{ "Event": { "published": true, "date": "2021-10-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-29", "timestamp": 1635552181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ca0e87d9-b850-404d-8b17-e51d2e2b717e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a645582-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635494754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494754, "uuid": "1bfd9adf-65f6-40f4-a652-2289afc9a1bb", "comment": "Malware payload (AgentTesla)", "value": "cd9868b450e308cbe02d15b2cf957f1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494754, "uuid": "3389bcda-3910-45d5-871f-631336478fd3", "comment": "Malware payload (AgentTesla)", "value": "004f7d9b1ea283ec6042bc2656bd59213513e270397d9364734e0ddc55ede32e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494754, "uuid": "03f0124a-4f4c-46d1-9404-82ec4a90f452", "comment": "Malware payload (AgentTesla)", "value": "2738933d3a5c4a6e1f8cdbefcb6847baf694da3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494754, "uuid": "e9b49737-4fe3-43b3-a6f0-55872e547e57", "comment": "Malware payload (AgentTesla)", "value": "07707f86453f8e6e52ac6da83f64ea1f9f4fab02d7fcfefd7478f89914802b71273dbe6314f95427c84ca1ee85a434ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494754, "uuid": "a3c0c8c0-81db-49c7-91bd-f9c5af576b23", "value": "T12FB4E00163D2AA16D77A0F7518B311201FB1B85B7E21C34B1E8930DA597FF960A91FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494754, "uuid": "b8d7536d-9231-40c3-b4fe-68989eea20b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494754, "uuid": "e84e0bc9-d017-41bc-84e9-f8a351180f20", "value": "12288:DGb1rDMmjQurUmvJDl/3Dl3mBUoJy0OnQeIo:Kb1vTvJDl3qUL0xro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494754, "uuid": "a4556ce2-3592-4b86-9643-a7e70c0eb5da", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494754, "uuid": "051158c6-e1f2-4baa-bff8-a28b67ae4247", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494754, "uuid": "0cd2057c-1a6e-4008-bec8-20ca1282d4f1", "value": "DHL SHIPPING DOC_44 7611 9546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e113bf5c-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635530333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530333, "uuid": "fc0c0151-86aa-4fb2-a11f-dead3a3dbaae", "comment": "Malware payload (Mirai)", "value": "4ea8a1042a03c77aa070c845260d9284", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530333, "uuid": "0f8e4517-9efb-4874-93e3-da66a866f0df", "comment": "Malware payload (Mirai)", "value": "01092323c46d236de407bda3315cb5c091de0f42a175153c578df06366adc982", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530333, "uuid": "6decc8a5-8563-4fc8-b37b-feff5e5d2b30", "comment": "Malware payload (Mirai)", "value": "2bcf77416bc7e34d8768baace71bc9be670d4359", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530333, "uuid": "36780c7f-9bb4-4458-99dd-89caf0e3dea7", "comment": "Malware payload (Mirai)", "value": "549a7e0bc4577de007d341494eb2d5e9d6b2018067ebe96ff53ce65fda9aa8e551189869cfd2e3ffd0b17a4f7ffe408d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530333, "uuid": "b6c7ac3d-c1e7-42d6-87db-8d4d19f95a2d", "value": "T1D933280BA58181FCC569C17443FBB53AC876797E0239B1DA7BC8FF176D85E601E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530333, "uuid": "0ec0228d-ad17-4716-87f1-506613b9f31c", "value": "768:j7s093tGOHn2PAe6nCAQTGWexrecbwBg4ubt7U4E1rjWb57Vn7sOngg:M0937QAe6CAQiWexKg1It1rs7Vn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530333, "uuid": "5759f36e-ed1f-4d78-9a24-86d6833dd815", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530333, "uuid": "cb7b24b2-976d-4066-85bb-9493ed198dfe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530333, "uuid": "14cee23e-61dd-45ea-ac16-6ca02e1299dc", "value": "4ea8a1042a03c77aa070c845260d9284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d85bec-38a7-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635505341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505341, "uuid": "0cf8ada1-bbed-4c43-9160-e02592063e71", "comment": "Malware payload (RemcosRAT)", "value": "3e378b36e82477314eae28c781367680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505341, "uuid": "88de5733-512e-40ba-9a1d-b0058c8205a9", "comment": "Malware payload (RemcosRAT)", "value": "0132df77e1dfe29165f39d4fffdf58350fa6e6136ba1fdfd095868d1dc1e6fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505341, "uuid": "c316cbfb-d3a1-4e20-8f40-9d9fd866e31e", "comment": "Malware payload (RemcosRAT)", "value": "8e7fe6092f5eae3efe4083af591df3dd50546263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505341, "uuid": "d9a74766-a338-4b21-a255-facd2c67de8d", "comment": "Malware payload (RemcosRAT)", "value": "65cfa3533149952d4b80423743f8ae00388b4e5764efb9b8e383f007bcd85cd7e1beda50f0e025a4181c8b9c052237c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505341, "uuid": "895cd589-dd5a-43b6-8d1c-1e18d10046b3", "value": "T11A25BF17A3E0293AC23697B85D0681C87829FF116D79ACC27BE50D4D9F39352F8E5863", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505341, "uuid": "e5d5eb31-254e-494e-9eca-2daa49f70367", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505341, "uuid": "ccb34f97-036f-4b32-bcab-ecf40352ca7e", "value": "24576:q4uBfTG2pM9o6NN+swhY4/99999999999999999999999999999999999999999q:q4S6PDuYRjFre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635505341, "uuid": "2ad26cd5-043e-45e3-bf25-0de5c9d9e50c", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635505341, "uuid": "333ae147-ab3d-4c00-b48d-060d99e1173c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505341, "uuid": "0d21eb08-24d9-4640-b569-e2e25dc19e97", "value": "Urgent RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ad56ec-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635494766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494766, "uuid": "ac084dce-6f6a-47ce-9f92-10890a1371d7", "comment": "Malware payload (RemcosRAT)", "value": "5c8448451cd48f92c60671d6a758c4ba", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494766, "uuid": "ec2ac161-9acf-4754-bfde-42c25a29f785", "comment": "Malware payload (RemcosRAT)", "value": "025a2d38afc9db265d6064588e38f6529d289f1549b5b129f2dbc52e72151920", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494766, "uuid": "392d790e-cadd-4b90-91c2-83af354e845d", "comment": "Malware payload (RemcosRAT)", "value": "716f52ed4b451e813e330f7d8befd260381da4ac", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494766, "uuid": "fa51f6bd-9ebd-4d0a-b661-8d207ae177be", "comment": "Malware payload (RemcosRAT)", "value": "80bf16e059b802268f00c9634e54a5015c64888161cb4211fbb6c9641d83194ba6a79922f08b0c86b2e5388bcd084d20", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494766, "uuid": "c89d8d00-04cb-45f2-a3b2-9cb1afbd8971", "value": "T16D25BF0277A09436E132AAB9CD3F5798111ABF60295EDC8327F82E8DCFAD54434758B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494766, "uuid": "1da57c3d-1cf6-4988-8cac-246069487e57", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494766, "uuid": "7af3774d-676c-470c-be0c-b4c2d583d456", "value": "12288:qXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4JA6NuLpjqayC94M0LdEegD:q4uBfTG2pM9o6NN+swhY4bMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494766, "uuid": "57a229df-a272-49bb-b9dd-f64a04bf7498", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494766, "uuid": "151c927b-6232-4e77-b074-ee9b61ec8139", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494766, "uuid": "12e68dff-8502-4235-9573-f6a600da2a36", "value": "DHL Receipt Document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba2995d-3875-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635483777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483777, "uuid": "f432de0c-8220-47fc-9b5e-363d09813866", "comment": "Malware payload (Loki)", "value": "3e9e2b7c0a03383e0d026fdeb257109c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483777, "uuid": "f912ac64-4be1-4f1c-a1ae-1575f20e65c9", "comment": "Malware payload (Loki)", "value": "025f5e28112d8e1bc917f5ef82c22d40f8c0c9afc9d630945e113c9d337a1236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483777, "uuid": "179d4064-f8a0-4d91-87f4-e43effdaeadf", "comment": "Malware payload (Loki)", "value": "74dafa9bbb2a85417618e6d1ed68b79ec8ff4cc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483777, "uuid": "e825e9cb-0937-4550-85e9-1e79b312d95b", "comment": "Malware payload (Loki)", "value": "916ea2a5e4629ca2ad3440e1c5aebf5cd98d62626dc2dcbf2e6fbbe5176634e4d8d32b05da8ac0af40020c8f090762ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483777, "uuid": "40cd34b6-65a5-4670-bdfb-1e437ef503ed", "value": "T14BA4E1716617900EED8CF5F66C1B00CA6F676D93912811FBCB46F3A82CF14891EE7698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483777, "uuid": "7c710fc6-e3af-484b-b903-406ec1d97b40", "value": "e1751cf8a48c661789883372a12c27d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483777, "uuid": "b6f6a4c0-981e-4d89-8767-ebae25e6be58", "value": "3072:3fDvPlw3V8MCiegNON5X76I7snd3fA3Hkrrfl8S1szTOHlpp:3fD3ljMCieggTL57sR+ErTl2zSHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483777, "uuid": "c23eb34c-d046-4134-bfb7-566464b63eff", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483777, "uuid": "7fc95c8e-9e46-4ae7-9595-eddd0c76de41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483777, "uuid": "1423a76a-85e8-4994-a715-7f80a422ae4a", "value": "025F5E28112D8E1BC917F5EF82C22D40F8C0C9AFC9D63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec4dcf8-38e2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635530517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530517, "uuid": "a0893a85-76c7-4fe6-87a0-43891b0d0a57", "comment": "Malware payload (RaccoonStealer)", "value": "5ae3b69c31fe729ac672ba483280f16d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530517, "uuid": "baa134e7-e7d9-4338-9244-6326b58e9447", "comment": "Malware payload (RaccoonStealer)", "value": "033247a6ba1cd0543f27857fb6743e16fdd2990cea1df3dce93e4031c8046d1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530517, "uuid": "49b97c66-3829-4e7a-a6b0-cecfd8096b99", "comment": "Malware payload (RaccoonStealer)", "value": "310d993f9fbe7fb9cf3892220d980e08eb5e6286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530517, "uuid": "99ef4ebe-adf0-4689-ac2f-da4ddc60020f", "comment": "Malware payload (RaccoonStealer)", "value": "c91ed1a7d5d655ada09e367acd308c9d191a40af6ac7d44554fefeceb11980be5f7c6a0f062175c8b061588cfc9ff1f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530517, "uuid": "54736da8-5ad3-431a-aafb-8013c220be2b", "value": "T155748D00BAA1C434F5B212F849BA93A9B93F7EB16B3850CB13D516ED5674AE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530517, "uuid": "855db4dd-71d4-44b3-8ec0-131527e45a7b", "value": "5243e0b7a8cb0f582099146f832c26e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530517, "uuid": "048096d4-8b02-4ffc-b93f-45078fb95724", "value": "6144:Y5uWaxsOBlJyeq8PStBStFgykET6+lWx:QvRO8R8PStBS4ykETW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530517, "uuid": "adc16e58-6fd8-4e58-bcb7-779d38c40e45", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530517, "uuid": "1834d06c-d5a5-434b-9ea7-e419cab0f276", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530517, "uuid": "4d7af2b2-037d-4cde-a54c-aa3065236a58", "value": "5ae3b69c31fe729ac672ba483280f16d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d290a1d-38d6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635525414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525414, "uuid": "011c4564-3f65-4afd-8de0-241948237c6b", "comment": "Malware payload (RaccoonStealer)", "value": "461dc0239361fa56c41ba582a4c98b17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525414, "uuid": "e2952f88-58c6-40b7-91d3-fccad15d6d60", "comment": "Malware payload (RaccoonStealer)", "value": "039694c6d172a624b9ed0e6bd4d3a34441835cc8658f7b4c7db07b659283b0ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525414, "uuid": "89b5dbec-7636-4f06-bb48-3f799d277028", "comment": "Malware payload (RaccoonStealer)", "value": "ab3853e51fa31564b3e87a5fa234cfebcd1bb824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525414, "uuid": "44a70e9c-1b1f-4f30-a823-bd6bd41b20aa", "comment": "Malware payload (RaccoonStealer)", "value": "92e7451766fd0549650190cff2de16dfa76eb0ea6c0416983851ebb286c3b9e42bcbd78c479769ef48640c5e4f77891f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525414, "uuid": "33159a92-b5c5-4f57-9371-c0a91acfef43", "value": "T127D4DF00ABA1C034F5B612F8597A9368B53F7EA1A77494CF12E526EE4634AE1FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525414, "uuid": "fe6bf8dc-18ec-4b3b-9ea7-560f40458bd6", "value": "4649591756a77695954d3f167e28cc87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525414, "uuid": "1c14ab44-3ebc-451d-b99d-f6d9537a1ad5", "value": "12288:6dpNjDztkomI7AcZs1tsWIdj77jmf4ZI/OwCRrKuyoA:GpJJkoAf1ijqfKK+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635525414, "uuid": "1baaa6b3-536d-405b-8bad-e797dac4d4cc", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635525414, "uuid": "82cd1909-73ba-4111-8cca-92d1b4274504", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525414, "uuid": "72a0ce33-be30-461b-ade4-47fb411ad213", "value": "461dc0239361fa56c41ba582a4c98b17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32aa90c3-3889-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635492245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492245, "uuid": "bf0f574d-ddd1-4131-a457-2b7f4cdad310", "comment": "Malware payload (AgentTesla)", "value": "92d4047d1f8595e3a708796838161dc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492245, "uuid": "6fac2891-8131-4723-a41a-0fbcd5418ae8", "comment": "Malware payload (AgentTesla)", "value": "04d4bc91bf6e2cd5b4d42b85a3e58ad24fbad285af7c80772778a49225b12265", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492245, "uuid": "4b47ae3a-b912-40d9-9976-86f40facf750", "comment": "Malware payload (AgentTesla)", "value": "a76b9f8295456576d55db9c2ec00d2ba982e5c80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492245, "uuid": "f3886910-8260-49e1-9079-4c1ee070f08d", "comment": "Malware payload (AgentTesla)", "value": "4d8f189f3b713c16676d6f267e272e9294e36038535321ed7017e84cfdc775dbd1f3bde6b23b38bac31e84dd96914c50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492245, "uuid": "1710ded8-8d52-4ccb-a033-5ba867db255b", "value": "T17E6423E349D8FB402315647937AEB180A399193F7DF62BC637885B62783FD49B782601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492245, "uuid": "ffc602a0-a470-4249-851b-901577feb553", "value": "6144:PObc+u4O0LXov8FeG3tMTaIcWY87NX+TQn6Iv7h:POb84/cNG3tMzcWYAiA6Ivt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635492245, "uuid": "5c0199a1-adcd-4323-9827-2c9340436122", "value": 320813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635492245, "uuid": "fc0dffde-4372-4cd6-a713-de72f92f2ccf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492245, "uuid": "5d555e8a-fcbc-4078-be8d-86479c8f0b9f", "value": "FB-108N & FB-108NK \u8a62\u50f9 - \u7530\u52e4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a21188-38e4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635531415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531415, "uuid": "07ba8e3e-5925-43d4-bd35-670319521127", "comment": "Malware payload (AgentTesla)", "value": "c586d04580506ad89e02458f92fc38c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531415, "uuid": "9e07fb0d-0bf3-457d-b22f-14a40b812710", "comment": "Malware payload (AgentTesla)", "value": "04ed68f494fd17779cec25decede45ceaf7535980bba66d91c77d0ac6a5df5bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531415, "uuid": "4258dc11-082e-4887-bccf-0c220c1f2baf", "comment": "Malware payload (AgentTesla)", "value": "7732b5d9ddcb58b197897c1b507951795abff990", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531415, "uuid": "c9775302-f33e-4f12-82c3-82bb3b4a389a", "comment": "Malware payload (AgentTesla)", "value": "4efae006e85335fa9aad33f65fb19902e58fa7da1e7e23f520dedc9b795d711a4ee50f6a6e476048b2b7be1c238926ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531415, "uuid": "899fbed4-ffe1-4ba0-91b4-89bf665f7d01", "value": "T13194F144637C9BAFE0AC47BC90A2263457F5AC223361F7554FD274CA2963B825E05FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531415, "uuid": "c7fa442d-d687-481b-8d03-769684d86d45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531415, "uuid": "f6b5bae5-ee1b-4f4d-b0a7-43e43f83f81f", "value": "12288:ElfZxHUB/fkaUdQA43KEAu28ybBbtGphq72+gUE:ElfZxHqkPmX28yb4q72+gUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635531415, "uuid": "a125749c-fbb7-4ca8-b4a8-57bbf23c3e7d", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635531415, "uuid": "8a39d0cd-8bc5-49b2-a5f5-11abbeb98034", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531415, "uuid": "43dbe2cd-1d5e-4e15-b929-51fdf02ef00d", "value": "1zqVsr2TzG7M6EA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a887f0a4-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635485571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485571, "uuid": "c3451ad6-8920-4399-bc6d-e4e228ef1238", "comment": "Malware payload (DanaBot)", "value": "d70f3c68b23be66166a1b1b486bb28a1", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485571, "uuid": "d12cfee3-4c33-4367-ac4d-a3fb1bc9f3d1", "comment": "Malware payload (DanaBot)", "value": "064eefd591b90b242c39a55d00ab37a3055a8979544e5b14504fec12bdec687e", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485571, "uuid": "7268a418-3d23-483e-83a1-bb23768752a7", "comment": "Malware payload (DanaBot)", "value": "7eb9e399405c599238e67fb43cd58b2780456925", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485571, "uuid": "ebd7992b-e1ea-4926-8e00-ee3fa020cd87", "comment": "Malware payload (DanaBot)", "value": "860478d166f493f34a5d2120a41c12720ce5f3a0aa8450b4bb2398f6432ee6dde2a9e20a29db74a5c4aa738e515de9dc", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485571, "uuid": "2f0c8619-1a30-4ba5-a992-097b77352639", "value": "T1C3C54C2033B69812F273133598F3D0E09ED8BD6299B4AD4B70C23B5F049F6D29A5975E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485571, "uuid": "0cbccb39-ebab-477a-9caf-532c2f2ad48a", "value": "cedd92f846db36afec299e785c7f27fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485571, "uuid": "1c85976a-1051-4532-827c-8a255a37c415", "value": "49152:4gZziYTJ//YPt2Z/fZMdzUAOC5n+LlrxFTGWMKq:40ziYTWV2Z/f6AAOGarxFTGDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485571, "uuid": "74656fee-5942-4842-8c96-92fb87b566ad", "value": 2588672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485571, "uuid": "d9f3c45d-6462-43a9-b345-a8373ce4da32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485571, "uuid": "e1db89af-d731-4068-819a-493c8a87155b", "value": "d70f3c68b23be66166a1b1b486bb28a1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32c1d69-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635526391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526391, "uuid": "25b09c5e-55cf-4c09-8f80-f6d469308601", "comment": "Malware payload (Formbook)", "value": "590ce086c9cd16d535d808543c5c76a0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526391, "uuid": "8c1435f5-6683-40c5-85a1-c9b8ae6d8ca7", "comment": "Malware payload (Formbook)", "value": "070476bb2c0868aba1da672ffdc08ac1dc35f15b654d769963b0950642233c06", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526391, "uuid": "ca7a40da-30fd-4f93-8188-6662882a048c", "comment": "Malware payload (Formbook)", "value": "892343a1223bc602f3e0e4b71eeac2ebdfb8a7bd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526391, "uuid": "6c5d0c7a-dc31-4db8-8190-328772bc8607", "comment": "Malware payload (Formbook)", "value": "7ab0c53979ce317f6b076e304d80fb3e38dc2ef5bb3664c0a7917d6ccc4f9ee1a619b5a9d3ffac28809a63c1a0109190", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526391, "uuid": "90cc2ece-20de-465c-b0f2-816c5703602e", "value": "T142B4F96C96884BECCBCCB3F47B092F5C018DBB65A786B5B7453873B15F9207B950A890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526391, "uuid": "d61c27bd-abe7-4d40-bab9-3ef9a906207f", "value": "12288:Dez1frB/Dt1eD64a2BGrMGJUOx5Bi5K53oSeX98HoI+4hscpG0:CvOmSBmMeLA64FiIIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526391, "uuid": "defd4144-ec0f-4c8d-8b27-c523be878a8a", "value": 530022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526391, "uuid": "80706c20-4767-4b1a-a0cd-dda27d4a7bf1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526391, "uuid": "4fd80948-29f5-4093-b440-215cf25e23e3", "value": "Payment-Copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32545eb8-3900-11ec-843c-42010a9c0014", "comment": "Malware payload (1xxbot)", "timestamp": 1635543354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635543354, "uuid": "0118490d-52a9-4090-9cd2-b67bf0664fa3", "comment": "Malware payload (1xxbot)", "value": "8b07390e29498acd8a6994f401ad1922", "object_relation": "md5", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635543354, "uuid": "223cb0e6-adb3-4f73-bf93-eb326bf01c78", "comment": "Malware payload (1xxbot)", "value": "079200fa660257be3e28b8b7092b65528b7a568f5e9d10d1be9013e72ba3b1f6", "object_relation": "sha256", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635543354, "uuid": "b2e4c9a2-36d6-494a-9bf2-f9b1ac8c5355", "comment": "Malware payload (1xxbot)", "value": "895cb052f1d76a16f8e13512ea7c9712d0eda5cc", "object_relation": "sha1", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635543354, "uuid": "bbf00eb7-e56b-4be0-bc1c-37bba2dcccb4", "comment": "Malware payload (1xxbot)", "value": "ec4564dc8161bb9eba4f52455f9778cc05322711b91d1cd33e78f4899e17223b421953705afddee6277142e062499a5b", "object_relation": "sha3-384", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635543354, "uuid": "8def40ed-ff64-4144-ad51-2b79dcf5e816", "value": "T1ED747D00A7A1C435F4B222F849BA93A9B93F7AB16B3454CF12D516EE4774AE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635543354, "uuid": "c7a28e0c-18ca-4e93-94d4-349c87e9d79e", "value": "518d84bc9a231f5bb2827b0550b9f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635543354, "uuid": "01a88eca-e3ba-4691-9992-c31ddec5975a", "value": "6144:VOWoIZBJ0Bfj0MRqxn25LStlJjkcp9kod5t1:VPoIZX0Bfj0Zxn25LSRjkcpZ5t1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635543354, "uuid": "05d42fb2-5e46-456a-b9dd-7061f734f03a", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635543354, "uuid": "1717bd2b-ff37-4666-ab29-dbd6c2c71ed2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635543354, "uuid": "9fd75184-2f8e-455c-9196-9b994223778a", "value": "8b07390e29498acd8a6994f401ad1922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0976baf4-3880-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635488310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488310, "uuid": "b0feca54-39d6-4c30-bdf4-a2f8b50cf736", "comment": "Malware payload (RemcosRAT)", "value": "eb7a5438f88f49074ea39ae1403ada1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488310, "uuid": "65342e38-14fa-4354-a8e6-69f6a0537d81", "comment": "Malware payload (RemcosRAT)", "value": "082baf651937a61c656a7166f6e672341808068663c21bd4111feccf71b78983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488310, "uuid": "ea70a83a-7bf5-451f-8b91-1f6b5d131ddc", "comment": "Malware payload (RemcosRAT)", "value": "eb0d35a80550db99c1adc40c1ceae3f015a683ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488310, "uuid": "fd305815-ba1a-4586-85fa-d66240eec94d", "comment": "Malware payload (RemcosRAT)", "value": "5abc0e363932a7059e677170c01e064a3727a8d8b791e965715e7beb0e635d76f21ebf31ed601ebe91470bf00f682e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488310, "uuid": "3058206b-17fb-4762-b612-8b2ddf31877b", "value": "T19C25AE2167D2A036C0B79E785D5B8A442807FF317E25BC8236F89C8CBEB91096D7D593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488310, "uuid": "377cc5fd-0953-46d2-8cd1-d55684864b7c", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488310, "uuid": "5f37f2f4-c709-416d-a817-c73092a700a1", "value": "12288:qXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4Ja6NuLpjqayC94M0LdEegD:q4uBfTG2pM9o6NN+swhY4tMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635488310, "uuid": "9e399cfb-7ac8-45e5-a79d-5ff03b701743", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635488310, "uuid": "7ea466ea-47ca-4ba7-9dab-ac0884c0d008", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488310, "uuid": "3dae6a60-e026-430c-bb13-45a34c5fdfa1", "value": "PO#BTX18000211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b061610-38a5-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635504419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504419, "uuid": "6780c7c5-6632-472c-9be9-a0c8dc83cdef", "comment": "Malware payload (RaccoonStealer)", "value": "d19f4e0dd70e6388d18162c6b546c200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504419, "uuid": "e89cd4a6-1518-47d0-9fea-6ca500d371b5", "comment": "Malware payload (RaccoonStealer)", "value": "0a6589e8bec291fcbb9ee4e8341c2bf6506f26a9a8174975e7ea8722f20c7845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504419, "uuid": "cfa8fd26-bca2-438e-940b-fc63678e0702", "comment": "Malware payload (RaccoonStealer)", "value": "a43a48290ddcc881e6d0c830364bf3eb5af24a40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504419, "uuid": "d9891b7c-fab6-41f1-8c5a-35381bfb2998", "comment": "Malware payload (RaccoonStealer)", "value": "1bf0e3a2345b71f091be5a5bc5c7732f1f9136c98f8e4bf8f299ad99097773a5a3c39157e071798d3a29fd21c1c811fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504419, "uuid": "b031b55e-b53f-45dd-ba83-54ff6428ddf7", "value": "T1FDD4E000B6A1C034F1F612F849B6A3A4B53F7EA1677481CF12D916EA4A79AF1ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504419, "uuid": "87b89f6e-c143-4e59-9980-ffe195d33da1", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504419, "uuid": "04b8fd76-54a7-4d7f-9129-86109b7b816b", "value": "12288:0OuIc9Z60vneGx8un/Fr+uNCba2Id6s+wMfD8ybuj2q:3uNy0fxFkYCba2OLS8zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635504419, "uuid": "214ee88a-c125-4657-8e66-3938c7b40f91", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635504419, "uuid": "b473b44f-4288-4fc8-88ff-6db043eb0f93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504419, "uuid": "9eee6fea-06fa-4f18-b24e-4f03a24a8c36", "value": "d19f4e0dd70e6388d18162c6b546c200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafa5156-3877-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635484850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484850, "uuid": "bafa065d-1db4-4cb0-a103-4e21d6145c95", "comment": "Malware payload (Loki)", "value": "46c0206c8937107e15c3cab2aa462e93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484850, "uuid": "c733c1fa-3ea7-450a-bc1d-7da610eae081", "comment": "Malware payload (Loki)", "value": "0aa08d86a002c9ae17de017777dbbe5704c31ab2351737244c11d2aac1a5ff0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484850, "uuid": "f3759e4f-caff-48c7-97c6-6b451f4ecba5", "comment": "Malware payload (Loki)", "value": "39b4646cfd8501cb64435ccc891cd9629194d146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484850, "uuid": "fa04574d-7256-4b47-894d-497e003c9093", "comment": "Malware payload (Loki)", "value": "1eec9e8d1e5544174d1d9f7884c77566f3bfe6e6085f1d7c75dfc667bb92cc283061335e4c493c19d8c1e58cf09292a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484850, "uuid": "48d858f5-b3e9-4056-a77d-891f462cf2a7", "value": "T12254121633D1E873E88F4A719DB39F6CE2B78612022052D7CB640F7A79A09D6DB194D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484850, "uuid": "e60b2ee3-f4c5-403a-a093-beeb525ec269", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484850, "uuid": "7b183926-20f6-4dbf-acdd-27fad7990df1", "value": "6144:wBlL/c1n5omMli9LMtpwpLi5Lu3/TSmMkB3XN4nO:CexSxlU2eU5LOTSvkliO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484850, "uuid": "f9af16c7-cbfb-4962-9325-8a82ff91bfd2", "value": 281582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484850, "uuid": "2ea5ba74-0de5-4ada-88dc-66c844492186", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484850, "uuid": "21533d17-4c05-45dd-bee7-343a65ea7313", "value": "46c0206c8937107e15c3cab2aa462e93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24eb64e5-3883-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489645, "uuid": "c6b05483-a51c-4d19-aad0-cb4317d58b3b", "comment": "Malware payload (Mirai)", "value": "e9e2ace904c9f2049ee2d16403868e50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489645, "uuid": "9fbc00c6-b4cc-477d-a797-ed4892b7c888", "comment": "Malware payload (Mirai)", "value": "0ace9c1e48517f73c6385f9ebdf3f67a9e7a37bddca6503e1d8f5f6ad7dc91a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489645, "uuid": "31e78be2-ce2b-4d52-b8de-ff5b1f0beda8", "comment": "Malware payload (Mirai)", "value": "dcd1a8cef227c63725ed272a8b9e83f8306104d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489645, "uuid": "dd00f693-6fed-4348-9ec6-dac5a67b6b00", "comment": "Malware payload (Mirai)", "value": "596fe5f9421e62fd66910fafd63101f1aa4c1c4fd5cd1b43527c9c546ce843585c3348f162a12f01811e4c2ac9a1f644", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489645, "uuid": "f16fc32c-b748-433a-b5a9-ef07f6e93bac", "value": "T11CE24E1385F61B86EB1D61F0B014AE35BB1AC5C1A2EE1DB7ED6981E07043C8FB695BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489645, "uuid": "df00fa68-82a5-4350-9392-65ce5a24115d", "value": "384:D+kUtKh11Cj3vHN2btttaukXT0oPaqO7LPaokol9rH/WUqBUMt9CH7Kzgsb:D+kUtKtCj3vHCEDGqpol9rfX+Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489645, "uuid": "109a9373-52a1-4dca-b432-d9262426864a", "value": 32140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489645, "uuid": "16bb1571-9353-4977-ba21-8a6a89ee7acc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489645, "uuid": "cd3e1dcd-3ae8-4103-bcc5-7d1cd2f48ce5", "value": "e9e2ace904c9f2049ee2d16403868e50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f06d19-38f6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635539250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539250, "uuid": "2217161c-1e0c-4c86-b446-216bdf08a8ec", "comment": "Malware payload", "value": "97a33f10e994d32f43404eac8ff3bb02", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539250, "uuid": "1f6d600a-31e8-4305-98c7-a300bb06e852", "comment": "Malware payload", "value": "0ba7554e7d120ce355c6995c6af95542499e4ec2f6012ed16b32a85175761a94", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539250, "uuid": "7bf8ff0d-dd25-4d00-aefc-24496ccc264e", "comment": "Malware payload", "value": "e2d7689f21b3cb232dc93f02531884663578316e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539250, "uuid": "d5bd3b44-5af0-40c0-92c3-7059ec9bca6a", "comment": "Malware payload", "value": "7f562e00e2ffb5082a3c7ce837dfb476349e5352870f8915658868a0791ff5edefabb9de9ee7b10ba754a15eaa7e7db8", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539250, "uuid": "2dee85d9-099b-45e6-a317-64dfcec0b061", "value": "T131F4D796AD2261E4F4B7D2368692712BB97138244735D7CB42006A172B63BF09E7D3CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539250, "uuid": "b185c27e-1fe3-43d2-b426-9f6becd2876c", "value": "c1777a21b70712a99cc5e029c88c2bdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539250, "uuid": "45b3d7d6-9706-4587-9363-186f76764ef6", "value": "12288:dECr4PP2Y44oAVzbqXJOjqPDB1AaK93sPs5hEPMemDnEHoo7:dExjq7k93sPsrDemDnEHoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635539250, "uuid": "3617a42c-bd6c-49c3-bb6f-1d7f58623af6", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635539250, "uuid": "882d2dd2-0d0d-4f8e-8cc2-19a42640a3de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539250, "uuid": "a70e72a5-efd3-455c-a108-c56135609104", "value": "trendmicro.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc6be0c-389d-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635501149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501149, "uuid": "2b62172b-a6b8-4ccd-8840-8ad67a2df51e", "comment": "Malware payload (SnakeKeylogger)", "value": "56037a6a37049da2652ce0014dfb4964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501149, "uuid": "58c71049-f573-4746-a859-cf860294a878", "comment": "Malware payload (SnakeKeylogger)", "value": "0bc0b59b2714ca09b138f15160c3e78e2f90dfdb3e2667e594693b3e94ea20f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501149, "uuid": "82614d36-a8f7-4148-824a-6806ba211233", "comment": "Malware payload (SnakeKeylogger)", "value": "286c029d90ec1b9c0ec6aa2a305ced60f7bdaa73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501149, "uuid": "187cb00a-4f49-424d-977c-6e64878f149e", "comment": "Malware payload (SnakeKeylogger)", "value": "2459c28ba2b35bc9edb8f02c45a0990075c7c5970f5fc5466cd4213227518769d01c300eb981a37cc0087d2638ea8843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501149, "uuid": "25b62949-b368-4cb7-a88e-8bc6651f3ae1", "value": "T1D6F427E7DEA40073D7362DFE121ABE84E76A1CD0E2F438957190705E07BA76270BE925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501149, "uuid": "d480cc38-dc58-4261-901b-ea551a46b8fd", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501149, "uuid": "f03da224-497a-4f57-8219-9badf5dac875", "value": "12288:HPoJG/4ISJK8RzYLOq73Pi+5N/Gz6vNJCQjbVYjV6cCr:vKIU+73Pi+5N3vNJzbVYYcCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501149, "uuid": "d8c6a773-018e-4f5d-8dc0-e08b7e9b92c0", "value": 735693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501149, "uuid": "726acb48-6641-49e8-8a4c-8ecc1e06aca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501149, "uuid": "f4e728a0-8f3c-4fbf-ad40-0cd0918fc57e", "value": "090-08765412345670089009765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d265c4e-3898-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635498759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498759, "uuid": "1530465e-5a52-45eb-b668-026e184b9915", "comment": "Malware payload (RaccoonStealer)", "value": "88973f13d39c485352a297d7e6c8ffa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498759, "uuid": "78bd10ed-f863-48e6-8ec1-0d8e0f9f77e9", "comment": "Malware payload (RaccoonStealer)", "value": "0c37d974d52e06ddf0b003694f1fe9f18475aa57592e639ae49fd840873646ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498759, "uuid": "7236fea0-08ab-4b5d-9a9e-6aeda381a26f", "comment": "Malware payload (RaccoonStealer)", "value": "ac0f1554e5cfcfc84cde5446a4b6ca14bb2d6a36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498759, "uuid": "fa39b41b-4918-4e39-8dff-f64e17421bc3", "comment": "Malware payload (RaccoonStealer)", "value": "9efea8bb48af519aac0bbf1590ad3a8170be15dad205f6152d857743916af44bf20af5f5306006ab954b4375055d4f83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498759, "uuid": "a6f1d06c-fcb3-489c-9922-35057704658e", "value": "T1BC748D10A7A1C035F1B252F859B693A9B93F7DA1AB3490CF13D526EE4674AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498759, "uuid": "fe3ed0cc-e9c7-47c8-82c9-1ef2d2f3d41a", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498759, "uuid": "642f3e01-5a64-479b-b584-0c6e3ce05fb6", "value": "6144:7BeSNDKDERbCF2CkGXCA60b83tMxKldn09BrC:dzEDUbCFAGyA60b83tMxKQ9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635498759, "uuid": "94f0d5f6-fa5e-48dd-84e6-89a56389530c", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635498759, "uuid": "560e93f0-23ff-4689-9d8b-3a3026476c95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498759, "uuid": "70f86b63-3aae-44f2-8006-db173584a4a5", "value": "88973f13d39c485352a297d7e6c8ffa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780da1c8-38a9-11ec-843c-42010a9c0014", "comment": "Malware payload (DBatLoader)", "timestamp": 1635506105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506105, "uuid": "65689b18-1fb8-40bc-94db-f3ddfd4f0579", "comment": "Malware payload (DBatLoader)", "value": "e380210f3eab0dd83b529d539b8ab352", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506105, "uuid": "6dc787c4-55a9-4172-8ca6-4c222fd8db09", "comment": "Malware payload (DBatLoader)", "value": "0ca9bb0c14fad0f33e013afb8894a888cac9cc5cbb5caef4fce1b61f70a0dbae", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506105, "uuid": "0e203b48-a3a0-47c7-bcd9-cb24e236e310", "comment": "Malware payload (DBatLoader)", "value": "70cab309f7d0b73798399c905e5ce81a395a2493", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506105, "uuid": "73a8e582-7cba-4714-b801-1b5b9d375c36", "comment": "Malware payload (DBatLoader)", "value": "3bf983754ceeeca407d9d470be7b8a43eb019f72b6b041145bd85f97ab899afc57f9b1639b7672d6ac8c4dfb4b9a8525", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506105, "uuid": "9bd5d586-c3a7-402a-a3c5-7bf6f91fc614", "value": "T1BB259E23B6C4A437C132AAF44D3692DA50177B102528EDC27BE47F08BEBD581B97A573", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506105, "uuid": "f6f9f9b5-5be4-489d-a466-9715062c0282", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506105, "uuid": "96e5fcf8-782d-4f98-abb8-b4014d6c3059", "value": "12288:qXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4JM6NuLpjqayC94M0LdEegD:q4uBfTG2pM9o6NN+swhY4vMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635506105, "uuid": "9ebbd072-18ed-4e76-bae9-8807e4a8647a", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635506105, "uuid": "5ec52ab7-709d-4732-bb5f-273878654eab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506105, "uuid": "b7b51a3f-1d3f-40a1-b13b-c3e6e5162323", "value": "Enxhyacvpdnlapppigsqmcxwkooppbeynu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fa2080-387e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635487652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487652, "uuid": "ef6560ef-350b-4b33-8c2b-c7a55549b8d2", "comment": "Malware payload (RaccoonStealer)", "value": "20199ac8396673368f4d21fb2cf09716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487652, "uuid": "172955e2-decb-4563-9ae5-f212cce8bc3e", "comment": "Malware payload (RaccoonStealer)", "value": "0ce7a21034827c590af16177ab69fe8f0549ba80d765572cd36eabcbce53dc01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487652, "uuid": "174baba8-3108-4786-92aa-f12c9aa41c96", "comment": "Malware payload (RaccoonStealer)", "value": "a38f3db1b0b4c37a162fb098a7d36208ed4e6e3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487652, "uuid": "9d3fe451-f193-4261-ba53-387bf2cc945d", "comment": "Malware payload (RaccoonStealer)", "value": "eef462aa496476bd5c807ec0ed87f5be82eca3daf1534af6a82dcaea630d769bd0364660934a0b85fd852dbaea66c731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487652, "uuid": "9ac24689-dab5-46b8-9f7d-f9773e44b5c0", "value": "T11CD4E100A6E1C035F2F212F849B69368A93F79A1677495CF23D916EE4A74AE0FD31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487652, "uuid": "e202ad8e-14d6-4648-8a3b-269843020ba9", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487652, "uuid": "6939daad-4c88-49af-9fc2-d3f161dde675", "value": "12288:prZMXSvSUvdDTpASLHlf5E1rum6hMgL6ebL1O/fbp7O9PcR5gsaho9/EgL:ZcSvSUvdDT595hMylM7WEEsdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635487652, "uuid": "1b55c7d9-f169-420f-b9a2-e7558fcae10f", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635487652, "uuid": "dc05def0-72a0-4d00-aa5b-1620c4744c01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487652, "uuid": "da48158c-ff83-4c67-8795-019f3e848ade", "value": "20199ac8396673368f4d21fb2cf09716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7f15b6-387f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635488124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488124, "uuid": "2073c249-6fe4-4cbf-97ad-aed3749e12ef", "comment": "Malware payload (AgentTesla)", "value": "62115cdc412faaf3a262b9a8f4c02ab5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488124, "uuid": "87d3dac1-bc24-47e6-802f-d772d2b8bb64", "comment": "Malware payload (AgentTesla)", "value": "0d94a60fa6bccf878f6ad33a340f123e17dd9a7f377fa9cf93a7b636e420651d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488124, "uuid": "4ff9051e-4b8d-409f-8f4d-866655cd1053", "comment": "Malware payload (AgentTesla)", "value": "4fdbfbfeab088efb1a3a492e1a70d818f9c01777", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488124, "uuid": "507b3629-97be-4010-ba94-2b63118be193", "comment": "Malware payload (AgentTesla)", "value": "cc76b66dad16bfd73ede8b14d9e485b1e0acbd089a64c00aaf673b7f053fdceead45af53e89a734d36f3af7289f1bee2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488124, "uuid": "2bf21bb2-f447-419c-80ad-734f12540986", "value": "T10F15E1365652EADDFFBB2B745561E0400FB47C738EA8D15AACCA315226F2904CF1AF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488124, "uuid": "9ce8d539-df43-4df9-ac07-4b26119a8b48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488124, "uuid": "f856c834-63e8-4f76-9959-16ba7323008d", "value": "24576:mC0pqdacB9DAqNc8NciEHLtJkfVjBp1JGStk2tC+ue9hAE:Z6VcD3c8Nc7HB+9j3Ttk2nDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635488124, "uuid": "752dfe25-1f9a-492d-aafc-6fc3a3677abb", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635488124, "uuid": "8ee15e6f-b557-47e0-8835-5bfe595f0797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488124, "uuid": "f59ba665-eda1-4764-989e-31be98a3ea50", "value": "Q.2021.03.17 PFP...