe5d77502bd", "value": "T198D1D8019BDC0B72CC534735A8FBE3410736DB1669968F9F18C8A62BACD2F544653B70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548617, "uuid": "1b88ce55-b8fc-4b49-a08c-5c6a6533b0dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548617, "uuid": "334dc5ec-4e29-49db-8668-6967f44af43b", "value": "96:agZdGOmSpV2qac4Xx0QgFD3EDd2/Th9aiqELKPzNt:a+/maVNv62BEJ2/T7VqZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634548617, "uuid": "96c28e92-6989-4eb0-a0fe-4da0a214a38e", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634548617, "uuid": "f8de9b29-6715-4e43-8a0d-ec130bfdd0a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634548617, "uuid": "c643a838-dbfe-4247-b705-7481a17bd697", "value": "DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34838f16-2ff1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1634547355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547355, "uuid": "a0536182-5588-46b6-bd30-62ca5821109d", "comment": "Malware payload (Gozi)", "value": "25a27d247432fe9f84eee3ebfca5f72a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547355, "uuid": "02662e66-a221-4381-b4c4-2ee10270c64a", "comment": "Malware payload (Gozi)", "value": "dd28953551dfccf038a501dbf06b7d87e6fd5ec99edfb0d78da1603d026e3d84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547355, "uuid": "d08332ae-8944-4c18-8b20-c6917613f99c", "comment": "Malware payload (Gozi)", "value": "e3331a019577644518fcf397c0f8dbb3be3bbb02", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634547355, "uuid": "37ca9cbc-4a32-4d97-b1d2-1dd2128d64b9", "comment": "Malware payload (Gozi)", "value": "bf029b05a636f2482a0ee8c95d5aadfa21d97a8929ba3bd81f3472f68d857dbb7d4cb8be7c86b802b5b272c47d5565ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547355, "uuid": "fc6f39dc-3b43-4b3a-97bd-58e65e9a600d", "value": "T187D49E2032A18032E177163584F5D1F05FADBC225D74AD8F72C52A7F0A7B6D29A29B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547355, "uuid": "c23caace-1972-41cd-900f-32039baa27b0", "value": "f0b89328d13367d734b49a9b596639ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547355, "uuid": "4f9467e7-19bb-49f8-8f51-1201b7ddd9cd", "value": "12288:m8dajLSIFcqRfyo4Tq89UtoM+YD3h0QYDpnynKZ0febiP+eMq6FiIa5zrg:ioqpyo4TqmUtoMapy60feeQiIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634547355, "uuid": "0dbb37f5-49f6-4047-97fc-ef8a752c7bca", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634547355, "uuid": "4efb2305-6a65-497e-a407-2e8bd72d2034", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634547355, "uuid": "8bac951d-72fc-4d75-8387-26233308e655", "value": "616d365f1d876.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8a93d9-300a-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1634558297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558297, "uuid": "71ff20d1-08b1-4c2a-a515-5b01be9d45f6", "comment": "Malware payload (Smoke Loader)", "value": "74079d5ad919746cfae94dc3756c49fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558297, "uuid": "a7603d2a-67c6-4049-a157-41696f3f6de9", "comment": "Malware payload (Smoke Loader)", "value": "dd43bb324c3d7cd49b899331e1e43a0aa2746d00c4cbb693c4ebc1a9c6425624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558297, "uuid": "96f77544-d118-443f-9f6f-7a453b9593ea", "comment": "Malware payload (Smoke Loader)", "value": "fd32b2108abf0259d893aa588ad98f417491d868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558297, "uuid": "78e9fe58-118c-4a3e-9333-652ade2a4317", "comment": "Malware payload (Smoke Loader)", "value": "2ddad9ad8c43cc7df84744d6afa4bce00e7cb03cb4ad5a787fd9669227984fa7f4ab776576343054fb70dc641d396ac3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558297, "uuid": "1242633d-1929-4bcc-a8af-e43a1093e96c", "value": "T181747C00A661C039F5F3D2F98ABA53B8A72E7EA0672450CB53D51AEE97355E0ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558297, "uuid": "66e57776-ddaa-4e0e-954d-3303ca57be55", "value": "bd3694527adf0e2f58ae8cb4e18ad5ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558297, "uuid": "85f6ec71-1890-454d-938f-37ca5f653a1f", "value": "6144:UeK80tpysxFgRytiis2Kf+YiTh3wsjDDN4ii1ydyTSiXlbgdo:Ul8bswRytiisjf+Yi1BjDDN4ifdmSitb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558297, "uuid": "465994af-e029-405a-89d3-9a5234b45a6d", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558297, "uuid": "9c186cd8-4009-4946-b1d4-5122eba0e3a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558297, "uuid": "eaf09ad8-d4d8-46c9-ac73-26b765197bfb", "value": "74079d5ad919746cfae94dc3756c49fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afbb536-2fac-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634517758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517758, "uuid": "3bea0106-daf7-4220-8375-df0dd22e3e34", "comment": "Malware payload (Mirai)", "value": "ce650f3cb6077181fd07cd6c2026e042", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517758, "uuid": "89758175-139a-4923-9ee1-08f05d4e33d6", "comment": "Malware payload (Mirai)", "value": "dd54cc28ad7cf0c313afcfd4bd4ac4f027b5f7009bff41310ce574762ed2ccd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517758, "uuid": "7743fda7-a24c-4074-8c1c-4efab32bd8bd", "comment": "Malware payload (Mirai)", "value": "28d9a6437e4375ecddf43e8238ed8e25e56380ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517758, "uuid": "2545ec59-d5a4-4ed1-a4e0-581d8e11250a", "comment": "Malware payload (Mirai)", "value": "7bc7707719190e28a587454efc92c43d465aaa111d5a17755aa895779bc5575eb275a41f11a741d943a8782757f66fd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517758, "uuid": "0ff228c3-24db-486d-b3c2-973cd2f0c026", "value": "T1E473A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517758, "uuid": "76daf852-bc1d-4ea2-8776-bc69bb1391df", "value": "1536:zoVvPLWTs7ys6XcniEyNMin3sDmTRdVSabdza3TTLbwXmP5X:zo5WTm6XouMk3sDmTvVSabQ3TTLbwXmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634517758, "uuid": "5ed41af0-91a5-4ca5-8f08-dafa9bb9c460", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634517758, "uuid": "024f771e-932f-4c09-b557-a7dad25a88e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517758, "uuid": "ce5650a8-ca2b-4bc0-b478-54cab5e7a1b2", "value": "ce650f3cb6077181fd07cd6c2026e042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908ce7f8-2fd8-11ec-843c-42010a9c0014", "comment": "Malware payload (Glupteba)", "timestamp": 1634536772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536772, "uuid": "4dd4748e-d003-4197-844e-9d92ffb0d822", "comment": "Malware payload (Glupteba)", "value": "099ad37ceccdfa74229d976b10973736", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536772, "uuid": "5bd05f1b-345e-43e8-8ff9-51d75039e704", "comment": "Malware payload (Glupteba)", "value": "df84d3e83b4105f9178e518ca69e1a2ec3116d3223003857d892b8a6f64b05ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536772, "uuid": "1f72081a-be40-4876-aff1-669bf2751132", "comment": "Malware payload (Glupteba)", "value": "1b6d65319dcb21fa94310c04bc3abd89b90b4699", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634536772, "uuid": "76fc7d81-e807-41f8-8c16-6b5535c4a390", "comment": "Malware payload (Glupteba)", "value": "d28af85d52dc2730177d9ea7f398892de265777b79eaf79fe74730dd566df56a81fe7721fc22ed05612c1c803e8393b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536772, "uuid": "cffd665a-cfe5-45ff-ac60-3ffe46d39040", "value": "T130967C91FAEB00F9EA07453084A7A22FA731750A8335CBCBD7401EA6FD17AD11A37765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536772, "uuid": "a596df22-7216-4d6b-b7ce-e364fdb6cd9f", "value": "1cd364a9e949d5ecebd6c614e64bc545", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536772, "uuid": "2b055e25-9d6f-42a8-95a6-1bf48f8f1c7d", "value": "98304:XYgmMiJdljVuezWku32WnMpP6KE1dj/DxMLgMhZytTVhg5iqR:XYgjiJR4MpP6KCxMLphwVhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634536772, "uuid": "78b62ae8-f0cf-427e-a2a4-0d621c7bd184", "value": 9054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634536772, "uuid": "fc8d14d0-5f65-4ca3-887d-a488cfdf5cc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634536772, "uuid": "51a5d8d8-e37e-418f-801c-b3076bc8a39b", "value": "099ad37ceccdfa74229d976b10973736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1abf3b-302c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1634572923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572923, "uuid": "0cb1d4ed-ac6a-483a-80cf-cfab77e73f30", "comment": "Malware payload (Dridex)", "value": "8d8b7ea34b7c1e93d924b3da0ad88a3d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572923, "uuid": "785cf730-a31b-459a-b4d1-a3c8280d8f52", "comment": "Malware payload (Dridex)", "value": "dff1e14810f798d9fecf383897913684621ac7b73b51f6580d00da936b1b5ef8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572923, "uuid": "4483a7b6-46db-4ab7-99b2-8add80371ee7", "comment": "Malware payload (Dridex)", "value": "0969ca2414c7108b3f2ac15ac54c11436ab51f7d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634572923, "uuid": "690c0e2c-2930-4c7c-9054-2e891e8719bc", "comment": "Malware payload (Dridex)", "value": "467d1752072f401cf70451a0f27106cb3342047f12a197bb0c352d27f55251a107210c93e4fd9f6d14dc05a80ed7a3c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572923, "uuid": "96c7690c-4e8f-4dc5-837c-7fb78c8edbe2", "value": "T18104E128E76600C5EDDF0D7A130DF32ED4BA1D066341C5BDE90CE762A224F29A97E365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572923, "uuid": "bb6a9f5d-36ec-4ceb-9766-8240003757da", "value": "adb0dd6ace4ae202db9532637ae1959a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572923, "uuid": "f439a475-517f-4a80-88f3-94a449bc3c1e", "value": "3072:7cE9O68ciPs9BrcOgPqT7nWLTkpv0W270f0muemES/4:QE9/QMcvPaSLTkp/5uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634572923, "uuid": "de8041d0-ac7a-436e-b0fd-32e70c788d43", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634572923, "uuid": "5a9a576f-5658-48c9-b1dc-b24d062487a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634572923, "uuid": "40a797c8-4d3b-4b28-afa7-0093a881da48", "value": "9_System.ServiceModel.Activation.ni.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc60c457-3006-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634556603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556603, "uuid": "58b0250e-1088-4439-8268-a1741c48ab43", "comment": "Malware payload (SnakeKeylogger)", "value": "737732b33bdfa729010c81fba507c59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556603, "uuid": "97c0f9eb-ff21-47c5-9a58-b84618a6fb12", "comment": "Malware payload (SnakeKeylogger)", "value": "e01b0ac8411fc377c317ed6aabf5656b400c17bbb4a61b55204ea335bbe2f0ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556603, "uuid": "44667849-6f7c-4a28-8921-688ae3546ffe", "comment": "Malware payload (SnakeKeylogger)", "value": "a4fe38b55f7ea8618ced754eedbfdfee9b7da5a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634556603, "uuid": "c2db206c-f9e6-49c8-a339-2331192185d0", "comment": "Malware payload (SnakeKeylogger)", "value": "4000123a6cd65a9be49855322684aa4da9eebdbb049a0ac6f8be7c94e5ab79a399b004d45e4166bcb6e8adb0a6dc2264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556603, "uuid": "67392d91-11d0-4d8c-b8c5-cebca93d1461", "value": "T13273C7013E046689C4920C7901F25AD1A3784DDF8E9ACE3779E5B73EB873664AE0793D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556603, "uuid": "c3d9af6e-353b-4a1b-8eaf-67460e365886", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556603, "uuid": "24c0efca-5f38-46f0-abed-adece12703c5", "value": "768:SYuJsFWIULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0cM:SDIULFMAAiu6JL6oNsgFAyox0cM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634556603, "uuid": "0af86afb-b422-48b0-8b12-4e498aadb157", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634556603, "uuid": "8b924a00-b21b-4cdb-a5d6-e4cee5665b69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634556603, "uuid": "223f2995-870b-4634-a5b1-43973ce9086e", "value": "737732b33bdfa729010c81fba507c59e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9596dd7b-2fd6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634535922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535922, "uuid": "12297320-e7b0-4c38-b41e-2af34d705939", "comment": "Malware payload", "value": "1be58897c70ad836f4cf9b8a565bb3ba", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535922, "uuid": "9be1042b-dd18-49ab-91bb-90a58bccf01c", "comment": "Malware payload", "value": "e10527708d650b84c9596d75fe512c4cfd683b9471b4f0ceaebfa5d835c76fab", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535922, "uuid": "324a9f00-cec8-4152-9526-4180f0753e27", "comment": "Malware payload", "value": "1a67d86ae877193a8f852d17daed01a13217427d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634535922, "uuid": "09a9786d-e7fa-4893-8007-5409a6bfbd10", "comment": "Malware payload", "value": "4a2a91f91a7ffb2439a77dc2617c945cef4454d59be5c4ca101f435df2d878a4b5c50d31767e02ea2c70794d3f94e417", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535922, "uuid": "8e3c46a4-eb98-4706-9f53-32a58dbb60f9", "value": "T19DC533B6A9BA6000AE255B775309E5539E77FBCF4A032C2D8A03C6216BF35DED102D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535922, "uuid": "11494bc5-3eb8-41a0-9ee0-52d4538d3899", "value": "49152:bWQCcWVe4SvB6YWJyS2Hfo/1QPhl58pfJnzFmc4wk:bWQCcWcpUYi8+QPhn8nccvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634535922, "uuid": "09072399-5980-4028-8e3a-8d68a879bdce", "value": 2611908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634535922, "uuid": "3e6ce3d4-90ca-4f47-82c0-44271a06e356", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634535922, "uuid": "2c945631-135b-45b2-aa47-c32f5ec068d1", "value": "WPS-X3668-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb571ab-2fd3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634534727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534727, "uuid": "1ea69854-8486-4077-b29e-b39a848a68e2", "comment": "Malware payload (RaccoonStealer)", "value": "66f04e4f495af513adb0002238436a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534727, "uuid": "5eb8414e-c45f-401f-a2c7-7b95122b6339", "comment": "Malware payload (RaccoonStealer)", "value": "e28a6d3bdcfdad9ff4c37e6c22c1a52018e5076ec65b128614bcf0e8eb711171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534727, "uuid": "a2a2a971-c491-4323-b3a2-ca2e9287fa1f", "comment": "Malware payload (RaccoonStealer)", "value": "24ad5323d538aa1fabca1ee3c0f6461bc39d4c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534727, "uuid": "37bd6a42-9fa5-49a7-94e3-76122a5bf51d", "comment": "Malware payload (RaccoonStealer)", "value": "381605046f593d7368836d63e98f0b658aa3d66d36fc652fda016a30f89fb1b60f4547b1e4c51bcb6c95f77424d54ec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534727, "uuid": "962bd8ea-bd99-4bab-b23b-d32ac168e2b2", "value": "T1EDC4D010A661C039F5F752F48DBA9369A52E7EE0672490CB53E51AED8B346E0FD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534727, "uuid": "656d94b5-e516-449b-8b53-fca61d3e16cc", "value": "578dc7dab5389346cbcc286cae0d11e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534727, "uuid": "6a8db51f-b8bf-45fa-a978-0c32e43d71b8", "value": "12288:Oa0qVmb1mrflqpKqDzJK8yzMYJ7Go2hjzsxCprL7hDSyvGm/Xy:OTqVmkwVGMYJ7Go25sGhDSy9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534727, "uuid": "44cf828e-9e0b-4f16-8b58-b689022abe71", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534727, "uuid": "25e19e33-1154-45b5-9b53-e30ec9b00472", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534727, "uuid": "3e48ee00-e4cf-45d9-8b78-3736ac12b04c", "value": "66f04e4f495af513adb0002238436a53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cf51ff-2fe3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634541416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541416, "uuid": "b27b40a6-b1a3-4526-8ccb-4aed68cb2173", "comment": "Malware