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cb20a7-38c6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635518587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635518587, "uuid": "7f1c54aa-eba9-4230-b67b-c2e02a23ab55", "comment": "Malware payload (RedLineStealer)", "value": "ed4b087cc4451ee7f8c5b15615c7a3cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635518587, "uuid": "331294ec-0329-49d2-a203-2b86309c2413", "comment": "Malware payload (RedLineStealer)", "value": "0f25e211ab9cdfd02445167a1d173b6e449762b9e7503865f4cd621837f5a77c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635518587, "uuid": "0f632cfd-852f-49e3-9e06-e6c30914111a", "comment": "Malware payload (RedLineStealer)", "value": "a39c794433e7ef9d8b037bbf8b20ef8445884824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635518587, "uuid": "804954ad-7461-4c45-a0c5-c14ade13eeb6", "comment": "Malware payload (RedLineStealer)", "value": "e4dfeaae7521ad3add8b722301c9027fdbd9f814d2c74799eacd232460d0771819018b9b5132e9c225e42422e1f2631e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635518587, "uuid": "722e14f0-b297-4437-b343-288182b6d26b", "value": "T1B646333751FB39BCD6F9C77390A6C54A104EA9AD0C089785FF0A8D8A6520ABCDD61B1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635518587, "uuid": "8d26d7ad-4631-415e-8b23-7c79ad284706", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635518587, "uuid": "94abbb63-3fab-4919-b7d5-e075cd0e6567", "value": "98304:Dn2c8y1/LOSWzz8WvOoXnAzaBzXxMADcZP7VfBJ32rLy4AYwU0G/v:11gP73XAiz2AQpfBor2G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635518587, "uuid": "daa67500-2526-4260-acb6-23cac9f35d1e", "value": 5377007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635518587, "uuid": "9ac27c68-2ad7-4b2b-addf-7521f2f1d88f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635518587, "uuid": "f8ee5c49-010a-4ae4-a240-aaf85d1fff1c", "value": "HackLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afd7453-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484098, "uuid": "4276d0ce-69e5-419c-9c51-34c7a78f82d7", "comment": "Malware payload", "value": "75733ee381ee80a07cfeddc6bddd91de", "object_relation": "md5", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484098, "uuid": "b813cb6f-0dc3-44ea-98da-41447cc84b9e", "comment": "Malware payload", "value": "10d83ed487de6ddbd99011f405006efbd415e24037cfd9c724628decffd5aadd", "object_relation": "sha256", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484098, "uuid": "88a41fbc-9363-4dd4-99f2-1a2efc5a9e08", "comment": "Malware payload", "value": "c38a63dc92db5c80e7198eecce5cd23db948b3c2", "object_relation": "sha1", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484098, "uuid": "d0f915ef-ebf2-4908-b03e-028c447c8c56", "comment": "Malware payload", "value": "6e4efb1d60b3fb592263715c390f4fb2b1e0894c65e7f9976752fddcdaab2a634793dc6dba249ba7a4baa0087dea03f5", "object_relation": "sha3-384", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484098, "uuid": "75b1fd29-12b9-4fd7-844c-6915364b8454", "value": "T1C601E20C0D922B22C332CD3A04DAA32284357A57EE92AF5902E416D8252D210B236DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484098, "uuid": "437b5a41-4323-4a5d-9017-9457932614ad", "value": "12:8AlXGC3pQVe/4VfgFDGR2W+feDJL1KDmNf7+lbYqlKBnml1kK:8ArpQQXF6J+fe5pzab/oS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484098, "uuid": "e107526d-011f-438c-a2ac-f2c0d11f856d", "value": 708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484098, "uuid": "d6ca26ab-e180-4631-b1d5-1ba80a604fe3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484098, "uuid": "30f51db2-8266-4fdd-bab2-8025caa6b2f2", "value": "10d83ed487de6ddbd99011f405006efbd415e24037cfd9c724628decffd5aadd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5236a838-38ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635507330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507330, "uuid": "ae8f16f4-8860-4f2b-a97b-d4723c6b2b25", "comment": "Malware payload (Formbook)", "value": "178524c151b05288c04e0f775cf58730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507330, "uuid": "e78ee73d-d457-47b9-8ef8-174d07180300", "comment": "Malware payload (Formbook)", "value": "11061f2489d810c91ae445ebe65eb28c16939836e609e2fac508546cfacdfa26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507330, "uuid": "ee4ef943-7ff0-451c-b0d4-ffbc73aa4f7f", "comment": "Malware payload (Formbook)", "value": "f7913f293a669b12f5eb6ed9cd5bbc73d7dc4c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507330, "uuid": "24afe073-6123-46ac-80a4-17e3fd6217ce", "comment": "Malware payload (Formbook)", "value": "e4ce2730aa38cbf3e663e1ae11fe4349d92a08ec8095f2bbcc23732715d8cc160fa5d22f6691002651fb24588e30f561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507330, "uuid": "a34cec64-6b00-4a50-976d-bd6592fd6fa6", "value": "T17894F1496339C76EE07C077C50A3066417F6A8267271FB454FE638DB2933F824E05AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507330, "uuid": "3ce5aba7-4d48-410f-9c1f-1ef3172f0d5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507330, "uuid": "10620105-d09b-4466-858f-a1cdc9084993", "value": "12288:1lfZx3OBUYPRKsVI95D1VHlqPfjBTDqVaRQVkkQ:1lfZx3ArV0D1obBfqVaRQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635507330, "uuid": "c428e891-7605-46e8-9ce1-93d6c01b8a65", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635507330, "uuid": "5e53c5c2-b39e-43c3-98bb-e0d43ddab5d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507330, "uuid": "7cb934e9-3d9a-410d-82da-8ac2156132a5", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12f8446-38c3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635517395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517395, "uuid": "95bd8c92-7dc5-4e48-8edf-a72ee1b703f0", "comment": "Malware payload", "value": "58fa2801039a0ed2ee164efb8e4735f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517395, "uuid": "8c7de7f7-85ae-4c6b-b353-57ca60142fd9", "comment": "Malware payload", "value": "11bd5910cc6fd925e80bd1a0d8a9ad861fcadeb3090088674e480c1ca65cda6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517395, "uuid": "d8e4e287-242c-48d4-9de6-e99d230bd461", "comment": "Malware payload", "value": "f60a2695802dd42ea556e03cf5cfb6b8bf09a77d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517395, "uuid": "eb3aa8a7-d9cd-40b8-9f53-97efd0246761", "comment": "Malware payload", "value": "33215f565638449cd5df912c2bb115d5d26b2ce4f3cada46ddeb50b1eca0b122cc983af64be92850cc26e31cc67844aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517395, "uuid": "51a38ec0-8b39-41fb-b42c-3d337277e7c4", "value": "T1110526176FD4A8E9E860CB7CA3525B6273304D26D67C6A89143FB47792316F3AC36D20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517395, "uuid": "fe2bd071-c79b-4e1e-8136-393c2a7a7aba", "value": "12288:/Gu7+ZafMFGkr0WR3SvcD7iE0BG22zm9nyQQ8biStNfvmGFLzAS1nolF:/Gu7+Za0DfRS0P5eysFPX1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635517395, "uuid": "c9c109b6-85cd-4a84-b34a-160e27d6c1e1", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635517395, "uuid": "4a117d50-2058-4f57-b127-b0bb0d29d0e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517395, "uuid": "3c24de5a-3e95-4395-83ef-38df42f400e6", "value": "UpdateOnly64bit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bee937-3874-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635483524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483524, "uuid": "66358994-3352-4081-844c-ffff16cb6049", "comment": "Malware payload (Smoke Loader)", "value": "42eabd90d252834ba52568b200e09dfd", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483524, "uuid": "1de71139-5085-481d-8dec-b687da8fa529", "comment": "Malware payload (Smoke Loader)", "value": "1206fbf7e6a98bf2ac11d17648cb27e3aa514774df47b8c071a4473ca4f382c5", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483524, "uuid": "81aa75e5-8680-41fe-9608-f7734d333698", "comment": "Malware payload (Smoke Loader)", "value": "e758217035e67aa46e475e1b5fb79a7168e03078", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483524, "uuid": "8372eb1f-7783-4fa6-a261-63b67d7d3d9c", "comment": "Malware payload (Smoke Loader)", "value": "8a451e1691a0a0701f22e98e3fddf55a41d9d2d4ad863e4cf0abe7f6a4cfd67f39683c494f272c0e663cdbc4722febea", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483524, "uuid": "b8415961-6b7e-4e63-a321-2bd342785b7f", "value": "T12C04AEF132A8D071D463793148258EA14E3ABC21DA709D47B374239E1F7AECC9AE535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483524, "uuid": "9330ec3d-04af-4583-9a4f-e502586df225", "value": "0907a935ef90d39af9a616560320cd24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483524, "uuid": "c05960b3-3057-404f-9f19-5fd39ff221fd", "value": "3072:MiKA8JjNSAN/YU+UB/1WWLAYNno7PLe1CWrxpzbgqruXhspVggjcGkNIVqI:5K7jN59RX/VNno3e1Cuzbgwu6L7ITsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483524, "uuid": "cd7c7f9e-71e2-4d21-bae3-8fd68038df7c", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483524, "uuid": "1b48b59c-d7e1-4834-b92e-a1621b3b04de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483524, "uuid": "df663994-9a25-4d32-91d9-18bc547c053d", "value": "42eabd90d252834ba52568b200e09dfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37826574-38c8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635519311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519311, "uuid": "730110ca-a47d-49db-b888-41a026a56fe0", "comment": "Malware payload", "value": "7981299799f2de55cc14c37ee0bfdcae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519311, "uuid": "7c8f4f26-7318-488c-b24b-38de548f0477", "comment": "Malware payload", "value": "12372274ff5f7aca335aa72f24d3672c919463d13686a91289ba35c330ce6738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519311, "uuid": "5040824a-c1bb-4748-89d3-7255c4993051", "comment": "Malware payload", "value": "7d5c23075e89daf05b5884d57251613722466d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519311, "uuid": "6b688248-0f5c-4c27-9256-92054418da86", "comment": "Malware payload", "value": "d6dd0cbcc3a185acb7a5a458f224221d3eae674c42a63ac2c7e04b0dffd603472f021a1c5b42de0c01f5db542a8185f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519311, "uuid": "511d41b4-4aba-4dbb-8403-fa2dbc5a71f7", "value": "T1900601857C9B28BAC0598E7378283854C7645E265F2BB93E940D3029C73F4B50AFDE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519311, "uuid": "9fc676f9-20f6-4877-9cf1-c3ec4f89e221", "value": "98304:H5JOj+xCCtejc6O9nwEvvPhYKJpicLUDNNsN7bBzaR:H5sqmc6awEvvPyoR6vM79mR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635519311, "uuid": "34080441-714e-4577-86a7-e85362e62456", "value": 3858944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635519311, "uuid": "3e00c8d5-d4e9-43fa-b719-eaaec7d34bc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519311, "uuid": "a34d4bf7-6355-4cf7-a37c-83654e16c25c", "value": "open this if the cheat doesnt work.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecfe9d1-389e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635501338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501338, "uuid": "ddd2a0bd-d319-4f2c-b459-256274bc124e", "comment": "Malware payload (AgentTesla)", "value": "a1adbbfa813d1951755c49e1581b7fb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501338, "uuid": "e775dfda-2776-490b-b0ce-2a99abb2546d", "comment": "Malware payload (AgentTesla)", "value": "1240e433050717764612e4d6c03e2b8120cd7fba43ebf82e0b92c5a8331e7e60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501338, "uuid": "4fbd7cff-ac08-4f0d-a5fd-9540185280b1", "comment": "Malware payload (AgentTesla)", "value": "c85047be4f931dd7087f7a2c50221505371ee077", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501338, "uuid": "a03ec7b8-16e6-4b4a-b542-146392fd0615", "comment": "Malware payload (AgentTesla)", "value": "2ff663d74070d20d9c7686c21e9ebcf953028f18fe141b1665a5dd3173d530d7349e568221ed8e1904efb63a299b294f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501338, "uuid": "f4a15ad2-58a8-4ba5-9d52-2db87748b2e0", "value": "T119B49EAC7250B9CFC85BCE768D991C60AA2074B7531BD303A42722AD9E0E697DF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501338, "uuid": "cbd48818-b41a-4f2a-8f29-9c3a25c220b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501338, "uuid": "4e832839-8f3c-4821-b1de-d90055c4176e", "value": "12288:gFm8BQuYOkblOWgk4UGOOvRNrl7mek6fVpjxEkK1DJQ8:sjYFlkZUGHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501338, "uuid": "1c5495dc-78a4-4418-8f55-728a29b1e25f", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501338, "uuid": "2949dc4a-ac18-479d-b25b-f839459f0af3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501338, "uuid": "d4bc659d-62cb-44ee-ac12-fd48ed67101d", "value": "Transferencia 001#.xlsx_____________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fdffe8-38cc-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635521262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521262, "uuid": "d0a2422e-af19-4350-92c6-92880ebb8f5b", "comment": "Malware payload (AgentTesla)", "value": "ee42f77c443ddbda3ac5a18cdad7394e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521262, "uuid": "be314dfa-cf0b-4eba-91b3-7c1dafa39b97", "comment": "Malware payload (AgentTesla)", "value": "12729928438ef176481b45d650093e1f092faef73e3d9d05e1eda68cbd6370d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521262, "uuid": "5b95f685-6773-41db-aa62-fb3a6a1028ef", "comment": "Malware payload (AgentTesla)", "value": "12d2cc1168cbcb842861c112ae3689669df18530", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521262, "uuid": "fe6513c5-e186-48d4-b281-b2013180a905", "comment": "Malware payload (AgentTesla)", "value": "d62694de2600d539976bf086d9a5ba9fb07f0cebc5f91bf686db913595399c940b465755e37baed9a00ef11d7a694bb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521262, "uuid": "8cc042da-bd65-4e5d-bf6c-22c4c6199b2d", "value": "T126936C2C7F84F518C22C97B9C45F53B58BA3CA4B62B38D49B8554CB53F126CA259CAC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521262, "uuid": "87083598-b3d0-455c-85b0-583d663d0180", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521262, "uuid": "a8d33c9f-fd61-47d1-a560-7b6bc7a2c8c2", "value": "1536:w6p6GCXS0Cy74CT3TrYz6vDpMQ43+41xPNfad7:V6GGS0h0CTXYmvFMQ4b1LfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635521262, "uuid": "77f16c24-0d2b-49f2-8829-ab3695e9ae4b", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635521262, "uuid": "6603a261-bd2a-44b4-ba8e-43074e9a812c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521262, "uuid": "7513ca75-6624-4281-88ed-bcbd685838c9", "value": "PO # 7800017872.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e0a51b-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635484269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484269, "uuid": "05fc0b3c-8909-45e3-bc8d-056c58fa3ea2", "comment": "Malware payload (Vjw0rm)", "value": "b724d40046aecb6bc8fa9e0ecd622ff8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484269, "uuid": "755b41b1-17f3-4236-994d-60d4a61ad3c7", "comment": "Malware payload (Vjw0rm)", "value": "12adc7362259c2e56998f6a108861b6c128c84af9136187c750c3a34a0ef55ad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484269, "uuid": "6759d9bc-ccf2-4cf3-93dd-f036259fe464", "comment": "Malware payload (Vjw0rm)", "value": "29399ff89ad33832d14cd53d1d10581c18c8d7d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484269, "uuid": "f4146870-0bd8-4f92-ac5f-4c8cf03249b7", "comment": "Malware payload (Vjw0rm)", "value": "74545ce467fcc0a0e1c92ce7bf7e6824a911b90c9d0af40cf62c3754d5c88e45b612ba956787e7c08c391e797031eff5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484269, "uuid": "a5aaf6c9-4e3b-4b5c-94ea-02b0631fa3bd", "value": "T1DDB26CCC6D15F589DB21B164A8EE6E985FF8521BD401439E3C2EB3808F75188D69EF2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484269, "uuid": "6c21ff70-4770-4116-aba5-21964ec91dac", "value": "384:tm3uw375WCw0XL8lGY7ZZ9djoq0tB9/q/KI3jimpeNVw0blUDk1z1dfqe:olLwCw07tY7VmvF7CjizN++pvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484269, "uuid": "ef1ebf19-204b-49d5-bb40-3fc18ecb17f8", "value": 23923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484269, "uuid": "a366eab5-f5b3-4dcd-b0b7-fdce4e9276a3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484269, "uuid": "72e9485b-6d22-4fdf-896d-4d75ceeffa56", "value": "receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd2ad25-3877-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635484724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484724, "uuid": "25b9b53d-7ef4-4c90-983a-b39d903c00a7", "comment": "Malware payload (TrickBot)", "value": "4c40eaccca95dcdd80f22a9bd58a81f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484724, "uuid": "697b9da7-44a4-4fa7-957e-9285b82ad7a2", "comment": "Malware payload (TrickBot)", "value": "1309cc563fba424dfbf77e08438fa80738a269bc86e46ca9c3f374b19fecb181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484724, "uuid": "2230ddbe-09b4-42b0-b551-1ea1ab4bb03d", "comment": "Malware payload (TrickBot)", "value": "4c181eccee61c9ebda048a3f61ca584fe82d580a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484724, "uuid": "9f9039c2-ddf5-4906-b834-cba19d773c45", "comment": "Malware payload (TrickBot)", "value": "b3381dec78bc02fcfda899b0a8ed1ae012fd66640eeb994cabc907365c048e07a6440e69744afd7f8818ba1d12710627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484724, "uuid": "f31c6483-e771-4a00-8414-5432bb1ad24a", "value": "T1E3E4DF613BC1C1B7E6B201750FE63B35A2BBE9A00F31BBC367849B4C5A318D15A35756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484724, "uuid": "8979e3e7-3532-46ca-b5fe-2458f564b86e", "value": "7ffe85aa6061465054775c61556ce3a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484724, "uuid": "f85d0316-d9bb-4f6c-bcbb-504999e0ae56", "value": "12288:azhK0hnJrYs840+8xZFDuJsd3aaTW/cTG6QCepwl/Cxofh/zB:HQrYs8v+8xbs/qveiCxofh/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484724, "uuid": "43edc2ae-3640-494d-b47d-3661846abccd", "value": 692267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484724, "uuid": "3c1a6504-745e-43e3-b187-628dd5147194", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484724, "uuid": "63a57e48-2272-40ab-accc-511a5efa5574", "value": "4c40eaccca95dcdd80f22a9bd58a81f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76808e3b-388d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635494077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494077, "uuid": "91c0687d-2b9d-4a18-a1d4-a2f49868e10b", "comment": "Malware payload (Formbook)", "value": "19df9a119feaacfe41e801011a994c35", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494077, "uuid": "3387e51e-897b-4527-b78e-7723d76630b2", "comment": "Malware payload (Formbook)", "value": "1356fb5359af3691295d961587737f67afe5c7910c50151d6028d3b69762c04f", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494077, "uuid": "3f2238ad-cfcf-44e0-9451-9951f9c393a3", "comment": "Malware payload (Formbook)", "value": "d22ef676abd59cc6106e963188ff712b65d837bf", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494077, "uuid": "14c92fc3-89b4-42f5-951f-5b25924c3a39", "comment": "Malware payload (Formbook)", "value": "9bc3dba72cc6bd00784de0f367ce22587930a18690209f13aedda0d59396de3f3423657299984e9154deda07a4e5b998", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494077, "uuid": "e3151dac-ae3c-48b2-af76-a4be567e663f", "value": "T13E7423FB1B89C95E51C5FC2CB6159D54390CBB416DC2A2A6B39064EDBB0EF01E3B44B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494077, "uuid": "17dcc859-21d7-4dd8-bf64-4c4708d90acf", "value": "6144:Q6VYIW33osonhJYXfVvd+WgbNj3WufFBJnSlgn3yUtMK0AM7QoX:/XWHXbvBdQYYFBqa3yUODQoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494077, "uuid": "beb57895-7d44-4948-b9df-72fa1ab40006", "value": 348530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494077, "uuid": "2eafc996-942d-4aee-8dd0-279367b41b0a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494077, "uuid": "602cda4e-48b0-4421-acb3-169208adbc37", "value": "shipping docs 07853 draft CI+PL.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e612f88-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635484963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484963, "uuid": "6f42a045-555f-409c-aed3-ae9fd1889a70", "comment": "Malware payload (RaccoonStealer)", "value": "789684d294781eb2cf652837753ee9f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484963, "uuid": "55b8ce2c-38d1-4935-99b9-5fb0e8ab927e", "comment": "Malware payload (RaccoonStealer)", "value": "13e3967b15ad45bccb23beb1f651aaea47d63a6e8ae0b53a4f9f5968e8a0bc1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484963, "uuid": "887e7c10-a503-4388-886a-658791aff76c", "comment": "Malware payload (RaccoonStealer)", "value": "8ac73e42d7c5c8081218124122fd846c6936d0bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484963, "uuid": "b6fae5a2-078b-4108-9f6f-e0b9e3d0f1c5", "comment": "Malware payload (RaccoonStealer)", "value": "a642f7762ae7b6ce731e948b2c331096c83b1bf757bf46a2453c9a3b50430306e61b2bb24c33a14a91d61772f3cf8e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484963, "uuid": "8bb1886d-59b3-4c87-8e65-0646f3d30ab3", "value": "T1FED4E010A6E1C034F5F652F449B69369B93F3AA1673884CF52D527EE5A74AE0EC32313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484963, "uuid": "69db580a-f2b7-41a6-b7a0-bc03e14269b2", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484963, "uuid": "d80f9939-9e6d-4ef4-b1d9-cf5bf42717f0", "value": "12288:msl94DTv2bcM+IfKa31q1ikc6udaSRd8D7DQFWRDIsklYlZ:jdbcoKO0nhmRRMGsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484963, "uuid": "056ba622-8450-41eb-b4ed-518bc7c45e33", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484963, "uuid": "5c4cad6b-978c-438f-adfc-e2ca04deddaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484963, "uuid": "1e103775-e733-417d-bf99-600e9095c013", "value": "789684d294781eb2cf652837753ee9f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ad956a-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635484115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484115, "uuid": "80669a13-d83f-470b-a8d6-b20bf063c6ae", "comment": "Malware payload (Loki)", "value": "a7cd314508813b4d8712c8cb7acc08d4", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484115, "uuid": "2f3b04e7-a547-4de4-8f0b-20a90cde08c9", "comment": "Malware payload (Loki)", "value": "1442be62f4542cef5450029ebc729556b0cd8c303182b926f37a0f3b153a2935", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484115, "uuid": "ac4eeaa5-f157-4f0b-a729-399b9e395754", "comment": "Malware payload (Loki)", "value": "66c60a2dd839bd633d0461ba765af3e0457a9ff0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484115, "uuid": "e2885e2d-91e0-487f-89bf-92a4574c2bc1", "comment": "Malware payload (Loki)", "value": "f638a01001ac45f1b95e58d111d164e3e4fce8d1c9cb85a6765383c52a38735752194abd8d4f0aa22a8fe6a4934dc8c9", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484115, "uuid": "9911bbd2-3d43-44d7-97fc-3d22e3e99afd", "value": "T123847C6C3250B9DFC45BCE7689991C20AA6074B7531BD303A42726ACDE0E69BDF191F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484115, "uuid": "4fc50e2e-f42c-4f05-b13c-5db7dfdddec4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484115, "uuid": "3f3d1bd1-31f7-41b0-bed6-b8c23390e611", "value": "12288:x84NEQNleVf960HDTDUI63LSZj3gkRi72nKEnMShQdCQFf:K6sf9R7UIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484115, "uuid": "d2492186-03ed-477f-b8d0-6153f8a5210e", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484115, "uuid": "f8559d7a-0642-414f-9300-a0f0c8248f00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484115, "uuid": "034415d6-fec8-404c-be93-79859d362a0f", "value": "Dhl_TY908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8185b130-38c3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635517288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517288, "uuid": "48970043-3bbd-488d-ae22-2fe17c212b05", "comment": "Malware payload (RaccoonStealer)", "value": "cb73451ad44fd946a064c617aafc23aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517288, "uuid": "864daa9f-80ab-4751-8ff3-ed2416685bf8", "comment": "Malware payload (RaccoonStealer)", "value": "14572841b0ae23c4303340f041092761306f8a006f1d7ae5a3a2c50aa485ec16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517288, "uuid": "c25053ab-81b3-4364-93dc-c7ec1fe737cf", "comment": "Malware payload (RaccoonStealer)", "value": "3b206f89d62b03a9338d10c7b63da77a4baceebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517288, "uuid": "3db0f654-3e9d-4caa-96e8-8430ad8b096b", "comment": "Malware payload (RaccoonStealer)", "value": "a718d6e96de43b846afee315b23bae8f477aaf1c18747461468abd821c9d382ddc60f485bf476ed4c57de64bc289ce12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517288, "uuid": "d5a4ad7d-0a5f-46a0-92be-13bcc1a6d6c3", "value": "T11826233372560096C1F2843D853BADE235FA1656CF02DCBFA6EAADD519145F2E213AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517288, "uuid": "c4e01afe-5646-4049-9131-8be7a045543f", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517288, "uuid": "30d2224c-e3e9-408c-a4b8-aae8f2021be0", "value": "98304:t7KfOaGifs/vkbr3ah/wiJ3TNKwMtmDM97HMGjWREWV:CP2v+6/tDNKwM4DMNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635517288, "uuid": "5105ec97-730a-4e8d-924b-9c6d8feebe7f", "value": 4846592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635517288, "uuid": "4f4eb506-2f92-4834-8394-1e7ad14bb395", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517288, "uuid": "f15cf524-e025-4927-8bcc-42fd77d19258", "value": "AutoInstallYouTube.