payload", "value": "7bf5687c11125a81294c0be5c499c65d", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541416, "uuid": "40f36220-93d9-47b2-8cf4-00c4ea32c9b5", "comment": "Malware payload", "value": "e2de1ee5c685fb833fcec3777c715cac0309ea41ea97574d78a259f0c83b95ad", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541416, "uuid": "5846e7b0-064b-4a38-b95d-4c59fd608147", "comment": "Malware payload", "value": "274661391a9e87484c70a0c2dcce658b40c1f070", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541416, "uuid": "2347900c-a5df-45b6-845e-d10dd584efa4", "comment": "Malware payload", "value": "86e1facdacb906d325ff5f00d457088d4be18ddfadfd01d718b7e3e739abee7ed91541740f7efa728a1010b60e03a822", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541416, "uuid": "6c2c355a-8b3d-42a8-bff1-f5f57b34ec1f", "value": "T1267423E388B9C2EA1AC1D079008A45E184D26BCE5F75D2683A8D4D8E15EFFBC7171937", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541416, "uuid": "6a402269-d2cb-4345-b770-2155226a70e6", "value": "6144:t0dd70qWEhgnVnt6NcnIETmu/kbpDyCWg22DrElIz7YCxXTdXW4wnykKgFS1JbA:t0nJ9KG+IMNkpWl2PElIzMQTdmtnKgF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634541416, "uuid": "7e7d5f5e-76d9-40c1-9076-58175c84f710", "value": 369725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634541416, "uuid": "4de94986-4196-4a61-9c07-b61be1c713cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541416, "uuid": "ea27c7ef-f45c-417c-acfa-96264365d23d", "value": "PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03492165-3012-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634561446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561446, "uuid": "5bdda594-123b-418d-a0b8-a7cbd4e07e1c", "comment": "Malware payload (SilentBuilder)", "value": "0156b5f1a496fcbbf5fc7b2694905cb1", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561446, "uuid": "47346cfd-d97a-4436-8b42-7494c074ff5b", "comment": "Malware payload (SilentBuilder)", "value": "e30baf6cbe6b28888c0c847cad54471d1ccdbc671668e9183fb8b452b4109496", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561446, "uuid": "31efd67a-126b-4dcf-9531-f82b86d6c877", "comment": "Malware payload (SilentBuilder)", "value": "7c1adc6b95fc2f811d1d70364dbe831b664d1cf0", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561446, "uuid": "6edeccad-851b-47d1-a089-3555a53c7acd", "comment": "Malware payload (SilentBuilder)", "value": "601e45fc4fde1bfdb1895a545cdab80ddb5ab505cad90b62c25fd65c5e21b0de50ba7009e4dade7e3600705d02b2f8ad", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561446, "uuid": "48577f57-5ede-46e2-a071-8a2470b3cf62", "value": "T1E744E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561446, "uuid": "c863e901-fb08-4143-aced-c02c26fe562c", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dgd9jWvcZZdtjq15OD7IvOEPD0lgvS3enw7v:Q9jFrjmkD7IvLDK3vLvfn1+21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561446, "uuid": "8909b0ca-60be-4a1c-a34a-23b67c68f46e", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561446, "uuid": "c29d205c-aa57-4f79-a05b-ca918845ea9b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561446, "uuid": "b1cfe253-4a3a-43fb-a538-9f26d010d449", "value": "0156b5f1a496fcbbf5fc7b2694905cb1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccf4efb-3042-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582131, "uuid": "21ad72e6-51ae-4d76-a32e-b5b389188a01", "comment": "Malware payload (Gafgyt)", "value": "5c35d3512dec0947c5bc8dc99b806664", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582131, "uuid": "a7511bc2-7daf-4f46-9822-f2f1b294dec3", "comment": "Malware payload (Gafgyt)", "value": "e36474e7c56c69441c6e86ecf16dfd9ae450300c11c1718f5ab708b8c0db71a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582131, "uuid": "3fa66ce7-7dc0-4f0d-b3c0-3348407bfebf", "comment": "Malware payload (Gafgyt)", "value": "9cb2b9f0d5cf8b2c5934d98d31e03fa0a8c28895", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582131, "uuid": "3a177673-12be-4e18-8478-47c68f5799cf", "comment": "Malware payload (Gafgyt)", "value": "7bf93d6c294df028a00163b5d682923d235c18cbae5b15e653a4cd197c4eb2dfecba53317a66a40fc676cd4d40f6ee28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582131, "uuid": "84e7dd87-cf5f-4353-b20a-be20ef861ef1", "value": "T152C32A01E4508767C1D2177AB79F864D77232BA897DB33129A346FB42FC279E1E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582131, "uuid": "8e8e1961-5a29-414c-aae4-bfc47a141ee7", "value": "3072:c+NJfyaEvj1Ux0YAoaf5hR56pNRqmEQ92tX8Q8:jyaEvjOaf5hR56FqmEQ92x8Q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582131, "uuid": "d922f6ca-51b5-4548-8706-1a42a1c04585", "value": 124474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582131, "uuid": "b13ddf3a-2ccc-46e8-9651-12dc66de6ffb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582131, "uuid": "c4d213ce-33fa-4b29-92e7-8ed1a5bf1fe2", "value": "5c35d3512dec0947c5bc8dc99b806664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bf02b0-3001-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634554362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554362, "uuid": "f9407179-1d14-460a-8ca0-83b16031882b", "comment": "Malware payload (Mirai)", "value": "7cfbb226da20b7b4a93b0279709531c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554362, "uuid": "37c6aac7-9d98-4e12-9888-a245a47eb685", "comment": "Malware payload (Mirai)", "value": "e3826f2331a542c643457e72f45c3e40ac990af9f7cbb4060c4bb95f652e39b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554362, "uuid": "3ca6dc7b-3417-4dbf-9f93-271f276d0343", "comment": "Malware payload (Mirai)", "value": "fece529cd8688d7133dc2bda2b1fadcbe624819a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634554362, "uuid": "889b2bee-cf13-482b-a0ff-e0151bfae250", "comment": "Malware payload (Mirai)", "value": "7de083ef285c3f9f9a70e28ae7ec91d0226864ef1f47b6d8e60c59e3c6317ca4fcd5b27939ea03bf131596721be9fbdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554362, "uuid": "6e93e97e-3e6c-4482-8ce2-4c3d6c4fd99a", "value": "T19BC3C607F4915992D9D2C336FA0E16CA32A7B364D3CA6107CDC84F213B4E8662DDE6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554362, "uuid": "47128a99-32c3-4cad-a528-ab68ea4047bd", "value": "3072:PqfcbWeZJZESx5HlJdiezAvY26Drz2aXl0EM6khfEYSh:sqESXFJdieRrCaX2EMh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634554362, "uuid": "5b497fbe-929e-47cd-ae7d-bdcaeaa283df", "value": 121884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634554362, "uuid": "77368491-ebb8-4dc7-bf9e-ec2a5724d84b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634554362, "uuid": "64553eae-284f-44a5-8e68-d1104dbfdaef", "value": "7cfbb226da20b7b4a93b0279709531c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2d423d-304b-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1634586207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586207, "uuid": "e7c54ee0-a81a-498c-8645-f91eaddd57ee", "comment": "Malware payload (Vjw0rm)", "value": "4bbeabc7d902f9f654cfe9c4f51d155d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586207, "uuid": "d556b446-6aad-495c-aaed-3db7e00ef4ea", "comment": "Malware payload (Vjw0rm)", "value": "e3f46470aa9ef52628f741e07db33a6af854693ae2a761d397bf87fbfbe687c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586207, "uuid": "9cd39ca1-e050-4a10-9711-3e7789fb7128", "comment": "Malware payload (Vjw0rm)", "value": "04b90a68e3911bc4edcf355c1db4567ae173c601", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586207, "uuid": "68068092-1af3-47e2-a377-277cc8a49aef", "comment": "Malware payload (Vjw0rm)", "value": "0d87f788b5e8068b0410b9c8a31830761238a28cdf17aa12dbf5cdcd22db43a464f650ae6e56f4cdf2c6de9b0c1ea4fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586207, "uuid": "ca187362-cafb-4820-bda5-323a8c31d713", "value": "T17132BF85C799F8729205E777A07D88C797272CB84F51B0CF86C991881C28F2632FAB59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586207, "uuid": "db7d1c0a-dc75-49fa-a891-708933e7750d", "value": "192:GDiOn6F9bg4NuHmcVP0sntG4a3FRUciE8IswHT9xfD8+pLhZx53fAeT7yTK:GDii6FVg4NEnbt7a3F2/EzswH/JIeXyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586207, "uuid": "3af20eb0-a6b2-45c0-9055-ce27c6dd3531", "value": 11679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586207, "uuid": "0e3c542c-9fc6-468e-891f-909f57670872", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586207, "uuid": "496ab829-4fb6-4c7a-8896-9017dac63143", "value": "HOO8M_Invoice_Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9792d1-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568414, "uuid": "3d02762f-de91-44dc-b4a4-60845a35a664", "comment": "Malware payload (Mirai)", "value": "d25cf87c298658e84833f8f215bfaae8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568414, "uuid": "c3a6350e-b01e-42a8-930a-4432aa9d24c2", "comment": "Malware payload (Mirai)", "value": "e3f841b86c42be0160083df6d0956a7326ad3292abd68527882a5de5fdcc3645", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568414, "uuid": "35213f09-5175-4491-9380-1f881c13265d", "comment": "Malware payload (Mirai)", "value": "6a7992a1244710b6d238de941a5073636a954e0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568414, "uuid": "fd48c191-7e1d-4f54-840d-7cf6cc4ab0ca", "comment": "Malware payload (Mirai)", "value": "5070074c7406324774097fbd2bb4358aeec514f533bb9b589147f2a5ad89f61d9ece622d0161cc3d477394ead2550599", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568414, "uuid": "42ce0452-07f2-4acf-ad04-679fdd063465", "value": "T136533A9D18420E2CE9D75CFD54224F0BED562310A0D71B0BA69EFDC37DB33A9AE22545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568414, "uuid": "871182c1-87e5-4fad-89a6-98616d3d06b5", "value": "768:4PCi/e3m/tzaDuLmaEeB4vvKjxXB2WEaPP+WUgFySbNw7Iv6d+f1prKjKQeuQ:QCi/tFzYuLmaEIL+qs7IvSg1pejK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568414, "uuid": "f8205ca6-d8da-4a9d-96a8-72cb92f4254f", "value": 62100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568414, "uuid": "0636871f-8dc5-4602-bce1-66b2cec53ceb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568414, "uuid": "0cd7bd15-1267-4338-8d77-3a88d855c0d6", "value": "d25cf87c298658e84833f8f215bfaae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d8d0ae-3024-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634569418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569418, "uuid": "46b0b1f7-fe58-426d-a264-e33e35d02157", "comment": "Malware payload (Quakbot)", "value": "cd93700f51d10e6a9dc83aee520e7594", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569418, "uuid": "65275ff3-ae7e-4341-9255-258d2ecb81f7", "comment": "Malware payload (Quakbot)", "value": "e48388101517eb170c2ecd6ecb2d1f682d5e185b2c9f844fe83a99917d82f3a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569418, "uuid": "1a5b3455-b86e-4029-804b-5cf29d106f5c", "comment": "Malware payload (Quakbot)", "value": "9812ece66c4fcf5d242ec31d6a909e72d5ff6fba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569418, "uuid": "8caa20e1-19da-4461-a674-c70f49517a4a", "comment": "Malware payload (Quakbot)", "value": "9b0f1d72ed06f20251ab81d0a855d12c7852e9996585404b75cb7b1784bac70d63685f39b00aec240bd9281ed69f6feb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569418, "uuid": "0d1aeb71-6ece-4025-afcf-87a2f898342d", "value": "T1CED38C427787C99BE94503398ED3C7DB3B72FC21EE22470336467B0E5E7A2A18D16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569418, "uuid": "12e7699d-6e28-413b-8847-d18edb164e31", "value": "3072:9k3hOdsylKlgxopeiBNhZFGzE+cL2kdA7c6YehWfGNtUHKGDbpmsiiUv2K+lrXqH:9k3hOdsylKlgxopeiBNhZF+E+W2kdA7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569418, "uuid": "0385d348-7a7b-4e98-aa98-be2e7d0e5b03", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569418, "uuid": "69543e17-e8ad-45c4-9ebc-5af09b659772", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569418, "uuid": "c2edc59c-9c78-41be-a8d9-9bcd3218923a", "value": "TXN-960094108.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811cb64c-303a-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634578837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634578837, "uuid": "90e37b29-cf25-448a-aab9-5d225ec1bebd", "comment": "Malware payload (SilentBuilder)", "value": "573039b8cab278a9fd13ff9fa1c87708", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634578837, "uuid": "f06b951b-f70b-4950-8a40-6f5692abaada", "comment": "Malware payload (SilentBuilder)", "value": "e514de6406b19950a9070dfdfb2dc69601790545e23d1708f60191be25b39ec4", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634578837, "uuid": "b0711831-ee6e-41b1-a1f0-f34fb69fa93d", "comment": "Malware payload (SilentBuilder)", "value": "a9997bb30d4c7cdcdf4dc5cdf3efddc7eed98ac1", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634578837, "uuid": "e412d9de-6401-4abc-b7ba-291395d3f706", "comment": "Malware payload (SilentBuilder)", "value": "9ed6bb506db884d30de1d7f6263928e434a99ee8694e6df148e60b30d9ddb32f8f448dee3b621bbb02e7ee317ca02f6b", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634578837, "uuid": "36c050eb-27d2-4e5c-bd0e-894a5dfd6df1", "value": "T19044E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634578837, "uuid": "63f5eab4-8dde-44e0-8e33-9518f983ead7", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7q:U9jFrjmkD7IvLDK3vLvfn1+2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634578837, "uuid": "b48f8106-d0e8-41e9-bd88-c6990c061b38", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634578837, "uuid": "c9118fd8-80fe-486e-b11f-71ba00a1b10c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634578837, "uuid": "50ca8b2e-e238-4358-915e-939af3dbe47f", "value": "573039b8cab278a9fd13ff9fa1c87708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd631c3f-3027-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634570804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570804, "uuid": "a3f786ec-3a88-42bf-bc02-021c6e3e401e", "comment": "Malware payload (SilentBuilder)", "value": "35ab247b12fee490ac02f62c19bf5e1e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570804, "uuid": "dadd9026-b7bc-4200-872f-fbcbc9d1afe3", "comment": "Malware payload (SilentBuilder)", "value": "e5e5e15ffd82cbf8bbc4b11622d07a4dd08f218438cbe0a1c4e49615d5500bef", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570804, "uuid": "669c0d1f-d52d-4550-99eb-189b892c3d00", "comment": "Malware payload (SilentBuilder)", "value": "cc412a79c49271384ad8902f3bc13b961f567aa8", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634570804, "uuid": "da8031c4-ad8c-4418-8633-62d6c05f524f", "comment": "Malware payload (SilentBuilder)", "value": "c1de345c56769a64080a517c7482bc055fd90f550f56d558db5a541670d0856e4df762a170514aaee6b92dfc13f8e250", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570804, "uuid": "3a9812b6-f70e-4159-aea1-e0ce574f33ef", "value": "T11B44E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570804, "uuid": "541b30c2-3b53-4f80-b714-c9b11c862d01", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7I:U9jFrjmkD7IvLDK3vLvfn1+2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634570804, "uuid": "e77777f5-0182-4fa2-bc12-900dd4d427a1", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634570804, "uuid": "98faf138-d743-418e-b247-3748c1b24316", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634570804, "uuid": "6fb96c39-b9ba-4eb8-9e4d-716f5f1114f4", "value": "35ab247b12fee490ac02f62c19bf5e1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5952f5-300d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634559557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559557, "uuid": "3bdb12c0-3aa6-42dc-877e-21ddc95fb578", "comment": "Malware payload (Formbook)", "value": "3a5c5bb43232e4e48b63cdf123dec876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559557, "uuid": "bcf49b33-7475-49d0-b454-13ee6e464107", "comment": "Malware