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075e83b0-38d1-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635523096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523096, "uuid": "e916896d-aa44-4d1f-9c62-224a8cf0dd0c", "comment": "Malware payload (AsyncRAT)", "value": "d4b8b8cfd3b479a8138cd750c58a7c82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523096, "uuid": "63aae5b6-ab28-4755-8583-cd4ebacfba01", "comment": "Malware payload (AsyncRAT)", "value": "1490f6303a675ded86c22841f87868c6f0867e922671e0426f499e46a72060d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523096, "uuid": "f0659c8e-75e5-45aa-929b-f0c659913805", "comment": "Malware payload (AsyncRAT)", "value": "b96aa9a15e4076786b16edfef4b3a92d289a3cad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523096, "uuid": "2874c976-7521-412b-b98f-ad4a8e65eead", "comment": "Malware payload (AsyncRAT)", "value": "9a2910ade666ca944ae98c14ab05c1d893901b32227c4dade3e9d2898f26cec0532ada0deb381169bf974c68c85e9dc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523096, "uuid": "697c7f20-b3ed-441a-a289-798a714ad535", "value": "T144231B003BE9812BF2BE5F7899F261054A7AF2632603D54E1CC451DB5713FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523096, "uuid": "57ec6738-5e02-4bac-bbf2-d695f2bbcad8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523096, "uuid": "9b4d8553-3864-437e-8ad1-a3afb57b81d6", "value": "768:LuScq5TAYGTqWU8j+zmo2qLzKjGKG6PIyzjbFgX3ipayUcuhLpuvBDZbx:LuScq5TA5c2eKYDy3bCXSpayULhedbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635523096, "uuid": "d49b189a-10cb-4134-8dde-eef08f28392a", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635523096, "uuid": "25ddfe07-0706-4f66-b64d-ea97f089ae2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523096, "uuid": "4626b54a-8669-4f08-aa24-0cfc664dc380", "value": "d4b8b8cfd3b479a8138cd750c58a7c82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284b5595-3881-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635488791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488791, "uuid": "2ee2a0a0-24a8-40a1-9c9c-3bad614c20fe", "comment": "Malware payload (Mirai)", "value": "a3ba64853e4f7f56fafb0dbb3a6c8ad4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488791, "uuid": "c41e20d7-1c6a-4c66-9811-32e23a1dbed3", "comment": "Malware payload (Mirai)", "value": "14ac9fa43f038807c1ff720ffbd43178f9a782950ad582a9161af2368de0ba60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488791, "uuid": "d712438a-8571-456b-b263-8be99df906ff", "comment": "Malware payload (Mirai)", "value": "8b1723540205f899362feea197b0bb22c6806e9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488791, "uuid": "39aab3ef-97fe-424b-84af-e76f1e83d661", "comment": "Malware payload (Mirai)", "value": "c5c2575c577a1ddb9f64330c1cb29fdb93a2b7a3b19b0ee1662f4cf17d8e688763412b9ef97af9092402be114d5d994e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488791, "uuid": "a052ac01-38b2-4dd0-8f63-aa3316bc9c0f", "value": "T10BB2E195D6FB17C3C2A18332D07C5A4DE1736AC1074B451E2109B69E62D760E8BFB3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488791, "uuid": "f6635f23-0880-4a29-ba05-d3ebab6c61d1", "value": "768:R/QOC0Yhn6ROHWF09cwNPFCnNBxcmQcI9:R/nihneF1wKNBa6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635488791, "uuid": "2dc3db2f-da29-494e-9de5-0c326a6f00b7", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635488791, "uuid": "c6200645-cdaf-41c4-aba7-ea568a02e6e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488791, "uuid": "dffdb5fa-224d-4974-be10-48dcb4fb34ae", "value": "a3ba64853e4f7f56fafb0dbb3a6c8ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61499d8-38ad-11ec-843c-42010a9c0014", "comment": "Malware payload (LimeRAT)", "timestamp": 1635507927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507927, "uuid": "6785210a-c688-45f6-93bd-607584f240c3", "comment": "Malware payload (LimeRAT)", "value": "b6fa2d4ed5c6cb58e654065f1f5016fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507927, "uuid": "8d2fc009-9e2b-4c4f-b17d-f21c6cbdffa5", "comment": "Malware payload (LimeRAT)", "value": "153d27bd441120fed477d629bdf1c9d8a8c5af1bc09b137241137a518153bb68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507927, "uuid": "e7766be0-4a8d-4a44-b584-9dd78893f580", "comment": "Malware payload (LimeRAT)", "value": "a60e15d05b802f0df624caadebe4b04432b5f327", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507927, "uuid": "0111577d-f9c3-48c5-b63d-2811b1e7ed64", "comment": "Malware payload (LimeRAT)", "value": "b62248f200c94aee7f9ea29d1fcfad5af4e255df6550c7070ae2b7733f99b5b09eb40250ebd18893eff9f482a5a609e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507927, "uuid": "5862c6e5-5f4b-40f2-938a-03b6eee4c5c5", "value": "T1B394B7D4A2D65E43E83D7A3961A1AD0993F310E52E2BD72DBF4D4EE94402AC74F0D24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507927, "uuid": "864d3e24-4a25-4658-93ee-122a1de28b7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507927, "uuid": "76fc5b7a-cc19-4aeb-a0e3-e0a5e44c83ab", "value": "6144:XrVVFVVFvDsVZiZiZiZRtCCmt7wdCmQZLdPsdWrbAd:XrVVFVVFoVgggjtyhwdyZPWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635507927, "uuid": "094fed4e-f862-4516-9579-c37c9a603c7f", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635507927, "uuid": "e9df8792-f01f-40e9-acd0-2304c8a388d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507927, "uuid": "bd2fdd61-7271-4674-ba78-69aa729b7228", "value": "b6fa2d4ed5c6cb58e654065f1f5016fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1d26d0-38e0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635529951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529951, "uuid": "47e4d1e8-1180-4375-8f5e-f0b6941a2fbb", "comment": "Malware payload (AgentTesla)", "value": "c2a49e7137c7a6ff64fd3a1e9fa0d3c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529951, "uuid": "9bc011f0-edd6-4279-b6ea-19b6979b348a", "comment": "Malware payload (AgentTesla)", "value": "1583a8e5b51390bdebb02e4098b461831d0a1819ede3b19703d80ce0a4d5c70c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529951, "uuid": "f0cbb4a3-6c93-4960-9359-7243ed7ea5fe", "comment": "Malware payload (AgentTesla)", "value": "759b9e9c4941d25f783e0a60e8356feeb97229c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529951, "uuid": "2ad3eebc-ddae-4925-9489-a2c899cd7991", "comment": "Malware payload (AgentTesla)", "value": "e1df429b01ac57b43182eacf225a077b5f0b51ea335a05070135752da7973d84e8eb3624ed4250c431a992a6749d8c4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529951, "uuid": "083f3d64-831b-481c-aad5-e0f500a379f2", "value": "T129A4D0493294F5AFC41B8F3559912C10EB70A4B7630BC313A98721AC9A2E7D99F15AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529951, "uuid": "6914260b-d671-4a04-8b09-7532dec05a41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529951, "uuid": "3ce2a78b-6896-4691-adf4-5de49dddb4c8", "value": "12288:LdR3YQopPkqVcYdut60klqdcqj79uHJ4XgUYPcRb17:LdR3e8qVDXlGLkpUePc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635529951, "uuid": "b45610c8-0c78-4a9b-86fa-f0685e8fa56a", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635529951, "uuid": "afd94303-1f92-4b6f-b1ee-4c720fd8a4f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529951, "uuid": "e2cea1eb-2869-4e61-88e4-14c233585cd7", "value": "FACTURA-112000076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a47b175-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635484097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484097, "uuid": "e6332782-d892-4a07-b64e-5650c79569ee", "comment": "Malware payload (AgentTesla)", "value": "3abf2ff98305add1591b9dce02559d52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484097, "uuid": "24aec5b8-ee67-4fee-a5d0-ab256d94ab31", "comment": "Malware payload (AgentTesla)", "value": "16379c1e99f9089b67d3ba766475b89cad99336d1f7030375f88bea0531d11cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484097, "uuid": "3e30fe77-81e9-41c5-a6d2-9e41082bd5e5", "comment": "Malware payload (AgentTesla)", "value": "a58d8ebc2a09173ab46b71a8c02e3fe90737b91c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484097, "uuid": "3b3f5a65-cf0a-4cba-b2a6-a1f3722a1d9f", "comment": "Malware payload (AgentTesla)", "value": "76e49b683cb531205c36ea9cd98e5efa961a3cabcc4f461c7600bcda68ec2f75bd981da5fbcd7418682a30a562b07c61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484097, "uuid": "ac202529-ba27-4c8d-b587-b52236b34fcc", "value": "T13FD4E00167E6A943D7B90FB5187311105BB1A9663D32DB0B2DC820DED9BEBC50A81F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484097, "uuid": "6bb68984-0d80-4d92-92f6-95da86ecbc0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484097, "uuid": "57d6f2f8-a700-425e-9402-45c0d8f0729c", "value": "12288:YQuPcUuaAWUBTfLgm8AKPXja+sLX1LH7z+Y6yhKerbgFiAKYQw:YJPcUuWUlf8ZAKvjafj+Y9hKeAAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484097, "uuid": "b0a90b0f-8d4f-4d25-9b84-f952c24b95e3", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484097, "uuid": "01b6d884-2882-4974-9a6a-00d120ccd304", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484097, "uuid": "2ce0edd8-8eab-4499-a274-afc6a1f683b8", "value": "DHL Consignment receipt_AWB#2045829822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbc76d0-3883-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489985, "uuid": "b96a3764-fea6-4683-a614-599a96e9ac1c", "comment": "Malware payload (Mirai)", "value": "dfc9d47d1bb0546c2f409032606b2310", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489985, "uuid": "e2f3ebfb-11c1-4f0d-8e41-1f9413c5dc52", "comment": "Malware payload (Mirai)", "value": "16542ccf805311f06c6a0327a7e1f1a66a590fb5101375ffe4f3c674dc6d144d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489985, "uuid": "b8ee1b08-4eab-403e-ad3d-cc0279ab1cc9", "comment": "Malware payload (Mirai)", "value": "dc7384fb44ce99c4a4329dbca627564cc912370a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489985, "uuid": "4a7cfd75-c9fa-4ef2-9a47-aa934b6613b6", "comment": "Malware payload (Mirai)", "value": "33cd1ed3a3eaa7fb98c027caf26508566ae81068497b80b58f15cf77b7412569f26864ed0f08819a57258fb32de90057", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489985, "uuid": "daa1397c-e8b5-4a88-999b-b5db2cdccb85", "value": "T18EC2E08817492AE9D1F9C13C07A81B681DB40F96F80ADC8568F9F7629D8E4753027ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489985, "uuid": "3aab6fee-af48-4521-a126-2b521b2bba42", "value": "768:G2G214DFyosXqgvV9o1ndB08nO4JgGlzDpbuR1Jz:G2GdDgosaaO1ndfVJuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489985, "uuid": "e7e9e2af-1bc5-44c3-927c-ccd0b010f511", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489985, "uuid": "98abc740-b1ad-4d41-bd78-f2c498cb98b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489985, "uuid": "4c5bbf6d-4a16-4ed7-868b-44445a3634a6", "value": "dfc9d47d1bb0546c2f409032606b2310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409ff4e6-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635526198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526198, "uuid": "399bd159-755e-4d09-9e3b-da1bc1ffbaa4", "comment": "Malware payload", "value": "b10006163a7219e99b2049a680226d2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526198, "uuid": "5453c381-3939-4954-a03c-4e388b10d680", "comment": "Malware payload", "value": "166f42d9f5a77471c3537ad00e246c4e58e7e9b113e248799cd938467b2dddfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526198, "uuid": "3bd83252-121a-4a72-8afd-4dd61c75ce5e", "comment": "Malware payload", "value": "edf51eb3667522825741918a24fedc398dd4ce54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526198, "uuid": "2a3554b6-eec8-4d12-bc17-61c16636d618", "comment": "Malware payload", "value": "4298f5363158d65e88d0a650c09a20c013800edea2eb0c69949b69227d2f0f42eef9b8352a248440d9728f484da423bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526198, "uuid": "f6dcb7aa-a2f0-475f-885f-9ed067c91ac7", "value": "T1D7151202BAC2C572D57319321A3A97246E3DBC305E25DA2FB3A4696DDF351C19324BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526198, "uuid": "0025d460-96e7-45d1-8d22-44d2ad73c13d", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526198, "uuid": "82554fdd-5f00-4c40-adde-128158ddcb08", "value": "24576:KAOcZwXYQpJWTMTYMer8cn+BP1dHO3453ioO2R/YzVW:wNPWdr9GHOo5vOqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526198, "uuid": "4742a228-9c7f-4b72-b4b0-dd0449434d1f", "value": 951360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526198, "uuid": "e0f12833-c888-4a11-b5e8-c2b19b6d512e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526198, "uuid": "29378a04-dc28-4b45-800d-5597b3193ff5", "value": "b10006163a7219e99b2049a680226d2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ad784e-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635494825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494825, "uuid": "46f3586b-afa6-45bf-beda-a010d59d103c", "comment": "Malware payload (AsyncRAT)", "value": "e95ddbd7f672ae398d2c178caa414691", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494825, "uuid": "56669a69-fb61-44cc-91b9-9cdf886f7248", "comment": "Malware payload (AsyncRAT)", "value": "168f62c6ea11a386469563c360ee5517da31015e774ccc9c8ba3d1bd4b4f45ef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494825, "uuid": "edbcd2d8-ebe2-47ca-b669-d735fee75382", "comment": "Malware payload (AsyncRAT)", "value": "18229feb07d8af500055af5521aca03cee8b8345", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494825, "uuid": "863f24a3-c695-4071-b793-43a8d49eb44b", "comment": "Malware payload (AsyncRAT)", "value": "5cc7d8c8b1de44390e3854e3616b108d125d17ffb5b6c24fcad0f6431943a644dd7488973e088b7928f3a8612cb3e439", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494825, "uuid": "7046dead-d04d-44b2-bf61-8116bc2947b6", "value": "T15D84DF00A3E99D2AC37A4FB6087301101B75A95BBD72D70F1DC520DE3A7ABD60952F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494825, "uuid": "53d29fd2-0a88-4c70-a166-0a8dd181481f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494825, "uuid": "30b33154-43e5-464f-83a4-e6234bf88771", "value": "6144:EHFeN5t2Zx0YpugQVmRXHObozaB9Q9wASrPFTZrHSOO1257lZ3EJXd0:6FK5gEmQVmJHOoFyFT9uM57lZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494825, "uuid": "206dc2ab-e902-47c5-bd8c-6a67f0631a9c", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494825, "uuid": "68ba77d2-a0e2-413d-86f9-ed876f8c81ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494825, "uuid": "4b7ce167-7530-440d-b28f-62e0812b4798", "value": "e95ddbd7f672ae398d2c178caa414691.