payload (Formbook)", "value": "e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559557, "uuid": "12aad88c-fdd6-4ab1-8a0c-10b883aa90fa", "comment": "Malware payload (Formbook)", "value": "95b478c57de28b87d6bd87dd32a4faec02b0d620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634559557, "uuid": "72b26087-e19b-4bd5-8e57-e46ac71ab502", "comment": "Malware payload (Formbook)", "value": "0539b47799575353553cd75c53d123879f0116493981bd5ed360d420a17d6ccab9cf95c115fe9d6c2fe3c76abe94c90c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559557, "uuid": "60b9f823-a434-4112-a979-e6062e0e466c", "value": "T14E44136BBAF1E8EBF43609B19C3B570FD17166052681278747302EF62D20BC7951BE92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559557, "uuid": "57e41c46-b678-4ecd-b4dc-aa8077e16fdb", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559557, "uuid": "1b408aa5-fac5-4311-8a04-8d913ff8faca", "value": "3072:wBynOpL12riocLMjve4LOk2AcxISCGn2rc2gGw7cMC9oyZ9rUoyBz92bO511D0tv:wBlL/c/LOk2Ac3CGn2cb1n5LD0t2lDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634559557, "uuid": "4c34bb76-8afd-4df7-a251-80dcee0ebee3", "value": 259828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634559557, "uuid": "15628ed0-36e4-42c3-ae5a-367da3127eb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634559557, "uuid": "aa398252-86b2-4d13-b565-7ba1687e5ff6", "value": "rrwq200123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4abec6a-2fe3-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1634541584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541584, "uuid": "daf1cb6b-4e68-4e2a-9847-72b49d33f96b", "comment": "Malware payload (Vjw0rm)", "value": "8547af690a9b533d6acd08360f5b18d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541584, "uuid": "2c8cd5ee-eb7b-4505-98f3-63938d42dd95", "comment": "Malware payload (Vjw0rm)", "value": "e61713ffb39c48f5a162cbd0635b869bbd9b318ee3ac47a5a62490b572752b7a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541584, "uuid": "fb91a342-18c2-47c3-bcf3-0d1e02726d92", "comment": "Malware payload (Vjw0rm)", "value": "fe393629e5df70bcfef741a70432af6c6a528b27", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634541584, "uuid": "a9f82306-3a03-490a-8b6b-72bc71774519", "comment": "Malware payload (Vjw0rm)", "value": "70adccd7fb6f8c2e738355116bd83bb48a8a20355d7038fa81e12c96617f7c0e019923d5f472ec4c325d37c7aa580f6c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541584, "uuid": "c87e5e6d-19df-4306-99dc-e69e8977ae4f", "value": "T1F1235C4E9C135351CF20531A6EB9DE549FF8A91F41B08EAD390DE6143B2642CF1AE76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541584, "uuid": "74f16106-8ab1-498c-896a-1c66eb902821", "value": "768:klrw9II2LrCko3oHRirCWiUG+Odm4aS/pLF8NQEJUP:klK1MrCP3oHRirWUG+OdOqv8NQEJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634541584, "uuid": "997c13b3-201c-4d03-9415-11331bcb7481", "value": 46765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634541584, "uuid": "8116915d-77ff-431b-805c-ecda7858e73d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634541584, "uuid": "627f07bf-365c-467a-884e-b11e09b6942e", "value": "PO 21.18.0047 -(APPROVAL).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b0b550-2ff7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634549887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549887, "uuid": "4ca0a956-e11a-4cc2-9845-7c1523343241", "comment": "Malware payload", "value": "6b2cbcabccdd33ffe8678b28905fdc0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549887, "uuid": "1b82f636-1ca1-474d-86ba-d478f61cd1b6", "comment": "Malware payload", "value": "e6bbe6d53215da93aaa940a022267db83efdbd8621cf3adea264c8c30985be5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549887, "uuid": "630478f5-1f22-4cde-ab44-3e8400588239", "comment": "Malware payload", "value": "b3cc3d657302e6047dfcbf831cf392a66614ea07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549887, "uuid": "02c54190-ac2e-4aac-a7ef-339ce8826b76", "comment": "Malware payload", "value": "0eecebfde368ad98761d88b0a0007f8132902b1ee008c0e3c5128c016219e9fa7b56f318865477d0c73d5028d53254b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549887, "uuid": "74f72ffc-8d72-4c9f-93de-289593520f49", "value": "T141B2E114357CB32ED327E93A03AB832536DCA25BFAC5A708A6EE97C65D058409778138", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549887, "uuid": "d2ccd90f-b3f2-4dac-833b-d3d0b64b3e25", "value": "a2eefcd1bf6c043aaadd13b87ba17032", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549887, "uuid": "4b6d508b-7ce8-4bd9-bdd0-c43c60163968", "value": "384:6s0nb76FFo7iVxYwtZfYKbOrmv/lagzctAx5gsEoFIC6mQSFoW54MzihH+kxo/It:6sycOOVxLtROrGxqAx5bFICTFoWy1QtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549887, "uuid": "d1592937-c3fe-4117-9c1f-d7ccf85d691f", "value": 23556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549887, "uuid": "36a1d987-692a-4713-a5bd-81803e7baa09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549887, "uuid": "49bc0d83-15ee-43a5-adde-debf26a0d60c", "value": "Update-KB390-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4c4944-3037-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634577460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634577460, "uuid": "763e2c2b-37e9-4566-af8a-1e1b2e0a8fa8", "comment": "Malware payload (Quakbot)", "value": "3b21e9a5f0bb5d23361648b4ec109180", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634577460, "uuid": "80507e4d-105e-40dc-ae9f-04315282250c", "comment": "Malware payload (Quakbot)", "value": "e7325c3a2fe03a4b4065dd03d216a5a6fbdc52f1b124a75db33cdd15d2dd229c", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634577460, "uuid": "fd081085-20ca-426a-87cc-0d4339906d47", "comment": "Malware payload (Quakbot)", "value": "577e25941dbc33edee527e1c21f00d7e87b8fa11", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634577460, "uuid": "68cf845c-0a1b-4ff9-afdb-8eda590d78d2", "comment": "Malware payload (Quakbot)", "value": "7d0d76a4e69cb3cf1c368ffcd78c3879b22f2d991668852725d2bcdf9910b5a154b7697d487339b948833977a32824e9", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634577460, "uuid": "cf88423d-eaeb-4c60-8fc6-05e49cff6b83", "value": "T1F3D38C427787C99BE98503398ED3C7DB3B72FC21DE22470336467B0E5E7A2A18D16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634577460, "uuid": "b8f8eb41-c352-4fbd-9ad3-90cf7d89a477", "value": "3072:9k3hOdsylKlgxopeiBNhZFGzE+cL2kdA7c6YehWfGNtUHKGDbpmsii8v2K+lrXqH:9k3hOdsylKlgxopeiBNhZF+E+W2kdA79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634577460, "uuid": "b4c3f68d-5b49-4e6a-bc70-d2c3e7febc56", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634577460, "uuid": "fabc2071-5874-4cbd-96b1-5942bbdf5f6e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634577460, "uuid": "6cce0cc1-2e1e-446c-9961-611509ce9176", "value": "TXN-796202694.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d89c23-304a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634585557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585557, "uuid": "453712f4-c1ee-4e26-b1e8-13b2f285e304", "comment": "Malware payload (Mirai)", "value": "2b90abf401322193b9ff15c3027e0bc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585557, "uuid": "bb6f55f6-408f-4cae-b108-6ef400d30966", "comment": "Malware payload (Mirai)", "value": "e7f4a1088ba2d6343ac3faee471dda20bb41f7f061198c5643b86f03b4931095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585557, "uuid": "2731a67f-24b5-4f70-b0f3-a984cdc86dda", "comment": "Malware payload (Mirai)", "value": "1e4e5c00a6a1fbfe9209d6afc07b5684b775f5d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634585557, "uuid": "1cee0d9d-4b32-410c-8235-22d8b7f74dc5", "comment": "Malware payload (Mirai)", "value": "b63720a3ef48623fc5decf3c4ac1b306dfcd7716a8c1ad977bc3d66a59cdf132b825945327c8d1cc13cce33bb0d92a7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585557, "uuid": "68f72aa4-700e-465b-bd62-d987c1e2f24b", "value": "T1BC53E781BC41A629C7D11777F99F559E3710A3C9D1EA32138C240BA07ACF94B0D6BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585557, "uuid": "1abf7843-0cca-40cb-a0a4-cb9c024bf981", "value": "1536:qmg+V1yjBbTRISQCHDBPCUpj33eZtVaq8tvHh:qmg+V1yjBZVd/D3wgPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634585557, "uuid": "23577ce1-f73c-418c-b45f-e4e04b6405e7", "value": 62908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634585557, "uuid": "a9da398a-9c32-4090-9037-432c242202ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634585557, "uuid": "d2867602-fbd4-45eb-8e05-0fa25cf6b119", "value": "2b90abf401322193b9ff15c3027e0bc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37c43d3-2fb9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634523489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634523489, "uuid": "323062bb-4523-4970-b2e4-c6e2c27aa220", "comment": "Malware payload (Formbook)", "value": "984eae99ede6562cf394483a1600c4a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634523489, "uuid": "59a9a018-c217-46c5-a759-84f0c05ff051", "comment": "Malware payload (Formbook)", "value": "e827c29f504045d8e6d8a2eb622a571f83e1bf9afaa8f1b839af76f457b45135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634523489, "uuid": "e544bf39-9cfd-4b81-8734-e9caf2bbe68a", "comment": "Malware payload (Formbook)", "value": "75d1a2b5c8cd64dbe8b6470e47c8016db541b794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634523489, "uuid": "35f201c5-11f1-456d-a9ed-ea843a57db0c", "comment": "Malware payload (Formbook)", "value": "e8410bf2fec9709832f8176f727969e2659bc6c347767266868930265f14da2a5bf6bccfcdd94d0156113ec62281afda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634523489, "uuid": "eb70988d-9da2-4f41-b1b1-ae0f45141f77", "value": "T17894124137C8852BCB7C0A3860F3E3A5277898263D91D79E9D9A78DE1FF6B805D90643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634523489, "uuid": "0b3f5b47-90a7-456c-b841-88ed1f022251", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634523489, "uuid": "b8df456c-545e-4e7e-ae96-e390d707c02d", "value": "6144:tngMQ+aLjZeVeSUUC7Cw8sHa+gTPox+o7Vu+o5sAUqYNY:C+a0VPUURwNano5vG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634523489, "uuid": "db01472f-6ae7-4f57-b34f-85994a491ecd", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634523489, "uuid": "e7e83504-ec8b-4067-a4db-b6c43d9ee633", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634523489, "uuid": "56937597-bf67-494f-861c-282a82e161d6", "value": "Invoice 3284 sales invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd20ac6a-300f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634560496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560496, "uuid": "8d08f2c8-7c82-4d60-a5bc-5b1260e4b180", "comment": "Malware payload", "value": "8295217cdc52ba8b095670d97a896852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560496, "uuid": "3af54fd5-a137-4bba-9ee5-6b4c46e9ccff", "comment": "Malware payload", "value": "ea0199b34288c62a05e507592fa3b5411ffb3598386cde29f7fc367b889bd075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560496, "uuid": "bcd26016-d86b-4370-b1f6-7000a00f03eb", "comment": "Malware payload", "value": "db53d460d8821a3e9175745b0608ec3a771b1b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560496, "uuid": "b1a02139-d372-4350-a3b8-c29891266e0a", "comment": "Malware payload", "value": "d1b2e51119e380a239ba42addd6c20917251f477bfddea4420a62c7db6e33873dba80c6052bd989efcdbc723e8626262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560496, "uuid": "29f56ddf-6dca-476a-b1f3-fe71f9bb3933", "value": "T1C415AE4BF36042FAD06F513189CBC677E3B076A91A35A72F4290D9DD2F339126F1AA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560496, "uuid": "e607cbf4-2fc1-4c6d-b96c-0a2477a65ec7", "value": "045715ac29c84a0e47dab339e337bc06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560496, "uuid": "b4a375e2-063e-4290-afe9-7371870b0a9f", "value": "12288:Tx1vJopzeLkTqhqeEmC7sOSafaei7fqBHfq:3CzIkTgqeEVsOffasFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560496, "uuid": "0b33aebf-6e21-473d-90dc-ee9dee5e306d", "value": 921253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560496, "uuid": "7322a70b-a59c-452e-bfc3-9bebb2e46e57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560496, "uuid": "ad045eca-8605-4fe1-a73a-02bbeb70c6ee", "value": "8295217cdc52ba8b095670d97a896852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091b609f-2fc5-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634528384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528384, "uuid": "5b1d2013-1513-43a6-a0a5-6af6cda640ee", "comment": "Malware payload (Gafgyt)", "value": "d13f7d7b6a6726cdec9125ec0e94fefa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528384, "uuid": "107db8b0-bb13-4e3c-9f4e-6ab0423a02bf", "comment": "Malware payload (Gafgyt)", "value": "ea18e862bf53acfc1824ae17449360d405fe3c2096a27234069f8e9c4d116d2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528384, "uuid": "26780f02-9629-477f-bd8e-59af56b1384b", "comment": "Malware payload (Gafgyt)", "value": "54099da6bf122d2a3f471cf519af9c424013a528", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634528384, "uuid": "f8375325-44f7-4272-812c-444ad96e6f62", "comment": "Malware payload (Gafgyt)", "value": "a811512036d963a705e85f27416a1d2fa593873b67abae30ec32518af53b77d2063285eaeb7eefade1ac391338577eff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528384, "uuid": "f963316c-2ec9-48e9-8ff3-45a8cf3a5967", "value": "T1D6B30692F900DFF6F00AE67604D34B256670BF6A0F536A26B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528384, "uuid": "3b12f4d1-daae-4984-ad7b-98b526b6ad6e", "value": "3072:+F6HOvtH1uPm1Q9uC6IypOFsK6NwIVRm2pgYMx3IPtW:+luPm1Q1ypgsRwYRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634528384, "uuid": "6407fe90-f9ad-448d-92d3-5797be42d1c1", "value": 113759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634528384, "uuid": "dd1727db-9322-492e-9b1e-128787ff5d30", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634528384, "uuid": "da17685d-e7e2-4c9f-bf22-4592d654235b", "value": "d13f7d7b6a6726cdec9125ec0e94fefa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b3ca2a-2feb-11ec-843c-42010a9c0014", "comment": "Malware payload (FluBot)", "timestamp": 1634544867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544867, "uuid": "ad975b72-c248-43c9-aa12-37573e2348c2", "comment": "Malware payload (FluBot)", "value": "891d5d2c397e9ad5fed5685f78657d4b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544867, "uuid": "53a2440a-57c9-4aca-86b3-4d24a0d0fe31", "comment": "Malware payload (FluBot)", "value": "ea6776fac45c8844242fdb566a17e70569813298235567bbe9fa0dd062f1160b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544867, "uuid": "4eea1781-f24a-4afa-b2d4-a489452e8c07", "comment": "Malware payload (FluBot)", "value": "f2f3f6344e054a03cd83e2e2f00af2af3d59f1c5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544867, "uuid": "fc26766b-832f-42ae-a2e3-0489055e69bc", "comment": "Malware payload (FluBot)", "value": "d52dd15cfc5e54fc5290f01dc4c8cd2d42a98afe62af0021da5ec19a023290bb79cb279e89eefb3581ceecf9f581d7a6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544867, "uuid": "df681e2c-cb31-406b-9e18-31069ca828e7", "value": "T173362325FDAEE427D20FD139C5A499CBD508655C8908FD1B2A26804C4EE6EC09BCBFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544867, "uuid": "f53394c2-b300-4fd6-859e-0004fe78b29a", "value": "98304:UHIuiDQ9wfSVdDp6gDkTjhJfB5oxlAuEk0Olk0mYjFpfYgQ+Q67D2t:Uor4pVZp6PjbfskXX+3PQd67O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634544867, "uuid": "c93b8127-e3c2-43f3-a89a-1a891147d0a1", "value": 4875200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634544867, "uuid": "f8a1f0a5-92e5-4f76-8efb-d36b486be404", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544867, "uuid": "e874316a-627f-4ac9-83a5-923d012a5d7b", "value": "Voicemailx30.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944c1be2-3011-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634561260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561260, "uuid": "497429b5-d3c3-48c8-bc2f-7b4ac4e0bbd8", "comment": "Malware payload", "value": "a962f7a1cdf29a4c7498033330faa177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561260, "uuid": "8529e221-a83f-4911-a7bd-86ec2a022a11", "comment": "Malware payload", "value": "ead036570e4444089b4d897e9491f5ffc3ad0b5143a593e9b748f789e13cf975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561260, "uuid": "8c203dc6-b880-4456-acef-b88f5fbaab41", "comment": "Malware payload", "value": "4ab55153155ae06b37e5d61bfb3525c3b1fa15da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561260, "uuid": "fd3a4be2-604d-4173-aaac-5ee485347edc", "comment": "Malware payload", "value": "f465b2c41c34dbc2adc472858bda824e4ac940c5895c0b84fe21d0ab2c63989ede7cd4cf3a48b557e004d3502fe4d7b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561260, "uuid": "4cc04e2c-d620-4f05-9ae9-33893cfeedf6", "value": "T1EF84F00172658F22C9BA5BF9403891634773AD374050E28A6FE57DCB3D79F42827AB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561260, "uuid": "8aba3ce9-f336-4aec-835d-571b3c56d55f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561260, "uuid": "e8f5d1c3-e258-4b77-9291-094dc8154ad6", "value": "6144:PqL5BWDGsRwixPsDXbtFcMC+RdmfBI8pGw4JdN/6t9CWYhWs8z6FmO2ezY:PqzyGsDyXb/9CSdqI8IdVSrsWsa6Flc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561260, "uuid": "45a5b4e0-5b8a-4b22-8266-512c992608ee", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561260, "uuid": "a1198992-bd6d-4dc5-8487-bae0433d7e6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561260, "uuid": "1af7fc8b-f9f7-4ac7-a8bb-ca6295928238", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a8b5b1-2ff5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634549394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549394, "uuid": "b9b6660d-3467-4384-bd4b-591c6cb26018", "comment": "Malware payload (Formbook)", "value": "2faeb35dfdd6697b4721d70094a8eebb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549394, "uuid": "43c50286-65de-44de-950b-01cf6c36206c", "comment": "Malware payload (Formbook)", "value": "eaeb4a70b5df25c40d3e443b2f4b3adbd193b0ed7ffcaf4c5ca3d5e9955134ef", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549394, "uuid": "6501d18d-8019-475a-8175-0c1e43c771d9", "comment": "Malware payload (Formbook)", "value": "19b77d1975995e7e7d4587075e939f02bf3a1418", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549394, "uuid": "fd9b1b5b-4704-4369-960d-247992ea644f", "comment": "Malware payload (Formbook)", "value": "9f5e4e59e72cc1d213a96acef678dc7be66c89aa7e77c07237d6b76d119e25bc18bdd9df8e6c806e1447b5695e63f96a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549394, "uuid": "8c71ed8b-4141-42e5-8f30-a291019dcf0e", "value": "T1D3F46C1EEBE204BBF037617CFD0AE67C1895AF501AA4A04239EF795C6B3C64251253E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549394, "uuid": "70b3d878-bcc1-49ea-8230-609ea259e85b", "value": "c27a46121fdf0c7d592b2676dec19736", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549394, "uuid": "cd77442f-d692-49ee-9f82-760b3cd998d9", "value": "12288:U2QfYldSyZTiq8WIPK2gMrKkuAV/LFLtF/ULvFfji6O6BxB:UrfByZKz5ge/DFLtF/QFfji6O6BxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549394, "uuid": "dd2af798-d198-4a12-98b7-ba3f63591799", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549394, "uuid": "696fc3f4-c5c0-48c0-8402-02da3c4e6822", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549394, "uuid": "6b465a86-c3aa-414b-9c66-0b3957f49aeb", "value": "DHL Confirmation CBJ211011128996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062c7609-3050-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1634588080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588080, "uuid": "4d8fdba3-3a55-4baa-840f-32c1b822bd8c", "comment": "Malware payload (CryptBot)", "value": "8c07387ad12b8c8e0cdd858fc7d478b8", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588080, "uuid": "37829834-99ca-47dc-a7e8-108a740b3bff", "comment": "Malware payload (CryptBot)", "value": "eb1fa54f64579a6b83cbadc59fcf34d045dd98d875569fa3876449130a5588be", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588080, "uuid": "13a360b0-23bd-4de9-a65f-06c51a6e62bb", "comment": "Malware payload (CryptBot)", "value": "4b63ecaefc737a4b75e2d9b229a37439223d0b53", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588080, "uuid": "7ab1e55c-0470-4da2-8c67-119b17b060fa", "comment": "Malware payload (CryptBot)", "value": "6a156fcfd0a5a8315be63ac23a14f2c329da2d5e74a5f975e677a81d3f65d3e293c1bb002ddedc32c15857f814b067d5", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588080, "uuid": "40a67069-aba6-42cc-a81e-4cdca6d03bf2", "value": "T14594BE20A7E0C035F5B616F44AB9D3B8B92E79E3A72490CF52D116EA57356E1EC3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588080, "uuid": "d746283f-5af7-4822-9b47-8b29de29fadd", "value": "aa28841a98fbdef9684f8dac2b470256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588080, "uuid": "31c59349-cd15-4147-a9c5-4ef9305e73e8", "value": "6144:SQKYmpSVmhEAnijRxqDEcshKl4u8kCqVCSxHKNCrz:SQ3MSVmiJbrMl4u8kCSxHKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634588080, "uuid": "6159472a-e930-425d-9c95-2c0273735831", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634588080, "uuid": "4d9128f6-d36b-4363-a6eb-cbcab7429fab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588080, "uuid": "d7754eb4-88dd-4f95-8783-d0dda4c3cca0", "value": "8c07387ad12b8c8e0cdd858fc7d478b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccd932e-2fe7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634543208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543208, "uuid": "bd52efb2-88e3-4eec-9bd0-00e0c2b379af", "comment": "Malware payload (Mirai)", "value": "bd3fdcb37a84d47a5e46a62c5cf73f5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543208, "uuid": "9455a73a-4ac5-4492-84d8-7556e30dc184", "comment": "Malware payload (Mirai)", "value": "eb265a67c1c60e3564eef6634276cc60e510123df4333345ac0567d08ac4b625", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543208, "uuid": "9865c9e9-9d30-46a3-9ab4-8e0dde6c4809", "comment": "Malware payload (Mirai)", "value": "af519144c44d7c6f7a046c5f2269f9ac15bbbd77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543208, "uuid": "d7868637-2039-49a6-b6c0-aa6fd324d083", "comment": "Malware payload (Mirai)", "value": "a5ad76d241b75786e599d98f92297ed92b9ecc05fb129d605c35c23a0ab1b597d057dcf13de247f767bbd08c3c197379", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543208, "uuid": "20ae89ed-b2b3-4bf2-a248-6fbc7630d2b8", "value": "T19713E135D2F06D06C7DDE9F00946C3E837D15B9EBAD3CA816FCA3B92191CA3A1906E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543208, "uuid": "d683defb-91ca-4f46-993e-9854b86dea03", "value": "768:exVfdipo01MQSOoknnGYZFRY2cKzuy+6vL9I4WFXU5bayQ4zjy1MAJ+HFtORjpML:ebffOMQEgGYrY2GypRI4WFXdyPWKA8FT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543208, "uuid": "ea91275f-d3aa-451b-a36b-bb7e95ce7170", "value": 43164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543208, "uuid": "f6c70b51-5858-4445-b782-10576d7fa496", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543208, "uuid": "670697e6-d81f-4cfb-835f-27a84e9c9780", "value": "bd3fdcb37a84d47a5e46a62c5cf73f5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5dfd64-2ff6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634549677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549677, "uuid": "e0bade97-e653-478d-9270-956902de2f32", "comment": "Malware payload", "value": "d050948cba26749ca0ae38c401cae549", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549677, "uuid": "f33db1ac-886a-489a-b9ac-4abf381c09e0", "comment": "Malware payload", "value": "ebcfd0fc3ecbf9281e9f42e858be21770fd7e3d92facd23d3dc589f01b1a1091", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549677, "uuid": "74fd345e-4a3f-4d49-bb53-24046b10d35c", "comment": "Malware payload", "value": "91a3471081352093d319e97abf787ecd7ecbd2d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549677, "uuid": "b523e13b-93da-4922-a19b-58b3125b963e", "comment": "Malware payload", "value": "80b0259cb45ab3572097babdfe490ae3c71cbd29baab1faec8e893b9cce502a47bc583a7e57bf43e62b8c595da38e069", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549677, "uuid": "449ddc2f-47aa-413a-947c-55bc2dc9bfc2", "value": "T15016226622263D46F1C5CE3A5D2BAFA9B1F9032F47F2BC74514DED9711210B2628FA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549677, "uuid": "34e5296c-d4e2-4a92-8dd4-886672d62f43", "value": "2c58ba983cbcad8b3c06c5b4f999bb55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549677, "uuid": "0bc27cfb-83bf-425b-ad18-59fa483f193c", "value": "98304:Jf0gnUUlBQgyoOqHAvtgWgyuccfQ+qDh/d8:h0gUUlqHqMgyuTfQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549677, "uuid": "edd45da9-6549-4faa-9b1c-b397636e149d", "value": 4379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549677, "uuid": "86b6cd1e-abcc-48ec-af66-9ca01d80457e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549677, "uuid": "3dff80be-dce1-4c07-a037-72174a35f8c9", "value": "d050948cba26749ca0ae38c401cae549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e309232a-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1634542064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542064, "uuid": "d8ed0b0a-389c-4bae-aecd-ac6cc27a31bd", "comment": "Malware payload (Formbook)", "value": "4175059892622b933de40274793c3f23", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542064, "uuid": "c86cb5b5-6d3a-4ead-a5b8-09955ab15111", "comment": "Malware payload (Formbook)", "value": "ec1c15c422e281b1aea9ab9aedb0fbb7896c605827c72e5842f42de56e62152b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542064, "uuid": "5a437a65-d15f-4db2-b3d9-f5e2a90b5d1a", "comment": "Malware payload (Formbook)", "value": "da9672d4edbebfb6189f6eb651f6df374f388402", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542064, "uuid": "7b85b930-8200-4f19-a5b9-e8129468b6b1", "comment": "Malware payload (Formbook)", "value": "b1968ee12bccce1d2cfe8f26288e4ea8b47eb2ffa8e36f6803a6bfe908a59de797753e02919f1513837ebda3d44728d9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542064, "uuid": "6ca572d2-c8a4-491f-8e8b-5b1999079189", "value": "T15864C0253151AA8DCA7676F6619184C3FDD59C1861B19FEFE980B1CAD3FB0BCC7800A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542064, "uuid": "8fdfc525-870b-4393-ba08-690d11a94f3c", "value": "6144:ZdJQHbhXOwJLaJ6+UDZuJUxqdSdOnIUKOB5p7uWaMK006hUD:ZeNOyL1mTIUKasWUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542064, "uuid": "f64e9271-0742-439b-a9be-ebae02504e01", "value": 318792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542064, "uuid": "fea9f54c-2f30-44bb-a787-d8670f63db36", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542064, "uuid": "004fc95e-04f1-4987-868b-61f9226d6b8a", "value": "ZHANGZHOU YIHANSHENG HOUSEWARES.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8e3d42-301f-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1634567448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567448, "uuid": "97b7775b-ccc3-4bbb-a2fe-92e2dc68c15d", "comment": "Malware payload (Quakbot)", "value": "19a1f6c337a8fc5779e7094386751cd0", "object_relation": "md5", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama117", "colour": "#2CFE58", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567448, "uuid": "38c342d8-1d2c-4527-a558-d3a84b18a2f6", "comment": "Malware payload (Quakbot)", "value": "ecc4f7d2b9204f21be814dbe03ece38b6934fcf1a37c6b848979a2e5a9f29e61", "object_relation": "sha256", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama117", "colour": "#2CFE58", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567448, "uuid": "29340add-b77d-46a2-ada0-f2e75d2a439c", "comment": "Malware payload (Quakbot)", "value": "2c255cb5e8cf104b4bbac7b47589b63a5edc0f64", "object_relation": "sha1", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama117", "colour": "#2CFE58", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634567448, "uuid": "9c6a8f5d-897c-4ec7-9d81-f2e8e7ec990a", "comment": "Malware payload (Quakbot)", "value": "051d9ceb46cc9d26dc7b2c21f2d72b06d41ef69afaddbb0e6649ac909cbd2ec95606f34d0495a1822031d05e9ba65cda", "object_relation": "sha3-384", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama117", "colour": "#2CFE58", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567448, "uuid": "182cc4e6-dcd6-4df1-b1f2-6cbf27fd1103", "value": "T1BBD38C427787C99BE98503398ED3C7DB3B72FC21DE22470336467B0E5E7A2A18D16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567448, "uuid": "dd7a8211-12ef-49d5-9ddc-4475615e69d0", "value": "3072:9k3hOdsylKlgxopeiBNhZFGzE+cL2kdA7c6YehWfGNtUHKGDbpmsiiiv2K+lrXqH:9k3hOdsylKlgxopeiBNhZF+E+W2kdA73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634567448, "uuid": "d7ea4bac-fdb3-4291-9ea2-885f6164a7df", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634567448, "uuid": "867d60f6-0d25-440a-9529-baa58edf7b13", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634567448, "uuid": "98881d69-e209-4bff-a281-2e9f83d81bbe", "value": "TXN-436671122.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacb0ba0-2ffd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634552761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634552761, "uuid": "9525456c-e4fe-4afa-8d75-3207abb2737f", "comment": "Malware payload", "value": "da5a961223861f524a93b5bcf504ee69", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634552761, "uuid": "ad24cafa-e206-451d-8f67-99134fed21fb", "comment": "Malware payload", "value": "ed1fdfd6d55e50f520d5d9abedd452844c545e7f0a5f43191c57ddeaf9c3f426", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634552761, "uuid": "5358f103-5c59-4384-b82c-921a47f01871", "comment": "Malware payload", "value": "a2caabd8d45d8ddd43c365aa586bc3bd2fc3a6ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634552761, "uuid": "0309f746-124a-49d7-a3ea-f866476f94e5", "comment": "Malware payload", "value": "61b3bec691e588b26387f62b79319d0a851cb48885d69e626700ec617b265518ba9243c53d4f615b07ea067de05a095d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634552761, "uuid": "f7f02bc9-684f-4a89-8b53-f8a6d3f6cc8f", "value": "T107C292003391C623D26A6F324EC3E6D67330FD41EE42876B3294736F2D75AA89D61756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634552761, "uuid": "d0fa52c1-52ab-4e88-a6c5-3d44890e0fb2", "value": "384:304dgNlaqdGjAU7tdSTTX49/d2EqGMuORhTG:LdgNlaqdqFwTi8EERhTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634552761, "uuid": "af0cdac6-202c-4f0b-841b-6a90d92dec20", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634552761, "uuid": "82f499e0-2112-4539-bafc-594fbaec4a44", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634552761, "uuid": "0004b2b3-4a91-4bde-92ad-14ced3091aed", "value": "SecuriteInfo.com.VB.Trojan.Valyria.4812.23568.8653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b01bca-2faa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634517051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517051, "uuid": "6cf0a8fc-747c-472a-ab58-76052b6ccbe7", "comment": "Malware payload (Mirai)", "value": "b9fec045382a52611f928095f599296e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517051, "uuid": "25063101-c8ee-4f18-9de3-6009d7f0dd2a", "comment": "Malware payload (Mirai)", "value": "ed209711669916e220347313e77815923c88bbe1e5bac45bc47ced4ca1b8128b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517051, "uuid": "8000f851-443f-4e91-a61c-802eca7d4a9b", "comment": "Malware payload (Mirai)", "value": "6d5b5c2c7100a0181754451d32aaf727d0ab299b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634517051, "uuid": "3ac72125-5550-423a-b4a0-f006ec3236b1", "comment": "Malware