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad9cc55-38e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635532873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532873, "uuid": "98311ddf-0ba5-4bc9-9598-9be3e8feb567", "comment": "Malware payload (Smoke Loader)", "value": "537ad79dd97c59fcd1df5d8a26256192", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532873, "uuid": "4cd44729-9554-46b8-b66e-5e5794897f6e", "comment": "Malware payload (Smoke Loader)", "value": "17bb183c9e8f262c2bd91228e788f4613279c795573b558c3981501ee02811ba", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532873, "uuid": "aa20ec9a-8f51-4068-b586-7bc6ae414636", "comment": "Malware payload (Smoke Loader)", "value": "7d43f8a6c25934e4299316ad7c9c8e8ce61416e3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532873, "uuid": "dc6b05bc-5259-48d0-886a-ddcf72dc038f", "comment": "Malware payload (Smoke Loader)", "value": "8d4cf797121db18a2c23b85bd106a6863a7cd80f10a1372a79db3c9bd29f659458482d10ee2f8a48f497b736b9a18a57", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532873, "uuid": "0ac64b42-f69b-4101-baf0-f5e8efbbd6c9", "value": "T1DF748C10A7A1C435F5F252F849BAA36AB93F79B16B3890CF12D516EE46746E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532873, "uuid": "7a3c8c54-c643-419a-9827-cff27bfe750b", "value": "8554f137e95e1371295faad9355adee2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532873, "uuid": "d3f787b2-56ed-4caa-84bf-8d02d3f81293", "value": "6144:KsJKwfGUwb7+K6jGYVG+tYuibQCMe/SEEt:K6bte7P6jGYV/tYuiP/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532873, "uuid": "591a261e-6573-4dfb-964b-42d8659060b2", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532873, "uuid": "e22f216f-ef86-4ccb-aac1-bb33ab79306e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532873, "uuid": "2c1e5a61-4f16-42b2-acc9-ce6265bdfa5e", "value": "537ad79dd97c59fcd1df5d8a26256192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f164c4-384e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635467225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635467225, "uuid": "7e388b7b-c362-45e4-9e7e-e52d63dc3084", "comment": "Malware payload (RaccoonStealer)", "value": "c5d026ed4cea07f15bf500638143f576", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635467225, "uuid": "2f179277-cd79-4b93-8ef6-25ddc4d3a399", "comment": "Malware payload (RaccoonStealer)", "value": "198600eba43dec4149a643372eafa618f9a87eb5b5f5bc0c5b8f77eaec97b295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635467225, "uuid": "92d06f4a-a119-4371-a1a1-75080847752a", "comment": "Malware payload (RaccoonStealer)", "value": "b7911144a953384761014f61901fb17a3dfbd785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635467225, "uuid": "8d231e4a-7e95-445f-a936-bde2657bbd35", "comment": "Malware payload (RaccoonStealer)", "value": "198904c556c33ca62ec88daaf5f0ba6ec33710a6e02b4bd6a4b847b3871cccc010cc768bbe1773f9edd69b26a593da5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635467225, "uuid": "f36019c3-e7c6-41bc-a55f-6110f7cc0a5c", "value": "T1E2A4F1F5629DC476C4633A708C25EE71462A7CA1E670D14B33B8191E1AB4FCC5AE23DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635467225, "uuid": "fe423dde-6d9c-4a38-848f-27f84622a88f", "value": "18875662b19ade4ddd6bba43f9abb4a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635467225, "uuid": "a35be80f-1a5e-4d09-93b3-51d56eb527f7", "value": "6144:Sn/2+RlkpIaeURDrlVB51zS9fC3LjhZGTBU0Hvvy2CPl4xNQvpybESZtM4uzbgw4:C2+RlFaLx7zKUHGTBPWnpygAZunnF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635467225, "uuid": "5219d301-a936-4acd-ac4a-bf03cc7ab6c1", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635467225, "uuid": "1275c2d5-9e71-4461-9513-700fa45a2ddd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635467225, "uuid": "fd335546-db8e-42ba-b949-52524872c357", "value": "c5d026ed4cea07f15bf500638143f576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60632ba-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1635526395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526395, "uuid": "2756dbb4-0802-4eeb-aef9-ee18e1115be1", "comment": "Malware payload (Neshta)", "value": "15c9dee0549b0ace548890de44acd781", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526395, "uuid": "6ca92421-cd70-4804-ad53-fcb273c7c8a1", "comment": "Malware payload (Neshta)", "value": "1a24bd8a5dbb7292e5b2bc2a9d3958eed8a1a3107f4e07e5ad0031f626a708a9", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526395, "uuid": "7245607c-46d0-4dc1-89dc-e490e349f746", "comment": "Malware payload (Neshta)", "value": "bce6ac3620d2f7ebcff5b153da84a8acc188461c", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526395, "uuid": "d0998d65-3da0-475e-a961-8107ecfd403c", "comment": "Malware payload (Neshta)", "value": "07fb194542ece36f4bb612a7e63e40497b643954f6e73d3e92056c99df40876da424cc18e17e9439c7b212dd0fa31c2c", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526395, "uuid": "d56d0696-3399-434f-80ce-b2a12316a17d", "value": "T1FAB4F16D7CFE272AD122817377B41A4671D6AE4F0F074BD292803A1996BD7A3C250BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526395, "uuid": "483b24e4-b278-4063-8ca0-adda2355b066", "value": "12288:X2bwysa8UOgfNUfGYJpD3kD4dQqvrzjROpsLxX32oH:XIargglG4drOpEWoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526395, "uuid": "03af3d43-50ba-49ea-aee0-bdfbaf2af4cf", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526395, "uuid": "9be14471-ee67-47ea-bc0c-891740b4a404", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526395, "uuid": "f3b5dac1-e6c2-45f3-81c4-369718207d42", "value": "new order sheet 0016.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c83b770-38e2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635530567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530567, "uuid": "73cd04e6-ea8d-403d-a13d-0836ed361ef0", "comment": "Malware payload", "value": "ff639eb2c9f449dcad8fd4f570e02c98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530567, "uuid": "b1493fe6-e59a-4541-bc12-ba27c9e000db", "comment": "Malware payload", "value": "1ae0433f7fedd2ec0755811b6bd2da286534583f0a7c12caa2319778a45155e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530567, "uuid": "fa5a883a-ec8f-4e3c-bf51-84b6b70a6911", "comment": "Malware payload", "value": "295fee41c5b2f6c9bbf467d3a16ebd51311a5b21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530567, "uuid": "53a2b625-aa9b-453d-b70d-1576b744aff5", "comment": "Malware payload", "value": "5b28c69ed3f516a2cf3cbf5c410bfce5ee551667ed2b20d64005abf2beea1d2c9d138d18641029a306a6c4775c78e570", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530567, "uuid": "a8330cc5-b41c-4c5a-91db-636f3348363b", "value": "T158E3F82A77908F14C59819B1C5E79A3407E3FA877232D7893F0A62D60E423E58D8F7C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530567, "uuid": "be07c694-9250-4e50-ac89-e38640fea3ac", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530567, "uuid": "e190f40e-0c6b-49b6-83e2-d2d3b80095a1", "value": "3072:WG6Vd+z9LYIxY8ukC8Yek2XFJlLPqzMWkhVxxQk:WVVM9LYIq8ZCC1DrD9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530567, "uuid": "1028ea35-7b02-4d6a-85ba-a3a57651125c", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530567, "uuid": "d39c550e-0cbf-45be-9649-7e0e16eaa29a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530567, "uuid": "6b87e4c3-b953-498f-b904-91d664ee655a", "value": "Level-2-Extracted.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780dc46a-3882-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489355, "uuid": "e02c8769-230c-424c-8c53-d385d02dfc39", "comment": "Malware payload (Mirai)", "value": "6c982efa63458b428ed98b6f2fa70165", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489355, "uuid": "da42397c-a824-4fc3-97f1-2739ae3a2f99", "comment": "Malware payload (Mirai)", "value": "1b20443752270cfe8fcd3f4d21ca7fbb9094e150d1b508826eaf1a454280d40b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489355, "uuid": "19765e35-b914-4dac-94f7-1a5799cbdaa4", "comment": "Malware payload (Mirai)", "value": "199fd3f587ed36e207696f3642986bd508dc0839", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489355, "uuid": "61803ab9-a138-444c-859b-b1071d31ffa0", "comment": "Malware payload (Mirai)", "value": "eead667e3601e9951c2dae8d52f62a16c046d8750020a28f8a2ff5161d4721186bd3ce6c458a0e8a8e33730c44007595", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489355, "uuid": "c5c6a77b-4676-4ee0-b2c0-45c64d29ada8", "value": "T1B8F25143B5BB4287EB1A38F0B95A3A81EB5DEAD032FC9182E95956C57075D6B30D0CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489355, "uuid": "d146f661-613a-491f-a0dd-da2c89df1b92", "value": "384:I391PeYMJpZr3ZMrnk8VcAUpNTMOfQYQkmxgAqFP1lhlKTnaNOOHtNNDmV3azu:e9hmXrck86AUYnY3c2NzNNNDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489355, "uuid": "61a12dd7-9c46-4434-82f2-12396ec174e0", "value": 35320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489355, "uuid": "04dec620-9d94-4a1f-984a-79efc2bb69dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489355, "uuid": "5018af72-96c9-42e7-b6af-47430f824630", "value": "6c982efa63458b428ed98b6f2fa70165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8872be-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635526541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526541, "uuid": "9444caba-509a-4219-9ed5-07ff02469b4b", "comment": "Malware payload (Mirai)", "value": "c0fe355a7d47dca121373733994e4739", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526541, "uuid": "28b1fe40-3695-4766-b964-960ad1cac79c", "comment": "Malware payload (Mirai)", "value": "1b22aa89fc48276d543f2626f77cb03bb64cb41eff97a9ee17d31dd129b27c8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526541, "uuid": "b79ec57c-9133-4ceb-a0f3-553513d0fd76", "comment": "Malware payload (Mirai)", "value": "d8217d61d7350fd4915d79a69c0d4a0cf558cb90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526541, "uuid": "4c0b5bfd-e1cd-40b2-9d39-9cd5eda9a10f", "comment": "Malware payload (Mirai)", "value": "ef406a67520eb0b533735497a7b78a9cb836b23adf428f081e39f1cd5e41e17a3898d5e94ba076a6c9ce6f6d0eb8398d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526541, "uuid": "78ed3e76-4d5c-4040-9457-c286eea1a238", "value": "T1B8734B32B9392B27C0D0A47E11FB4B15B6E11BCE26E8C61E7D720E5EFF516502416EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526541, "uuid": "efbb09be-b497-47f5-8521-12c9ca6db446", "value": "1536:iTNvf5bW8j9SOxqAxqS/Kcj4gE4nyi9TGVgOtj9I:oNjCqlDF+tG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526541, "uuid": "21a2d9e3-0723-4217-8ead-b339fb728162", "value": 80160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526541, "uuid": "5f270935-471f-4363-841a-9fd179fd053e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526541, "uuid": "9227ddf4-9751-460a-9127-c09694a42a27", "value": "c0fe355a7d47dca121373733994e4739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40f6fd0-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635484301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484301, "uuid": "04b9e885-e00a-43cc-9f93-f06f83ec3b6d", "comment": "Malware payload (Vjw0rm)", "value": "ff03b716aade39fcd09b161acb59a323", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484301, "uuid": "e5ceb4bc-8715-49fb-ae7c-f21ab13d5c16", "comment": "Malware payload (Vjw0rm)", "value": "1bd86d8d310a551d485e8b26da4a2b8cfa3b0b219fe8635fe084efe960458e8a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484301, "uuid": "cd866882-6edc-42fa-9119-d4ab7d665191", "comment": "Malware payload (Vjw0rm)", "value": "65a5d2f0b656ec114e721e8647e51f87548098e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484301, "uuid": "81de2f26-a5c5-43a8-a65b-12df70500a40", "comment": "Malware payload (Vjw0rm)", "value": "f519d6cdc4b300c50b350dcaafe1cfe85c4ff7118cb2a8b0c6afce93ee260967a1327661f06d0a547cbfa2a66ab216cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484301, "uuid": "f0ab412e-fed1-4584-8001-f92dde1126b3", "value": "T1D9838F119E401C66B7B6C692F3980124CF15A2F4CF2A655AD38359CD3EFF247AB83E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484301, "uuid": "9f18870f-8fee-437a-af69-8a581f4047c7", "value": "384:A6DrhWr+y1tvMWfHvYdfQ1nu4cLBQCcp2fHQ1BeTb9ADDcQnerRsfAf2fmfAffK/:igh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484301, "uuid": "59da38d6-f3fb-45ab-937d-7870c20d6e3f", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484301, "uuid": "4d707d52-f67d-42be-9b71-819fd23bde61", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484301, "uuid": "10f11a33-07ba-445a-90e6-229b3900ca03", "value": "f2m9_Payment_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fa37d1-38aa-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635506430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506430, "uuid": "66d6dac4-2dad-42a2-80c8-d4d01a0ddde3", "comment": "Malware payload (AgentTesla)", "value": "0ba25a4eb4a2ef30c8a58232c4dcdb06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506430, "uuid": "7b6a9022-d0b8-4b83-a26e-bd541250b626", "comment": "Malware payload (AgentTesla)", "value": "1bfe1a1ab18340fc2d8db60dc0ee09ce05c6cebcc056b2cc0692ff315d3fb9ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506430, "uuid": "0ff47499-f3c1-4fe4-8c5a-6cd5ba39dfa7", "comment": "Malware payload (AgentTesla)", "value": "4486733ff6191f5e12bc39e7c3f4dcbebd0aac87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506430, "uuid": "5cd8d910-3691-4f8c-a90e-dd1d3416cd7d", "comment": "Malware payload (AgentTesla)", "value": "d2e82b3ad55569af3cec2660b5201f4d11aeb5c93d0b918975cbed48a9bcfa7e297d5b033bed5e5cbe0c68f52d839481", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506430, "uuid": "38e8817b-eb7d-46ec-bab8-054a55c5517f", "value": "T1B194F111A379CB6BE4AC47BC5093072517F298623321F7518FEA74DA1E77BC20E10AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506430, "uuid": "37645a05-579e-4330-9035-675114a580b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506430, "uuid": "415e94a7-a91c-40cd-9206-b352a9a4b3f5", "value": "12288:NlfZx3aBra+Qu0Q0/9K6dVADICOXirjaLH+duGjxQ:NlfZx35NcmADIZXirwedu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635506430, "uuid": "09bd9596-6b79-4228-9857-a0283948ad18", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635506430, "uuid": "c6fe4572-d534-4968-9f52-e5eb686dde9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506430, "uuid": "056a78a8-b66c-4f81-9f3e-8b692383411c", "value": "Details OF Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a4b53e-3888-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635491879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491879, "uuid": "65a9390b-92e1-434a-ab44-6252ab1f7619", "comment": "Malware payload (Mirai)", "value": "df1ed6e73703ce09673aa4525975d129", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491879, "uuid": "c2c11f22-3c2c-49a2-8360-c38023796785", "comment": "Malware payload (Mirai)", "value": "1d41b0a9c3b189c68bf219335a60f8156857fc6cef890e165e9ad2c48b15103a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491879, "uuid": "a9148a32-4dd8-47f0-9b5a-407899942174", "comment": "Malware payload (Mirai)", "value": "4b3444321f460d0ea48f4e96eb0ea45b27b885a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491879, "uuid": "32e298e5-e969-47e0-8886-11d4a686b441", "comment": "Malware payload (Mirai)", "value": "e4af2ba7c160b75d3fd18168c1419f0ec26f228510fbfa0a788cc68f47ac026f9cc207ea096a3f78aafbd4234c62c09c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491879, "uuid": "13c6f655-b0d1-4641-893d-3878774c49aa", "value": "T1B9230F0ABBB20FE3FD5FEDBB54942A41748D904721EC7A26F834C558B60A94B15E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491879, "uuid": "5c888c6d-907b-40ef-a7e3-91b398e1e0d5", "value": "768:n24VmMBIOoR7sYhz9ezjFFZ4GZJZTXiT+dQeEogrig0cH:PYhz98jnZ4yzy3rl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491879, "uuid": "7e89ea91-a132-4806-9677-2fb85cb3ff8f", "value": 48624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491879, "uuid": "1226976d-95e4-462b-a0f9-0653ccd1f070", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491879, "uuid": "07c89a5a-ca7b-49f9-80bb-93e348f3ff34", "value": "df1ed6e73703ce09673aa4525975d129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d29cf3-38d4-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635524382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524382, "uuid": "a6f2e48c-71f8-4371-bfe7-6c5e716bf943", "comment": "Malware payload (AsyncRAT)", "value": "a1fc890ea630be2c1efd80062ce12b18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524382, "uuid": "55ff6db0-a439-4c4c-9aee-7048b022380f", "comment": "Malware payload (AsyncRAT)", "value": "1dd6d37553168fa3929f5eaa5b2b0505aae5897809b532dd0b12eae8ffd8957f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524382, "uuid": "4a6983dc-fe90-4dcf-bb97-b37db4abea3c", "comment": "Malware payload (AsyncRAT)", "value": "cd076e4848b4bb197ebafd8e641f3c8b744ecae6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524382, "uuid": "42a8d8a2-9a03-4cbf-95c1-57756bf08b20", "comment": "Malware payload (AsyncRAT)", "value": "3fb81774245068029acac85d645efecc0f6048af2d719c809841fc4954d65aab9fae18b6e902563da6e4b93ff807e0f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524382, "uuid": "6dd284ee-8da5-4b3b-b180-cd98a4a06fb3", "value": "T16D231A003BE9812BF2BE4F78A9F26105867AF1677A02D94D1CC441D75723FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524382, "uuid": "192d6f0d-1c94-4c49-8a81-155a770b5085", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524382, "uuid": "77e7c97b-98e4-4927-853b-fd7431da540c", "value": "768:/uScq5TAYGTqWU8j+zmo2qL55/0tqjEPIazjb7gX3iRGlE33uOOQzxBDZnx:/uScq5TA5c2ONta3bEXS3uezPdnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635524382, "uuid": "366026d4-0f83-4b41-981f-3f2595dc85dd", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635524382, "uuid": "2d10b4e9-d27b-44a6-b26f-1b42b4bc540f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524382, "uuid": "52d02112-9703-42f9-84f8-ca76e8177aa7", "value": "a1fc890ea630be2c1efd80062ce12b18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e513923-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635530087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530087, "uuid": "46a25bfc-2c2f-43d0-bec1-d4742a2c6642", "comment": "Malware payload", "value": "801ec7d72a7d4d85a9527a827bc9863f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530087, "uuid": "e62fe4e8-988f-4d32-83d5-60447594baa9", "comment": "Malware payload", "value": "1ddd1d0fe22c23e07b5a521f781d026afda4a313f055e099762611b0d9053e0d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530087, "uuid": "b5f43a37-815c-413d-8e93-c67ca5325aaf", "comment": "Malware payload", "value": "7f0198aa7408c2cdba73c9bc1cafa5ec9507e568", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530087, "uuid": "b8337db5-de17-4c7d-84ee-a64a29f1cd7a", "comment": "Malware payload", "value": "348f8b230b8e1360574a0945d49f9926cef4ecb8f3e77c7139f54e85d8297d285d6085094a4e0dc4b5e7370d354292fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530087, "uuid": "8b74e89e-dd15-434e-8bdb-efa236f09cc0", "value": "T1DF7423059F801D87B5B4D697D05C0028FE11E2F4CF6AA466DC9299CC1EEF247ABC7E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530087, "uuid": "788b0425-c772-486f-aa8f-bd8887ae0c14", "value": "384:A/XvYVwIzLRw5JmPDwO7673PQPGPGPgPPKPd3JPgCaWKgkw/:/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530087, "uuid": "b8dc5f05-729b-4a76-a04f-9701f11fa60d", "value": 362748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530087, "uuid": "5d47eee8-640d-421a-9e00-cd950f7f0239", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530087, "uuid": "de4438b1-f838-41fa-b364-d09d52d9867a", "value": "alab_Payment_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b547aa-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635530171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530171, "uuid": "dcd677a7-e60a-4541-918b-81a2d909b129", "comment": "Malware payload (AgentTesla)", "value": "a33d4b1c0cfa2f784bc4d798211d81f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530171, "uuid": "a94c240c-bda7-4bed-9a63-68f8c6a45c26", "comment": "Malware payload (AgentTesla)", "value": "1e2d648b97d7834ddc4ff43052fe36f5eed1403a0aeab3a149bb188aec8286ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530171, "uuid": "11ff2500-71cf-4ad0-b41c-af4832bd4d08", "comment": "Malware payload (AgentTesla)", "value": "d510fe17f9ecee961ac5e9238e9379ea5666baaa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530171, "uuid": "dfdfb7e5-e871-4490-98e3-01e75f966fec", "comment": "Malware payload (AgentTesla)", "value": "79300ee65c1ce8c7baa460ec33d6c52631d4a958f7d65e0c9ee02ef33f9b4938fe3edf6ba7a84b16db4283cbe418d374", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530171, "uuid": "9ce059c9-4410-43ff-98b5-b4c36b3b68f9", "value": "T1BBF4D033AF85FDC9436E2D83E4091E541CB29B57C7A295CCFB80054364AEE2CDF695A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530171, "uuid": "cf623625-445f-48fe-896c-95c693c8cc54", "value": "12288:GPvlftyf/p6DzrO6W+0Tz1JPb6YXfm1l8KNCVf42/vaJIvOqq3rwczug/0wg:GPNlyfwDzrO3b7Tm12KNCFKCvObZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530171, "uuid": "ccd5b00c-293a-41fc-aaf2-0c1e5c20e241", "value": 766491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530171, "uuid": "b5043dc8-7341-4fde-880f-88c76323f4a5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530171, "uuid": "34625c83-35cd-485e-a355-02e6411795c6", "value": "CIF ORDER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48343456-38ac-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635507313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507313, "uuid": "3913985b-2cfc-4373-be0c-48f790e99e4e", "comment": "Malware payload", "value": "6e5b8b68299491f42be00e87372bcbb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507313, "uuid": "55ee5f11-fcdb-4a50-a668-148533e11ff1", "comment": "Malware payload", "value": "1e9ad31f48be6c882810fc2f05c15e6ae3e11d1383911e5674d2d73235972b99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507313, "uuid": "440fcc58-a263-42c1-b740-16aa0054e27e", "comment": "Malware payload", "value": "e75e75b176068ee9a71f7873967aa358c07730f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507313, "uuid": "05b1e28b-9202-4e0a-9ebf-d4862b423796", "comment": "Malware payload", "value": "3fc1af02ba555105553a0d36c4466736d948137c1f576cda08ed2f705e73220fc9d96b1a62924076d8d8244116a2196c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507313, "uuid": "533db033-4c2c-49fa-83fc-eb77cb7e2f49", "value": "T1EB06338D1F29E8DEE446D3B05BCF61DB5E632ED6DEC0D309E951686C0CA6C078BA65C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507313, "uuid": "47060695-c20a-46b4-91e7-b3f5c53398f0", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507313, "uuid": "aa43158e-1143-42a9-9886-d1960f172c39", "value": "49152:+PEY24Pb/HzYhkfcDb/+samlHDhRv64WP9zhwSBaEi8rK8kMPdO9Ljcm/EWTT:+PEGTTviF5pDu4WPlJk+eMPdOljc6EW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635507313, "uuid": "22b58dc1-9507-4ee9-b3fc-f5944b99da1c", "value": 3673600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635507313, "uuid": "95c4b796-3f09-4149-af4f-71e2ce969c22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507313, "uuid": "aa2a9b98-5845-4941-a175-e4c8d4970520", "value": "6e5b8b68299491f42be00e87372bcbb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fb6d1a-38e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635533803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533803, "uuid": "099ff8d4-cecf-4edd-91af-ae88288aaffc", "comment": "Malware payload", "value": "1960c94cc1339a2abd841a7d97f1274c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533803, "uuid": "e33afa01-68fa-44d7-9fe9-a834040c6f17", "comment": "Malware payload", "value": "203db26c279146b77bb3bbef9fc52fc75027d9ff3bff76be590cb1e92c85490f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533803, "uuid": "47bcb6d1-3781-403d-be40-41417a9db395", "comment": "Malware payload", "value": "b0150d1a71d245d58b7a630128e87dcbff61a72e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533803, "uuid": "16c0ca9c-41ee-4e67-ace2-877cafb08143", "comment": "Malware payload", "value": "c35742ed22d018f271735b7ca117509105020e97880221a2069ffe226f0fa8a0a83ecc262fb3ee6903990746fba1a994", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533803, "uuid": "db137499-bf1c-4172-94a1-94d0d50bf72e", "value": "T1E525E70AB799BFDBD11EAF38891F4D2883F581233231F6AB69C546D54159F888F1F062", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533803, "uuid": "a8686209-8948-47d9-b94d-a87732ca0da7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533803, "uuid": "caa1e502-6f37-4921-a121-32df2a1e1202", "value": "12288:sk6sJbgIU7FYska8+Dm3zNSONxlbLpCXrmKsr3S5NTA7CJVBjSerMTPluQ4f+y:sk6GbgDVGym3VaSC5dAMP6TPlcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533803, "uuid": "58b8ff2a-f617-49b4-a9ec-5c08c2e78d5b", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533803, "uuid": "f5b604bf-3024-450f-b2a5-9b64f0aa798c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533803, "uuid": "5a30477d-2871-417b-af8b-ed04ca1e0f9e", "value": "1960c94cc1339a2abd841a7d97f1274c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4600f56-38a6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635504972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504972, "uuid": "b8741620-d711-42fb-b56c-67b356a7032c", "comment": "Malware payload (AgentTesla)", "value": "d2a0b24c508367a3fc3b5125971a84cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504972, "uuid": "00b5baa2-7e84-4c03-b082-6d385a5768eb", "comment": "Malware payload (AgentTesla)", "value": "20f78ac002f9947ee813001e4dd6a2adac6f0cd06075fad4e050424910586233", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504972, "uuid": "461d151a-82e1-4053-872b-b2dcf5ecd78c", "comment": "Malware payload (AgentTesla)", "value": "11088d715cbe1ba8e237663830f5e303929666fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504972, "uuid": "555bc113-8a9a-439d-aa64-a45cb843d402", "comment": "Malware payload (AgentTesla)", "value": "52e86e6c5c1332601bba384df44c88535c189d040c8a7e9c4f286ef6f9e1a2543916d8023802c5b6d87f038c7e0a009d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504972, "uuid": "a98912f8-7d0e-48e3-81ea-7ab2324becf9", "value": "T17DE4BF327283AED5EABE4FB04F6612601EF57C3B9AF8C30DAD49311617F3610D81965A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504972, "uuid": "31cc184d-1a3b-47d2-b3cc-afa1dbed8713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504972, "uuid": "8f438ed1-d708-435b-babf-ba04029072f3", "value": "12288:BXefcqJFTPe3nyZSaVD46m7+UiDKCvCE9TvCZzfuocCdQVYJUEKl75jQWmc:BXeUqC3ngb3mqDKZcKZzfunC2VYJUEKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635504972, "uuid": "9aa28f08-97d4-4c50-bba1-1d4251c1c034", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635504972, "uuid": "15b744a2-46f5-4c7b-868b-82d7711ca407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504972, "uuid": "1284afa6-7bcb-40f5-9da5-d2e636bed21d", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a56280f-388d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635493922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635493922, "uuid": "42552264-096e-494d-b07f-60