payload (Mirai)", "value": "d40989fb00d5c9344eba605ca7c7333a0ca0cbe839cc58a6277e15df9d1cb7f98eae03f65f14ce589576776e3806e9a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517051, "uuid": "3cc41f72-8630-44e0-b446-c29be4e87a3a", "value": "T14643199178D19A16C6E423BBFA6E40CD332563E8D1DF32179D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517051, "uuid": "40094059-966b-4164-a129-88cb83b24917", "value": "1536:EaDIpuRZhJRAAMA+xVZtWaWhK3+y6MdD:EaIe6ZtWhhQ1dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634517051, "uuid": "8a2e7234-e0c2-472b-bba6-7fdb6dafce22", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634517051, "uuid": "c4c74a80-471c-4d49-99f2-140884ecb803", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634517051, "uuid": "6d978889-636a-4c78-b03f-01bf7286b184", "value": "b9fec045382a52611f928095f599296e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223ea251-2ff7-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634549901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549901, "uuid": "2548d2ef-1530-42f5-80ee-18f819c85f1a", "comment": "Malware payload (GuLoader)", "value": "70e9b753cb1f4f173c75c0d85f5e5a48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549901, "uuid": "681d8bd0-1d78-4e5f-8c31-9cb4a9f69081", "comment": "Malware payload (GuLoader)", "value": "ed77b015d1ca486b1820727ec913ee0c42b3f622dae4ab25c9605f34ea13ba47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549901, "uuid": "35b5fe74-c5de-48a7-b627-d6358af1122f", "comment": "Malware payload (GuLoader)", "value": "97a15f594479af8004e82307b76c91319ea2e5df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549901, "uuid": "52692e4b-c734-40eb-ba33-0888dd744a4e", "comment": "Malware payload (GuLoader)", "value": "c397fe85e780f673f98bbea9737dc1b057f73c4ffe54d2971ad7da3ee5112ed86bee878959fe72b9ebfc2fbbb5578ed9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549901, "uuid": "52d9db62-ef6e-4fe1-9f87-5c942fd6f02b", "value": "T13CC35BE2A5F22FE0E053467F93E28B257537FD5009255E0AF4CD7D2D2EB2681A46234E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549901, "uuid": "495b2d73-0b8a-4191-a1e5-0dbcd71ede0b", "value": "fd2a350e6b9d34ec5cf88c61afb9d41f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549901, "uuid": "026c440f-b40c-4c88-bc49-34445fd41d8a", "value": "1536:kSXSFqLB1inqw8lIFhQZjPNTGYLEiNFVZ1Kefrg6roVU2hmhLB:VXSCOnEIF+PNCYwAbKejrF2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549901, "uuid": "e0edb89b-d51d-4b3e-a289-daa7bc4a52ef", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549901, "uuid": "02e50678-fea9-4e7d-bb31-3f43ac8fd3b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549901, "uuid": "ded53ff0-35cb-4ec8-9c49-98334c812ba7", "value": "70e9b753cb1f4f173c75c0d85f5e5a48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6074885-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1634561397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561397, "uuid": "86365b37-593b-4a6a-ba1b-31a7f3c107c3", "comment": "Malware payload (Gozi)", "value": "323418a0b6f38ca1bce0a72ed3081ab4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561397, "uuid": "a68b3db6-7d4b-4166-83f5-31ff4f2088c1", "comment": "Malware payload (Gozi)", "value": "ee784e9f14aa4c0729d35f8cfb96618d33173cf6ea8db49c5f3fca1938afda9c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561397, "uuid": "33d46fce-cb5c-4318-85a3-40d040cb4d23", "comment": "Malware payload (Gozi)", "value": "47993e38dc59752fa26e08a8af1da896a6121dd9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561397, "uuid": "558b6b02-c816-4f4d-a757-af894cb473ab", "comment": "Malware payload (Gozi)", "value": "1434410e051699ebba36006f706d206c1d87f2241db2517da21a21b50483680c36705b0765a034cc1c33249cc62ed488", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561397, "uuid": "fe59c2ea-6bcf-44da-a3d5-1c49eb90ac89", "value": "T18DD49E2032A18032E177163584F5D1F05FADBC225D74AD8F72C52A7F0A7B6D29A29B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561397, "uuid": "6631a732-c529-4995-b4c7-eb091419b481", "value": "f0b89328d13367d734b49a9b596639ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561397, "uuid": "2ec2f9cf-1ec0-4e79-9843-e630e12837fa", "value": "12288:R8dajLSIFcqRfyo4Tg89UtoM+YD3h0QYDpnynKZ0febiP+eMq6FiIahzrg:noqpyo4TgmUtoMapy60feeQiIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561397, "uuid": "01075f80-5350-41f6-8940-39591d7e1252", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561397, "uuid": "811c100e-539d-4635-aaad-d9139dc8b480", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561397, "uuid": "85da7a85-869c-4b0f-b838-afe82c656133", "value": "323418a0b6f38ca1bce0a72ed3081ab4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f70a916-2fe7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634543213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543213, "uuid": "76867581-fd0a-43e7-9f8d-e8820bfa2224", "comment": "Malware payload (Mirai)", "value": "836067b094c8bebc01a6592e17e10ac5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543213, "uuid": "e6f7a314-035b-41f7-9929-956ea26adbcb", "comment": "Malware payload (Mirai)", "value": "ee7e4bfb172dbe537689d3ff4fee2b1831f911856f1fe86660ef5ec9a9ea966d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543213, "uuid": "2aa4a01b-42c6-4fe0-b800-611bc7870e24", "comment": "Malware payload (Mirai)", "value": "c7b12a09409c10084779ad78074104e330b662ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634543213, "uuid": "152a5fff-5f5d-4b9b-8011-8d06ffe73753", "comment": "Malware payload (Mirai)", "value": "518bd2f25320571579d7cdad24dc0407b155212e3d7f510654f2ea76993e37b4976fcdb7f32229fbb399e81b9cde2b96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543213, "uuid": "518a4150-1b41-43e1-a100-c73516838081", "value": "T1A613F1344A5AB022EB34C822B935C5BE53F65FF4F2AF750B57B4899675A6047023C2B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543213, "uuid": "d8a17391-f7a1-4d7b-b94a-4bc81ac96ec9", "value": "768:Ov8vFBQ5lZv71twBg7uOVjRx3thjvFrhCqjf1TsHEC1HeGCgT01WHX0nkys3UozR:OvOi5L3waFj77Cq6kCN7tTCUX1zGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634543213, "uuid": "037de328-06cb-4a7d-835e-51157ed00936", "value": 44008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634543213, "uuid": "4a762797-d4a4-4f5e-b423-1e1c76895e69", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634543213, "uuid": "c07230b6-549b-4d68-84eb-feab8a0fe4a7", "value": "836067b094c8bebc01a6592e17e10ac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77cfc13-2fed-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1634545830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545830, "uuid": "dac5aed6-8db9-458a-8aaa-8ef1150d16e6", "comment": "Malware payload (GuLoader)", "value": "2c367613f660093076d5af13ceab0fce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545830, "uuid": "31f63543-7587-4844-a0e8-f7f712b602f8", "comment": "Malware payload (GuLoader)", "value": "efc65dfa10179e26ab832705d131228409c16c545445ece35bdc539d8be214f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545830, "uuid": "f06ee3ab-f92b-47c9-9d8c-d26bf8cc6d55", "comment": "Malware payload (GuLoader)", "value": "3b8e3eb633072585dd1c33bb107c3aa5d81fb781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634545830, "uuid": "7335c754-1f6b-4737-bc5a-3c8f2278e824", "comment": "Malware payload (GuLoader)", "value": "8fc74ca1bc657327b5b643ea3d48de70102fa8f5b524853bf64525d2d720c7b582bbc599f3e0e859f2c28ad5aeee3554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545830, "uuid": "964fb706-1194-4e7a-9c37-2952998f7583", "value": "T111C338D295B45FE0D057437F43E14B76B83BBD600562AE0AF8EC3D2D0DB2A86A46135D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545830, "uuid": "7105ec90-7b13-4eec-861e-3b3f43994c05", "value": "fd2a350e6b9d34ec5cf88c61afb9d41f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545830, "uuid": "65c51a71-6b13-427e-905e-a5553d2b897b", "value": "1536:yie6Nvq6ke7v5BnUq5mkm34M2NUj67EOIeGTpPj5ZKmhLB:ze65ke7RBP8kA964OMTlrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634545830, "uuid": "e0423aa8-e061-41f9-b2a6-8ba2142925d1", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634545830, "uuid": "98cf6146-a449-4f26-8234-26b0f7d75997", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634545830, "uuid": "7ac2025f-80ca-408d-b17f-651bec8c55d3", "value": "DN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226377a5-2fff-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634553338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553338, "uuid": "8cdd53d1-d255-4be5-9130-85a55d1a86f3", "comment": "Malware payload (AgentTesla)", "value": "20155e92f6a7a7763994226e11713552", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553338, "uuid": "26bfb849-280d-42d1-a926-954389e5d75e", "comment": "Malware payload (AgentTesla)", "value": "efe702eff8b1684d9a92b1a5f24e1f375033dd124e588ee30cc778adc16d76f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553338, "uuid": "f7ce69c3-ab3a-482e-8b3d-4cb0d8e6a019", "comment": "Malware payload (AgentTesla)", "value": "40924207e867cf348592997149b3c4c09218913b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634553338, "uuid": "629212d3-6c2e-493c-9191-9e9aa2438d71", "comment": "Malware payload (AgentTesla)", "value": "ff07ed32f9145dbd8e270a8616bd18a894303de3562e50ca03966b342325f3a15ada96ec32eb1af5c5df4a689424a2ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634553338, "uuid": "b6fdc228-1280-4b86-96be-bfdc29696f1e", "value": "T1F274275303891BBDF68D0EC9C94B255B20F2D4677D251298EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634553338, "uuid": "1d528c3d-bfa0-4a70-968a-a8d1788a03d6", "value": "1536:EU00amxtg0natcmsqDifqO/vFHt543MCfj/gfj5wbQKKJskZguVeTY4+jUgRD4sL:NwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634553338, "uuid": "b6a13bc5-b483-450d-8143-88b45fb8bbe4", "value": 364359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634553338, "uuid": "61ef4f54-91b2-4369-8ac2-2d90403d9577", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634553338, "uuid": "936a8dec-e1f3-431c-bf6c-c5f23618f9fd", "value": "92c492_959babd593ed4cd49dd3b6a0f1146d59.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb2f9f8-2ff6-11ec-843c-42010a9c0014", "comment": "Malware payload (LimeRAT)", "timestamp": 1634549600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549600, "uuid": "365b9f1e-d2d6-402a-81bf-dbb24ea97f05", "comment": "Malware payload (LimeRAT)", "value": "98c0e8ae038031c7f5f210119c1b0b36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549600, "uuid": "795ab835-7ec0-412f-ae96-6374ef7ae11d", "comment": "Malware payload (LimeRAT)", "value": "f090ea218b1b9efedee6bae4665c1066649dc0fb94542467a56ae5a0a2c693e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549600, "uuid": "f63553ce-a447-4b12-92bf-bae969b0f05a", "comment": "Malware payload (LimeRAT)", "value": "e63bb6d9ebe904e805f93f86dba97f6eeb6a5cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549600, "uuid": "b3eb97da-8295-4492-9435-e1e96a05325e", "comment": "Malware payload (LimeRAT)", "value": "bc7706e82208c0df233850cb340e29522bc6f9af08961c0fb49218966e2fb804e1f204924ce24fe9281c290c6245e78e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549600, "uuid": "542427f6-a88a-47e6-aa79-084b5a3d8753", "value": "T14503C402F5909370C7E64AF7B8DBE00CF2A5986D0617EA9AF0557F8816723D21EF961C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549600, "uuid": "ebeeeefc-1445-4e76-95f9-334e7544e66d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549600, "uuid": "cb7d3673-a173-443b-b1e5-3fe65e040896", "value": "384:2UyBbXgdNSPj9Wyo0lEmogGVAyL8hS0nmns0/5v1G983ViMTvLAinU5BavNes+z:YNXg+PJWyo0+mDa5L8htns3ViMpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549600, "uuid": "42a334cb-8a91-4d1f-9d86-78ff407a3029", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549600, "uuid": "e0ee042c-70af-40c6-9cb2-56c1b083eb94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549600, "uuid": "1dfc394e-5443-4a1f-909a-cba6ced260a3", "value": "PAYMENT_COPY_ HSBC BANK_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef180801-3060-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1634595342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595342, "uuid": "932a77e9-bb64-41ed-8832-cabaf268ed99", "comment": "Malware payload (SilentBuilder)", "value": "ea4ffc3d8b9a31e11d72b7eab787bae8", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595342, "uuid": "c3938016-58cc-4842-95ef-b4417e4ecf8c", "comment": "Malware payload (SilentBuilder)", "value": "f17e95c7e3dce9e03c629a9e0745cd7ff01c2686036636006b4463267e2b3b5a", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595342, "uuid": "2867ba76-ac1d-4fc1-9cae-698ef36265d9", "comment": "Malware payload (SilentBuilder)", "value": "d3d43dce8946a5c585c2eab607255250bb162b51", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634595342, "uuid": "8198377d-7e7b-4da0-8242-fcd59c863c94", "comment": "Malware payload (SilentBuilder)", "value": "18d260d869e3c771c637d37dd50c5085d8ad26b9be54730a868865108a21b51a39130eadde88010a5ecc24fc6e405eed", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595342, "uuid": "a5f2f733-2453-4b83-8d2b-bd11607b381e", "value": "T14344E14AF175C84DFE4A873A4CDB0B9B6376DC128BAF0647B685B1506EF1DBC1A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595342, "uuid": "030415e1-eb02-4d6c-aade-3c7e1b39cafc", "value": "6144:5Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dg59jWvcZZdtjq15OD7IvOEPD0lgvS3enw7W:U9jFrjmkD7IvLDK3vLvfn1+2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634595342, "uuid": "3018536f-2c13-4bf8-a1ca-445fe669311b", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634595342, "uuid": "dd3ec9a8-dda5-456d-9782-19455bf1fcfa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634595342, "uuid": "d32368ca-1803-4372-805e-3972a4fc8cb6", "value": "ea4ffc3d8b9a31e11d72b7eab787bae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88771480-304f-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1634587869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587869, "uuid": "dc633933-eb6c-4bc5-b2b3-6c4231163dcc", "comment": "Malware payload (DanaBot)", "value": "d870904882cf877c66b16dcd5e2572b3", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587869, "uuid": "90c1cdfc-09fa-4d24-aeae-ee297fc55b95", "comment": "Malware payload (DanaBot)", "value": "f24001f95b70377e15a6153b8291eedc1f48e9552898c85d59daab3dc26aee88", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587869, "uuid": "6ae1308b-e1b2-4f99-9883-27d16a4ee105", "comment": "Malware payload (DanaBot)", "value": "96f5b3f86999ce1fe274ce6481e5cfa48f252ff4", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587869, "uuid": "9e80ec8e-eef4-44d5-8fd7-4bd77452354a", "comment": "Malware payload (DanaBot)", "value": "1f0485609a1a9fe0ed230cc2dd67376e8c763893df95342ffe520017fd5ac9d0d37696ac4069532e34a1f2bc87ea120b", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587869, "uuid": "0c34ca50-451b-4732-9246-932f11e0330c", "value": "T106451200A7E1C035F1B216F449B9A3BC6A3E7AB0AB3555CF62D51AEE06366D5EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587869, "uuid": "a9e0a706-695f-4168-a241-c40dbbad6c5b", "value": "6f2a068c255b00f177d7f883be0dc61e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587869, "uuid": "876c0409-be84-41ae-8ed2-e080edf0787f", "value": "24576:R2xqCGbJPQwQaF8GqZBkPeNelbFpDf1WMO4tTZHa7D7/x1R:RKla+ZBkPeNw5ZTdZHa7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587869, "uuid": "14ae6a7a-0736-4727-91c0-f29318acbc07", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587869, "uuid": "cfb71482-f59f-4b93-aa0f-91672320b160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587869, "uuid": "5a716677-5268-44b0-9c20-90bd2753fa73", "value": "d870904882cf877c66b16dcd5e2572b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6999348-3011-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634561317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561317, "uuid": "8a13e401-7897-4ccd-911d-068fc23533af", "comment": "Malware payload (AgentTesla)", "value": "6e93f7298beda239f60083a0c5425060", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561317, "uuid": "c38c5a95-58fb-4cbf-9ce6-4a2074de8a4b", "comment": "Malware payload (AgentTesla)", "value": "f3a8222b6462aafcc1d47fa1a1ca8972daf438b0d98666308958982307ab88fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561317, "uuid": "60c975aa-2747-4a76-bd58-19f9a63168fc", "comment": "Malware payload (AgentTesla)", "value": "3eae538f716c7ef96ec27915d966e5ee8eb95f61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634561317, "uuid": "3eea3d4c-7e59-4521-8567-f1ab0e8c4bfa", "comment": "Malware payload (AgentTesla)", "value": "bac0c7140563bc5e604c4cfd6850e58c543ff8bf03f6190c4ceb2360e19b2e78a7697d6b7730af8963b28cb3c7ad0a93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561317, "uuid": "8b0f18c2-7c1c-441f-95f5-58eade87d698", "value": "T169839CF277C86C13D82EFAB274D5B3852B61C70F6A0E7A49396944B51C917CA26C0EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561317, "uuid": "5dc67579-860b-4298-add6-647894c2cffe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561317, "uuid": "a1a1d701-9d2b-459c-b003-24017edec76f", "value": "1536:s4yReHS0Cy74CT3TrYz6vDpMQ43+41xPNfadx:sFReHS0h0CTXYmvFMQ4b1Lfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634561317, "uuid": "cbb6197a-8715-40d9-a11e-d862feda90fb", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634561317, "uuid": "dda902fb-645f-459d-a790-de7e58d07a57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634561317, "uuid": "03fe0254-d17e-42f9-bcc0-395ec795919b", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be17aa00-2fbe-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634525682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525682, "uuid": "3ddff0c3-ac45-4070-9cf6-629b8220c6aa", "comment": "Malware payload (AgentTesla)", "value": "c5b78f6103c7794006f9d5d966b3bdbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525682, "uuid": "99b84d96-56f8-42d1-8f17-10aa9551a5c7", "comment": "Malware payload (AgentTesla)", "value": "f3d8fd75e106b26fb267e3d5c78c299b052c5ef53228b0f0fba3e308bcad1d26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525682, "uuid": "69e8296f-1179-4337-b452-891fbb3e53be", "comment": "Malware payload (AgentTesla)", "value": "1858e3e0efd8c7a7df30c0af59ab3249c7f72e30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525682, "uuid": "b4a890b8-2b59-4670-b04e-0ece46c3bf1c", "comment": "Malware payload (AgentTesla)", "value": "58d4b505f7723b5952edf87820f284cbf5107e37f46f0803063e36930333ed8ffeb873183ca912813aa448159b976cd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525682, "uuid": "a1f69de5-b2be-4477-9518-a799173dd791", "value": "T1E9839CF237C86C13D82EFAB274D6B3852B61C34F6A4A7649396948F55D517CA22C0EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525682, "uuid": "a448dfb8-88c3-45f1-a5f7-fc05d10f0d00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525682, "uuid": "30e14033-1f70-4e14-8492-a37a47ebffac", "value": "1536:QVp624eBS0Cy74CT3TrYz6vDpMQ43+41xPNfadG:Qr4eBS0h0CTXYmvFMQ4b1Lfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634525682, "uuid": "603afb95-34af-4346-9e00-ec2a4eb0d6ac", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634525682, "uuid": "6eed83e0-1e0c-4adb-860b-cda7cec2e683", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525682, "uuid": "86206bd5-cf50-46f7-9a28-df3b5a6d0cc4", "value": "003847.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c3dd9d-2feb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634544787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544787, "uuid": "9902c5de-7ec2-42db-bbb0-955879471585", "comment": "Malware payload (Mirai)", "value": "a86048aeec0cc1478e81fc65da08238f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544787, "uuid": "5753b209-7272-415a-b6b1-e82665344ad6", "comment": "Malware payload (Mirai)", "value": "f431d36fdae0dec6bbdd320902ddfa93ec3cb6f8adbfe7cd8338cbe2c8ff0bee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544787, "uuid": "4a19f053-df9c-4b7d-9f42-6be71a4bcaed", "comment": "Malware payload (Mirai)", "value": "e64103a883bd3dbba2abf0d26e1a945f80f37e72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634544787, "uuid": "242aa5db-e913-451d-aafa-7585c800c786", "comment": "Malware payload (Mirai)", "value": "e11ee6f033035608d0c3a5e26fc3f48e5ac1592a0ffff3621d291ce2328fff71572c39f79c7c0604989fac9064bb169f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544787, "uuid": "a193c1bb-b4ae-41d3-8200-d80b1a1cd1a7", "value": "T1B4D2D09E76F0E554C92D28BF415E2AE85C45B1C333FA8306939548C4A9FEC4F287B4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544787, "uuid": "ad42bb46-c844-4af9-981b-8ab5906ba586", "value": "768:bJl+8Bw+KwJLe4MLgj7SaTk7/xtc4cpm9j0Fo1bWO:9l5Oxeyc7SykTTc48lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634544787, "uuid": "696aa6a8-0f91-4481-a14e-f019172b3567", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634544787, "uuid": "d786d7b3-e558-4c05-a756-52345ca64314", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634544787, "uuid": "d021d533-33e2-47f4-8626-dba7b851eabf", "value": "a86048aeec0cc1478e81fc65da08238f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bcd1ae-303e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634580457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580457, "uuid": "25f2316e-b42a-4b07-acde-6cd8fc5f67be", "comment": "Malware payload", "value": "675302753006d7e0e880a538dfa1ea8a", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580457, "uuid": "96392a76-b7e1-4b3f-bb81-62bf8bb9e3cc", "comment": "Malware payload", "value": "f4acb0d4656caa3290de744d4f36d3694bfadde2301531516e4ff33e7c274f3d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580457, "uuid": "55b92864-d6ec-4997-ab1a-5917832d1075", "comment": "Malware payload", "value": "926a571ae6feda988b63c0060e00ab3f45c493fc", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634580457, "uuid": "c483e83d-64ff-4e12-b409-129a68924fa2", "comment": "Malware payload", "value": "ce114150b8ae559ce14e501486f4a707dff02c062c46c53bfe0a44e2c8f9d498b6c3cdeaff6b330c9c961c0c428ea1c2", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580457, "uuid": "9bb5b411-c4cc-465b-a954-3490f51bfe5a", "value": "T1D974C093B8EC95E7D12F0E38E7BD9E3910D79C18423A68B997F03582547AE06124D73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580457, "uuid": "0f97175b-228b-469c-a692-995d9ac94075", "value": "6144:qycsugvV7gJEo/nwTBitE84rEpihNE4BxM6gnBZwcg1tfvU0K0uo6/rgW3I:ll/NitENEOM6gnBZtg1Vq0uf0W3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634580457, "uuid": "1ee29bea-1c5c-409c-8a8a-99c54b3fc290", "value": 351496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634580457, "uuid": "5205e5d9-dc51-4e10-abcf-435d42d578da", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634580457, "uuid": "02f6ec6a-872d-446a-ac6e-ccd6f49300f2", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0459620b-3054-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634589794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634589794, "uuid": "f8b74e99-c669-4f23-8c1f-eb746c6036e3", "comment": "Malware payload", "value": "e275365c0a8684b5dce1b5b626cb8649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634589794, "uuid": "175fb0a2-7f64-42a0-9960-2755b9d24eec", "comment": "Malware payload", "value": "f4f37faf7b52b7544ee58a029dcc54a71941aedcdd2b4eacda2f39c3217aad48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634589794, "uuid": "13f80be7-7683-4515-8e5a-bad72661db79", "comment": "Malware payload", "value": "fdb2e76b53e55f5083774349998815c598074e22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634589794, "uuid": "df30cbb3-35aa-47e9-8d25-fb664a5575e7", "comment": "Malware payload", "value": "bcb7451caf10d7a57899ec54ac23ad65994ec05e39d5a8d7809dce416fc4939a40d12c3bdb3764861b94e41eac2f3a1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634589794, "uuid": "8c631c84-83a0-42ad-b6c7-bad1570201eb", "value": "T11BA63392369F6432C3A516B5815C74A0BBB5E83AA4658C9E7F84335F7530FA2CC35F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634589794, "uuid": "9394ff6e-54ef-445b-a27f-3992713e3312", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634589794, "uuid": "dc022aa3-8ebe-4986-a7c9-9fdca619b233", "value": "196608:dlUuy1BuQSR82yCz4M2p9G3ZkOoh+vbXrKDfjOg/JsXHo4ba+:414QSNyCsG3iOzqWhH/bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634589794, "uuid": "6ae7d7a7-12dc-4699-9188-426edc9e056d", "value": 9839912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634589794, "uuid": "e4f969ed-4ba7-414b-a1f5-ac5d2a22df11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634589794, "uuid": "1d566911-da31-4142-9775-f21109a006fc", "value": "FIFA Football.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444628db-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568427, "uuid": "5e245d19-057b-4ddd-b8a8-3e44f4c8d369", "comment": "Malware payload (Mirai)", "value": "73d01b47ed8ee486fcad31f02a9cc2c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568427, "uuid": "8ff14796-c037-4fa2-8f89-efd9cf04feab", "comment": "Malware payload (Mirai)", "value": "f507638b515fac40d936d0aeaa29b0838dbfc7c02896799d44f1c707ba5f030b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568427, "uuid": "768f8e43-13b5-4cf5-82aa-a9413312b0e6", "comment": "Malware payload (Mirai)", "value": "6eecd785e1e718e155d95348480ef5919bcbc576", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568427, "uuid": "58556246-1c51-4d59-8702-491ba002fc36", "comment": "Malware payload (Mirai)", "value": "13d6627703ea5bd6b57a617fc3de0b7a3d82392e2a307860125e4f69122c73ed3c6dac5904ef18986f0379c6c9fcd7ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568427, "uuid": "ce2db6fb-25b0-46ce-b886-8ccf2a0d300f", "value": "T14D63ADA8D078ED9CC66586B8F54485355B23E008A2633DF7DA83C3A6406BEECF5057F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568427, "uuid": "9721d8bf-cdfd-49cb-b528-a40e125bf8ab", "value": "1536:C/de+O0oGXaasT2CC1VFNO+XjsrzS02cfs3oGb2BbagqC8ZiZ:CleSpXsC1VfO+6zS0Rf+NChagqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568427, "uuid": "7ad1be82-05aa-4b4b-9347-48e4370aab3c", "value": 72760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568427, "uuid": "c6a8b6e7-c4e8-450c-b2a5-e85ae5b69acd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568427, "uuid": "1a773824-ffc0-4c8d-8cb1-0d5ba5b96201", "value": "73d01b47ed8ee486fcad31f02a9cc2c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fee4da0-300b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1634558595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558595, "uuid": "d3ef1095-c24a-4ce6-91aa-a9cdb1a58e06", "comment": "Malware payload (SnakeKeylogger)", "value": "5139e24e3fa4d06a143dd7d297a44ee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558595, "uuid": "70d189c0-2645-4f04-9445-dbca83a00ec6", "comment": "Malware payload (SnakeKeylogger)", "value": "f5a980b01f25dea8e566dff4cc9750bdd5ea67e76c6d02fe490d7366039c9f92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558595, "uuid": "964e024f-dd45-4225-a75f-bbc3085a860a", "comment": "Malware payload (SnakeKeylogger)", "value": "2ee7f89720c68680db7e0b96b30069ed1bed913a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634558595, "uuid": "051736ea-5da8-487b-901b-80fb1da8c2c0", "comment": "Malware payload (SnakeKeylogger)", "value": "48070b524767c3e62af19e29276f74d497364f12eebb545c32e1a4ad4858249b4628fbad6b10f6241c065ff7141a8b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558595, "uuid": "d536d1b4-9628-4ea3-84aa-7a340723b769", "value": "T14B73D7013E046689C5920C7A01F259D1A3788DDF8E9ACE3779E1B73E7873664AE0793D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558595, "uuid": "04327d04-58d4-40c8-9021-bebe4be0b672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558595, "uuid": "f06f509e-ed59-44b2-b094-7d64939ba27a", "value": "768:1gktFPr7fIULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0cj:1pxr7fIULFMAAiu6JL6oNsgFAyox0cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634558595, "uuid": "3c98b713-f114-4fbe-b35a-691335903922", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634558595, "uuid": "e62845e7-255e-49a8-86c8-a39da7d3ccd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634558595, "uuid": "2365fe2c-862a-4147-acac-63b5d440d4fc", "value": "5139e24e3fa4d06a143dd7d297a44ee7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd34187-2fe4-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634542059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542059, "uuid": "7cb00370-4f7b-4d54-ab79-46f8bca64938", "comment": "Malware payload (Loki)", "value": "117b65a2670e41a32b7842eceac2b41b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542059, "uuid": "22cb4002-7df8-4103-9ae4-6a64f99f3fb5", "comment": "Malware payload (Loki)", "value": "f5b77e653a65d3edca888b1beb18b22b97204b9ab425040ec685a9a50e6ef825", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542059, "uuid": "8cc0006c-e7b2-4693-87ea-ca90cadc3337", "comment": "Malware payload (Loki)", "value": "2ea2b0b8a12d37ccfd678e56ca59298baad74a9a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634542059, "uuid": "3c8f18f0-2772-4a6a-bef2-0cf8a46fd4c2", "comment": "Malware payload (Loki)", "value": "7c6270741995c809628785e24dc1b0aa800c3fe1029c41a35cedc6e97650ce261a33501e96a35d58f248338b25063e18", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542059, "uuid": "c46519d8-854f-4f67-ac53-ad3c65cb0fd9", "value": "T19474D1415E3603DDE1C6C63B9BEE1A46E7BF9CC0035F40A6FE2D3E498633D958AA4512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542059, "uuid": "6a80eb54-eb5b-41d3-b113-a35ebb914d75", "value": "6144:+IUPE0EJsP3+XxGd+Sata4uHR9ZsHxJcloJtrncS0D99oGV//bZeMwQ2dCS7nTvv:9UPz+MExGd+SumZs8sncSk73FidnTvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634542059, "uuid": "a72b6a12-81f2-44f2-9d0f-3f1fddc478a5", "value": 350936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634542059, "uuid": "98f5d8eb-1d17-4c12-8ece-21a300cec8cd", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634542059, "uuid": "8e838095-bae6-4b2c-b210-746c3d98576f", "value": "MV NATASCHA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057a8340-3023-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634568751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568751, "uuid": "18022d71-555e-4791-8de2-43917d55af13", "comment": "Malware payload (AgentTesla)", "value": "efed7c80f2d5d857f01cb11fce2969ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568751, "uuid": "552e1342-82b4-42c9-8cb4-dd21d3c6be64", "comment": "Malware payload (AgentTesla)", "value": "f69d3da755e1879ba7c75e9eeb0d855b23f5cb3a3a58785d25eb23acdcfc421f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568751, "uuid": "4c25a17a-e905-4dc1-933b-d18908a6218d", "comment": "Malware payload (AgentTesla)", "value": "ac23b49c35518ed2f6730e26b45e1684568be1cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568751, "uuid": "5807d328-b834-4465-9daa-67361be582a9", "comment": "Malware payload (AgentTesla)", "value": "a0c24d62e71a165eba130c8913f2343c83c8dd6dae9bca49d17adb387d009f22ade2f3c4e03a09b1f987bc88cef9be69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568751, "uuid": "9d5b3c6c-97d5-4873-9e75-dfd6b48df8de", "value": "T169B4F140B17A5B12D9F953F10438569307726C2780B0E28A6EE57CC7F979F82997AF23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568751, "uuid": "47dd8c40-192c-4a74-82ac-64f632fadef4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568751, "uuid": "c0dcd032-bf01-4681-8429-a3cdde71d9cc", "value": "6144:vrbOT9G/cgVy0GPtZYx1ttIw0F+xKFhOwTg4frxq3u8mIJFnsAmQ/OTTzY:vmZGgREZQFJ1TjxcvWAtmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568751, "uuid": "8ea1f46d-a75b-4195-ac13-2de61852451b", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568751, "uuid": "ae063a44-fa1e-41be-ab48-5dacb7461c0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568751, "uuid": "b22fb2d4-f585-440d-b69d-66aa6a2b87a0", "value": "Purchase Inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf6686c-3050-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1634588252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588252, "uuid": "4fd87f45-e081-4c5a-b9a2-ceedfb66060d", "comment": "Malware payload (RaccoonStealer)", "value": "3f6c42e0e6c9e4fc859d74a094bc4b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588252, "uuid": "82daaa74-7cb2-4cf1-aabd-451a5815bb3f", "comment": "Malware payload (RaccoonStealer)", "value": "f6aa3dc3569ec484dd54f461b0f4ff25de4a81c422ad0b91ec06ae5c0fa893e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588252, "uuid": "f8a00bfa-8e9f-47c6-ae94-6c34dbe5db70", "comment": "Malware payload (RaccoonStealer)", "value": "027e4b8048e4ce10c6c95fa9c91844e517a7496f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588252, "uuid": "59bf3340-6f24-406b-833e-1e2248f2bbb2", "comment": "Malware payload (RaccoonStealer)", "value": "17cd31e15dc5d4a1b90dccd673227a794c5ca8b7f68e0b304b49a660dba16b6d6791bc1f7f979d5a27dc1c37965fbf45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588252, "uuid": "1087156f-24d6-4a3c-9efa-180305e9f54e", "value": "T147C4D100F7A0C035F5B663F88A79A3B8A52E3EA1AB6480CF62D516ED56375E1DD30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588252, "uuid": "ef5ea289-6210-46e3-abe1-876869212555", "value": "6f2a068c255b00f177d7f883be0dc61e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588252, "uuid": "b7e2a151-9828-4374-8a2c-db3a80433591", "value": "12288:hlkFZ4dPTv0cIv8hkZRIJE66bHcEc94j2zrV13:hlkFZ49vTKokZm12zpyvVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634588252, "uuid": "a9d60305-b5de-46e6-b803-f574eb91cbc9", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634588252, "uuid": "d029dcdb-1dbc-4dff-adc6-e88473aa5162", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588252, "uuid": "d51a7ce1-b1db-4e7a-a504-9a8e75c5fc0f", "value": "3f6c42e0e6c9e4fc859d74a094bc4b14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1427fce5-2ff7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634549878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549878, "uuid": "867a0d9d-9b37-41e6-b6a1-10c225fea517", "comment": "Malware payload (AgentTesla)", "value": "ff32efcb494ca35aa47a2d0d647d3546", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549878, "uuid": "cd77a917-3999-40c6-89cd-96fb757262f1", "comment": "Malware payload (AgentTesla)", "value": "f864c078bb8a27ef5ff44af23b3829894febdba1a0dd692fdd423717086ebd4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549878, "uuid": "e3dbe8b8-596c-43e2-ae90-ee550797d0e4", "comment": "Malware payload (AgentTesla)", "value": "390a510f45a735aa14940fa46370be62b721a004", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634549878, "uuid": "8bc26247-4c10-4c68-a790-18228289fb3f", "comment": "Malware payload (AgentTesla)", "value": "0b78eddd0f087b51af3af3e6339bcdbae245bc2306dc1c327f3794a8b3f2599156fa2113f1d43d1774111c2ace76d6bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549878, "uuid": "e74c728a-e4b3-4355-b849-0f54fe359e54", "value": "T1D0A40214BBCAC23BDF4819F044C6D382A778AA612E86D75B6F9531EE16B37C48F40197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549878, "uuid": "38dbc9d9-e730-4b13-b4d5-a87116a6b586", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549878, "uuid": "cbb36e17-5965-468f-adf9-21172055a52d", "value": "6144:bdcZ430nBPewKZ50Qg/gypH8sh1CHreDbUL4Vp/RX6F/937MwY0uUYY0Sh:bdKswKZCQgoKHvCreDbULORqZtMwYbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634549878, "uuid": "91b6c16f-7e73-42f2-a3ad-19ee133bc417", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634549878, "uuid": "6374e4de-c5f6-4221-8c52-897c22f3857b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634549878, "uuid": "961e6963-3af5-4fe9-b2ea-2fbc3aadd53e", "value": "ORDER#321550 YOEW AKA DWC-PM-1173-121 International DMCC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf04cff-3022-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634568440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568440, "uuid": "de4a6403-e417-4e74-9181-39fbf299a4a6", "comment": "Malware payload (Mirai)", "value": "0403ed77e22b1a3396f5c11237e15b81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568440, "uuid": "383a2497-7903-4335-9771-793c03e760dc", "comment": "Malware payload (Mirai)", "value": "f95a51f929c08b140851a5cadfbf0e8119e8c72e12f152f1986b2fb2bde8b399", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568440, "uuid": "22745d9f-2547-4058-b07d-757a418a6421", "comment": "Malware payload (Mirai)", "value": "d5988b6082154baf08c9af183c9660b766f210c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634568440, "uuid": "2ae4e4dc-c138-4dbc-93d4-9b934e8e9abd", "comment": "Malware payload (Mirai)", "value": "e565c885b2161fa67b8f98915eca115d2d83e3eff4dc0575af22a75f653793a1d2c21aab497cbc83e25dbc7c9a2fd03c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568440, "uuid": "c98b0daa-c927-4649-95c1-b389ee8c312c", "value": "T11303F2F7F1905CC9DE8BAF714D58E9D273A00F9F32A8D6E432E1139449932367A09DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568440, "uuid": "8e4e57dd-c070-489f-9b17-115164a59fca", "value": "768:ajDCpnA5/khs6JlTBFq7pAMeMT59WKE8Uq9WMN7aAvKae/30HFep0QrG74uVcqg5:aKpA5/khBPqTfj9jNOAST0HoU74u+qg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634568440, "uuid": "1ae5f067-e02b-44c0-9897-eb48366db4c7", "value": 41232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634568440, "uuid": "74d49fda-a538-456d-ba75-8aba830d3447", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634568440, "uuid": "47711d59-24a7-4f61-83eb-a11f24dec92e", "value": "0403ed77e22b1a3396f5c11237e15b81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be69631f-300f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1634560471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560471, "uuid": "372bd4a2-ab06-4254-9bf8-b7f35395d962", "comment": "Malware payload (Gozi)", "value": "cd93f5a1814a68f668c5ccf406545055", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560471, "uuid": "286a513d-29a4-4406-ae39-73b4978def18", "comment": "Malware payload (Gozi)", "value": "f975c273ee1a577d14a428bb443b94b5815091fa06637387e116ef3d36030b2e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560471, "uuid": "cb811bff-2975-4b96-a217-f6222c238a75", "comment": "Malware payload (Gozi)", "value": "74a80af67025d0f40d12bb89bd9f132e5b543f0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634560471, "uuid": "3e0c1a0a-6ec3-4977-bba8-a52f1eaa8afb", "comment": "Malware payload (Gozi)", "value": "5563d51d5f058e613239768e0fcbb000355b2e7222c2c078647546112ce348c84a84b7589605410e260c8cef38e9922d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560471, "uuid": "5f47c287-4c3b-4b0b-a320-2cfddfe85688", "value": "T1A327339495FC03EEE616B4FAA001F56C672028D725D49881A18F66CFDF36BCA7D3B910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560471, "uuid": "2262e490-e144-4b38-a570-b3dc2c109fea", "value": "b4087cff22e552c8dd7737d5f5a908ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560471, "uuid": "4363605e-f733-4f2f-aa32-360f72128447", "value": "393216:4DoFlakdDoh42jzmZqH/2xgUycZmORUwrLYO9l+qHp23MUUUtYp:LRdDS42jzmZfxzxRUwHG3OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634560471, "uuid": "5a117104-ade5-472b-8859-53309644cae0", "value": 20967979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634560471, "uuid": "7b1dedcf-e45d-4186-9569-0424d1f40937", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634560471, "uuid": "d85ef3ff-3532-4fcc-98e0-13032968506f", "value": "cd93f5a1814a68f668c5ccf406545055.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c304e5eb-3040-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634581524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581524, "uuid": "4400669e-635c-4933-8ee5-6792ef7de56c", "comment": "Malware payload (Mirai)", "value": "4a5cbb0c859cd1e000ca58eb3edd125a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581524, "uuid": "a875c809-83b3-44a3-beb0-840b9fa6f104", "comment": "Malware payload (Mirai)", "value": "f99804291a44f9d785e7305a3c1499e1518ce820799dd8d3b137443c288604a8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581524, "uuid": "981d0908-0e3c-4d05-b8e6-7a0ee1bbfcf2", "comment": "Malware payload (Mirai)", "value": "94e93a1253ae9bb2ad0bcbdf0b48b923236c2833", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634581524, "uuid": "5fef0f76-cafc-4451-851f-c2244b80b409", "comment": "Malware payload (Mirai)", "value": "06c2460dc44015ec1e79899e383e9cc3997932e96d6c4b9094be5d7d11b87a08cbf5e5017dd689382c7ce28ad0f13549", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581524, "uuid": "aa96a037-106e-40a5-8949-ecab65b33825", "value": "T100431A172991DABFC4E74BFA57D799308513B8391B136245B3E8BCB92B09DC82F5A204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581524, "uuid": "c2d86210-cb2b-4833-8dd2-1a6046da2452", "value": "768:/R/9ibT7kI8+MO80ueo9lj3CtkMIBa3mcm3MY28WkYKDYEZLFgLjD4wVZE:p/9mMI8J0uN94uMUa3PJmkElFYP4wVZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634581524, "uuid": "58d8e999-02d9-4ccc-9a8b-65b46b464f82", "value": 56795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634581524, "uuid": "aa4f15ad-77af-4341-847b-e6ec43067aa7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634581524, "uuid": "33a94810-215a-4c9d-8670-ca84246220b4", "value": "4a5cbb0c859cd1e000ca58eb3edd125a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478e2f0b-2fee-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1634546099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546099, "uuid": "41401b41-e408-48a8-9c39-13335eb00352", "comment": "Malware payload (Gozi)", "value": "f64066fff51a9027fdcc09cc945348f1", "object_relation": "md5", "Tag": [ { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546099, "uuid": "04f6c57b-d859-4e66-be44-f83629971325", "comment": "Malware payload (Gozi)", "value": "f9d4af4f518410fbbff3f83d253dae9cfa1169995ac502ebc5d33752bd44132d", "object_relation": "sha256", "Tag": [ { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546099, "uuid": "110ea462-bf17-40ea-8abc-df5935165126", "comment": "Malware payload (Gozi)", "value": "09dfe19460e834da02a1907c22e467d187ba0db9", "object_relation": "sha1", "Tag": [ { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634546099, "uuid": "e46568d8-4e32-46c5-833b-79ba933d22d1", "comment": "Malware payload (Gozi)", "value": "fa03c9c98940f0be884c8e08b22ac99cdc9707f26a94eab3722b8303b79d5ec374f919f0af48dea9e68f93855d251c03", "object_relation": "sha3-384", "Tag": [ { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "EnelEnergia", "colour": "#FA0CC7", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546099, "uuid": "8ad60b68-6cdd-47c3-b661-3f5c7629b44b", "value": "T12B532A55B666D99AE69517364CE2CAEE7336FC50AF9B43073204B32E1EB92C0C913707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546099, "uuid": "2b4272fc-1ee7-4920-8217-e79992445db1", "value": "1536:wVsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0jCoyp6p2UUayqI3G/msi:UhlYkEIuPm3fNRZmbaoFhZhR0cixIHmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634546099, "uuid": "ef299422-87e7-4b04-8376-a007b28f1bbc", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634546099, "uuid": "c4908197-265f-4280-920d-25ca752cb15b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634546099, "uuid": "d41303a9-f44e-4d0b-bc02-61b1f1a50730", "value": "004199280339_4.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8222bc3c-2fc3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634527729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634527729, "uuid": "50e6b0b0-18aa-42b0-91e0-722163a322b9", "comment": "Malware payload (AgentTesla)", "value": "2e7067f7351dbb597e587f2cf17e2078", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634527729, "uuid": "b7e48108-f232-4b13-8a1a-d0aa81c3e9ef", "comment": "Malware payload (AgentTesla)", "value": "fa6598232bda21145174fb4c433e24a4a16ba270edbd02505c896d2f3de5a0e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634527729, "uuid": "5726959f-09b2-4def-b32c-fc717004d138", "comment": "Malware payload (AgentTesla)", "value": "351fe3096f32056c1377cdf9c59cc21ed63f3663", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634527729, "uuid": "45845f10-d7e2-406e-9230-04c9fbcaa450", "comment": "Malware payload (AgentTesla)", "value": "0f6a86edb77613c186861402b474b92a0ad21603d40c503f99a2b22b603364fc2a35ee4b863bc4fc4a1025ebb8d8af86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634527729, "uuid": "39c5e21e-92fd-45e5-a523-cb7a6bc3e7cd", "value": "T19BA402409B848523CF5D06B5E0E3E78427B4EDB27E42C75B598E39EC1A73BC38E81596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634527729, "uuid": "c0753652-7ee5-4bad-ad1b-afde9b4bed57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634527729, "uuid": "f6e0ec18-94c6-4b72-b66b-28c0d6cf25d7", "value": "6144:2MZ2Yla6iWdtj/ytSD+51/6lTw45FeNiIHx8j2Wy3QZC/BdTrR0BC2hVNCaFio:2MZlAuR/S51il1G8j2TgZSTfR0BC+fFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634527729, "uuid": "6ea95b7b-f4ba-4806-835b-fa23b0d20f65", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634527729, "uuid": "a0cb75e3-1feb-4780-83bf-75568a6751e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634527729, "uuid": "e48d5026-4adc-4650-beaa-3c4421831c54", "value": "Purchase Order No. 63500321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39ad959-2fd2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1634534281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534281, "uuid": "e867d7bc-28a0-4a83-8514-b030ac9e3f09", "comment": "Malware payload (AgentTesla)", "value": "1443ecb318ff158823692945f04e0a14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534281, "uuid": "c7908db6-fdd4-4629-a4a6-44e9b98d1bb3", "comment": "Malware payload (AgentTesla)", "value": "fa9744a9f8530dfe050f21fd9b85a9cabfcfefd30b5290355e3ea6b6c8136b6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534281, "uuid": "e0ff0e79-5402-4197-9d21-2267f1740520", "comment": "Malware payload (AgentTesla)", "value": "fba634c395ca7bf82496d04e5b45822611db65e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634534281, "uuid": "2db41d50-3386-4d26-ad32-fa24c6fbfb33", "comment": "Malware payload (AgentTesla)", "value": "b7dd7af6468b4620273a80b79514656304423ab8ef7219a36a2dbc541870a9c393aa4750f31716f24beffa694266ff22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534281, "uuid": "d7f7d627-beae-4ef2-bf6c-acd300e1e1e0", "value": "T1C0A412493704852BCF1C0ABC90A2A3D1677CEA722A86C79B5D9535FD0EF3BCD8E04596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534281, "uuid": "e8f50191-d07f-406c-8410-7d3146414478", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534281, "uuid": "c46b173a-0ba6-4012-b79e-30c1c817cd34", "value": "6144:aHERGpLRGW22gxFfF1UOVGuklso07Lnaorfxl+y3POaTtDy6JDDT5voaZ5CgZuU9:aHI2LHoF/LN5nysTTgmnaaZ5CgMiyIQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634534281, "uuid": "c03c377e-66f4-494e-b227-0b1b0c92dbbc", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634534281, "uuid": "01ae8cf5-3885-4176-ace9-b53560454c5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634534281, "uuid": "d5e59ac3-b2b7-4d2f-920c-757d0e0a0b3d", "value": "BL-SHIPPING INVOICE DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78989949-304b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634586124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586124, "uuid": "9af78c88-1551-4b72-becd-905b0d5845c4", "comment": "Malware payload (Mirai)", "value": "95b9d66a9c11dcf1aca0932a7d554f9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586124, "uuid": "2190f63f-f05c-4c73-b8d1-07abdd269992", "comment": "Malware payload (Mirai)", "value": "fac7ef1f705222bee722f40ecb9772e4fa0eaa998b0bd85fe6eecf7b63c765f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586124, "uuid": "7af5f2d4-7b62-4d97-bc79-58680b93f401", "comment": "Malware payload (Mirai)", "value": "a6458412d70c05a3912aa8d2135d28916185e4e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634586124, "uuid": "cae99da8-87fd-4a76-bdf0-c747ef2aae9e", "comment": "Malware payload (Mirai)", "value": "1098f61026bdb7574a7b82cc7595fa2362f486d33491e5f6802275987d8c882c29b3b5d014a56d86ec39635c7dac810d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586124, "uuid": "1ca6e5d3-6bd1-4a02-a14e-4f7f3842ac97", "value": "T173832A9AF400DEBCF88BD6BA41664D0EB930A39016920F367767FE933C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586124, "uuid": "dc7ce2f7-7d5d-4eef-9b95-e97a835d7253", "value": "1536:qLf0+QM5PHyVwi7f21UiEy+DlOo7qL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fg+DM9SJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634586124, "uuid": "0cb3594f-3cae-4845-98b8-b81ca9550ad0", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634586124, "uuid": "6f0b8097-7e01-4997-b8d6-b1a61d0ed115", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634586124, "uuid": "a54a759a-c50c-463d-9711-7acf718dba1d", "value": "95b9d66a9c11dcf1aca0932a7d554f9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701d40de-3059-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634592123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592123, "uuid": "f3a8d8e3-b502-4a08-97d1-af955c694f1b", "comment": "Malware payload", "value": "469281f5a3a1190a2403e58500702a71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592123, "uuid": "ea4cd9c4-89aa-4a65-abcb-864de6b6cc23", "comment": "Malware payload", "value": "fbba9838068e6b6866346f7b03187da283aba8780b14fcdad70d3e023e71faa4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592123, "uuid": "38dd4574-ea63-4801-b950-6fca9007ca75", "comment": "Malware payload", "value": "88c0cc29969e9ed99fb8ff8cbd8160b5039e247e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634592123, "uuid": "701b2355-379d-48f9-a680-599a0bec28e2", "comment": "Malware payload", "value": "5fdb03dc476103a7849956033268f19fe51c05ae39e6258038d7d2d195cd113665b648ac968289124aac8483dd811435", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592123, "uuid": "5a220924-0354-4b83-9675-15cf057d9fbf", "value": "T18533F12D4394295ECACC6BBEAACC4BD0FA8BD4C6720A5B4D93C750D1913105EB54E47B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592123, "uuid": "d60f6cc1-eb69-4553-85c8-7e6f871fbfa1", "value": "768:zvt4sleCKO63B2dEx+UliviUjM0qUzew50WMcYOWRR1W1u0JJH:eSZCByYViv7M0qi50WMJw1u0JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634592123, "uuid": "0a3cf996-c200-48e1-afbc-907dffbd96fe", "value": 51080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634592123, "uuid": "0a9361d9-bc9d-4324-a092-74c1073a9d9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634592123, "uuid": "7413bb83-54cc-4a3b-b8fe-e7b2e84c58d6", "value": "469281f5a3a1190a2403e58500702a71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a3b161-2fbe-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634525402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525402, "uuid": "1b695c18-c5c0-438b-8d35-9e9fade6e8ab", "comment": "Malware payload (Mirai)", "value": "69b7ee649f70d15a62baf8179db07e76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525402, "uuid": "d06e6ac2-558f-4239-9935-fbfaf899d7cd", "comment": "Malware payload (Mirai)", "value": "fbe03f5463efcd54fcf7aec51fe24abc7f1f19e8397d2b41390149a88c0fadab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525402, "uuid": "1a106317-0dbd-4d08-8119-99512fcc0024", "comment": "Malware payload (Mirai)", "value": "2bd9108081ac590a24f64edfb5f5a363558407a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634525402, "uuid": "537650f9-a462-4f02-aefa-fe4872c6746f", "comment": "Malware payload (Mirai)", "value": "6848504dfb57daedf40aba7f37ba3acff4fa13a66efd714223214404eeda9aaff4f1d5c8a80fc80ceccc5f838fd425c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525402, "uuid": "de6b2eba-36e8-49a8-b1c0-f745718fabd0", "value": "T175236CC0A543D9F8DC110AF52173EB329B7AF07A2129EED7D795A433D842702E54729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525402, "uuid": "7831bb0a-abef-4c0a-9ab8-0b9c5b0454ea", "value": "768:gjo8WnBsux3TUi32+4qbBYSWLxXK92nbr21BYMbJoSlO+Meb4aJ:gWBsux3TUiG9qbBYSWU92e1BY8JoSlOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634525402, "uuid": "d73e5356-a696-4909-8cdb-9ae54aec960e", "value": 45656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634525402, "uuid": "93003201-fcbc-40d7-aec9-77c43f847c4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634525402, "uuid": "336239c9-a9d1-4d0e-a325-54ecc0afd39e", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fad421-3025-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1634569661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569661, "uuid": "07403c22-afdf-4bd9-9233-977c89bd2657", "comment": "Malware payload (Loki)", "value": "d5221f463d6fe2799e405236513610cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569661, "uuid": "68e7ab80-5c3e-489b-91b2-573873f6d983", "comment": "Malware payload (Loki)", "value": "fbf8573e839732a10b86926f7431ec61f95b328db6bb074dd0f8173cbea75f2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569661, "uuid": "f5ecbd4d-ca5b-4636-90a6-d168405e7f46", "comment": "Malware payload (Loki)", "value": "572f967afc80d7c41626a1d302a1643ed35b0d49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569661, "uuid": "a7af4821-63d4-4e48-b324-a1ac7d2caa33", "comment": "Malware payload (Loki)", "value": "1269fd35232e03aec5eb4ea968f35d411ff93aee997580f61c9d6ece05b19676580710e9637912ae81485967f49b0577", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569661, "uuid": "2e3c9dbe-d3bc-4bfb-84f8-706c93d48605", "value": "T1DD14C02073B0C4F7D49716B198788BA23A6BB821567491CF3B793A7E2E643D04A7534F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569661, "uuid": "cab114f3-3c46-402a-b455-02a6512b72e0", "value": "c8c17e47eb07afabbfe8e635fca5ad02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569661, "uuid": "10499ebb-6e57-492a-aa4c-3a44a43ed32a", "value": "3072:M0QP6wY8eSlG+huEfjkYyzy/4eAU7cG0jcPtr7+4oS9D98aShyuyo0+53E:bw6RmG+hu2kB2QHEclcFW4Vx98aCNXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569661, "uuid": "785ec84d-d1e3-4c19-a3a3-ff36442121f8", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569661, "uuid": "2a2b1db1-85e5-4fd5-a967-b73f809f56ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569661, "uuid": "a322ac8a-d012-4ae9-b47f-500f21a5c98c", "value": "d5221f463d6fe2799e405236513610cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01c8b4e-304e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634587613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587613, "uuid": "2bce1e9d-aea4-4d5c-9301-14783c0c7dab", "comment": "Malware payload", "value": "7d8b10b0fdc275fa08e824d83945f633", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587613, "uuid": "a651002a-5503-472b-8b81-0df273c57b3a", "comment": "Malware payload", "value": "fc8565740bc47221ef878d70028af6a71f5aaa842b1b29c20977192060635a53", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587613, "uuid": "fbe508b9-c8c9-422d-ba20-e05622711721", "comment": "Malware payload", "value": "462bef66c0bcd67446ee516f78ada3a6780009bd", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634587613, "uuid": "9a14c460-af7e-4c2d-80f7-41dbdf21622e", "comment": "Malware payload", "value": "84bf9c4334a743f50fdca830b45d7e2e29b71bbbaf44949dcfbea5c95d29dfe53e3a8d4a2aa3976392305b134830bb05", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587613, "uuid": "0ae3ebad-1ad4-4fbf-aeca-011b8ace72ac", "value": "T11F737CA6F6C1DC06CEAA077A48F782D6662BFC551F53934F3248F75E0F70A90891261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587613, "uuid": "0fe0ce28-f073-4542-aba1-95a3052d8e0d", "value": "1536:5k3hOdsylKlgxopeiBNhZFGzE+cL2kdA34zI0ScDNzmVQyrnHRBoESK4nceC7r9O:5k3hOdsylKlgxopeiBNhZFGzE+cL2kdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634587613, "uuid": "79184e40-fd4f-4fae-bf41-191930d4e235", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634587613, "uuid": "bb3fabd0-f37a-4818-a5ba-b74394097cce", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634587613, "uuid": "2dc6cd4c-1555-43b7-90ef-fd10c4093826", "value": "Remittance Advice File.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcf28b8-3024-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1634569332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569332, "uuid": "f8ebb4ca-8df9-43ac-96d9-fcedc56ba4c0", "comment": "Malware payload (Mirai)", "value": "1bde40456a0d76e011f57db7d431abe3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569332, "uuid": "366b41f2-6b53-4dee-950a-a0ff2b8be782", "comment": "Malware payload (Mirai)", "value": "fcc8e6a96ba736fe72003bf4602067b562dc453776e7cac8a2160a2edf5569c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569332, "uuid": "03ae90ad-c44e-457d-a1e3-7f6df15221f0", "comment": "Malware payload (Mirai)", "value": "aa0b63d5338fd052d7dbbabf36e0e92e2ead5605", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634569332, "uuid": "e30b782f-084a-4ea9-9519-b10e6aa50fc6", "comment": "Malware payload (Mirai)", "value": "ec11194db36da977459be55875938de1c040b4113779baf303410c3814d908566f3905ec25178636bdc736a400efcc2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569332, "uuid": "0466c4d7-4126-4e43-818f-2a03454d5a92", "value": "T1C7733A96B4128DBCFC5BA5BD40154F09FD2123445BA30F27A3ABFDA32C621A7AE47C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569332, "uuid": "bc300c1f-e2aa-47f8-8452-d1dd9d4bdc4b", "value": "1536:2Ru+Dt4CxeuKfSOvWGj+rQ7aple82XtRqbO0FR:2RquUvxIn2+bVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634569332, "uuid": "9e7292ed-4b71-4dc2-9978-988bd5b40add", "value": 77452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634569332, "uuid": "66f29a13-9a65-453d-8338-6204d2c982bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634569332, "uuid": "17ba7f2b-c3f2-4b3a-8658-fe9b2e783f33", "value": "1bde40456a0d76e011f57db7d431abe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be097dc5-3058-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1634591824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591824, "uuid": "d7fe6085-fdd5-4600-86c3-7b466975abc8", "comment": "Malware payload", "value": "8a6465a960395e718b9489c5738a1714", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591824, "uuid": "1e20b98c-eea6-4a34-a32e-e7ce8c06e68e", "comment": "Malware payload", "value": "fe8fd282bdc1f838ff2dad9b56b6bd615fb7f76fa69775c5afd5ee204dd007f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591824, "uuid": "29db935c-dcdb-46bf-b866-a35e7065c1f9", "comment": "Malware payload", "value": "fc72045fbc8157ed4035d53f12cf36738ecad644", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634591824, "uuid": "b8af430b-d439-448d-8b26-a20b13a960e6", "comment": "Malware payload", "value": "a5bc55b476c29f5e501ca7089972acf8d3d3a2c84f4bbec319a12062a2635e119c3fdedc38a71dea417d8aa8ca210437", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591824, "uuid": "c80fa088-c067-4dc8-b80b-30eff5071d09", "value": "T17C05AE287B0C6958CB1C4FB38137826953F8E15776AFF32F35D2ADD458962039B0A1DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591824, "uuid": "5e862337-662a-4383-ac99-5ff2a96f1946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591824, "uuid": "b5f6fdfc-b98d-4088-a93a-cb8f29eb3fc0", "value": "12288:G+Ix4t1bc4hbmOwD71tJha6QSGXhjFoht99t0zBWgsmSKHdsI5iI:VIxcW8bmOKhtPU2W3sOsuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634591824, "uuid": "bce7329f-f15a-4bcf-a5c9-fd76c6401f75", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634591824, "uuid": "bb1538b0-f870-46ac-9522-fcbf0b7a94a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634591824, "uuid": "579f024a-73fc-454d-8d09-8f92a3844048", "value": "201586.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c54cc8-3043-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1634582499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582499, "uuid": "8f8440ce-8d4b-4d80-911b-3f474c1bf508", "comment": "Malware payload (Gafgyt)", "value": "fa8d980598524707533510ae4ad4bdd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582499, "uuid": "b26bff23-f959-4ccf-b03e-762c88aaa472", "comment": "Malware payload (Gafgyt)", "value": "feb7066c0a7de2403d284a470f169ab6f6a3adc40266db1f3ac6f7322919ae93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582499, "uuid": "0500056f-7140-42c0-8b30-67fb244048cb", "comment": "Malware payload (Gafgyt)", "value": "04fccdc193782b2fc566b3f73c437ce8dc0a8d42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634582499, "uuid": "d85f67ec-08ed-4d19-991c-a460e1ecc618", "comment": "Malware payload (Gafgyt)", "value": "a58bea1ffcd6a04d03fe3d4cdfefab4feb63ec774d4ec796d6a5834eebc0cd3eb18a910e37fc5a8bbd6083da7b96a9e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582499, "uuid": "372b7de1-aa30-42cc-8827-aebb6bfb669b", "value": "T17CA32B05FC444767C2D327B6F79F434D7B366AA457D73301AA346EB02BC1B892A3A960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582499, "uuid": "5fde4897-da45-4aea-ae45-14b589f44212", "value": "3072:e+/SoEF7AZmWGh5hTAeJ5ZmFmDQFdC8X30j:eUEF7EtGh5hTAepmFmDQFdC8X30j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634582499, "uuid": "5c234cde-9266-4d74-8581-3df61c629154", "value": 102048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634582499, "uuid": "4313303f-d5ea-4774-9bc0-05264f11f7d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634582499, "uuid": "8a231648-4f7c-470a-89c1-7b435219736d", "value": "fa8d980598524707533510ae4ad4bdd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a3122d-3050-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1634588077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588077, "uuid": "386fa501-b3e6-4ddc-9092-c5ba5c70338b", "comment": "Malware payload (NanoCore)", "value": "a7f4ba93f28bc1228a12a0fac1ecfb2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588077, "uuid": "589bd54d-0e83-4115-9b4f-1789beb69576", "comment": "Malware payload (NanoCore)", "value": "ff3604b2e276ca507bf7e5397df7390fd92e83dfc7c3f98737d7a6e9dbecd516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588077, "uuid": "090cd85c-1395-4d24-b8ca-b64d38c95d0f", "comment": "Malware payload (NanoCore)", "value": "ae4c770291d431bc7475cf168e34e579ece3e1a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1634588077, "uuid": "0aa2f278-4253-4784-8c39-626cebbb7136", "comment": "Malware payload (NanoCore)", "value": "7774d8746439d96693e9ebb51ccc1b53c56d34ee708c1b3961d1ee7c7d6a9d1323a21e4b716324896b56e8549b937078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588077, "uuid": "fee88278-73e3-4dbd-9b38-767c1a5e848d", "value": "T11914CF2637E84A2FE2CE8579611252139779C2E3D8C3F7DE68D464B38B667E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588077, "uuid": "73494a61-1302-423d-bd78-ff213a4bd0d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588077, "uuid": "4f517c79-e541-4eda-b234-9c2e9d7b3a14", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIYE5fUisD1NHmB5n7lnQidogwS:gLV6Bta6dtJmakIM50jsDM5nZQi+nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1634588077, "uuid": "bc71f941-255c-4859-80c2-8dfe2900a87b", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1634588077, "uuid": "63c7d1a2-b891-4294-8653-84cdcee9d377", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1634588077, "uuid": "1c34053f-8359-44fd-8ff2-4e9fbfbebfab", "value": "a7f4ba93f28bc1228a12a0fac1ecfb2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }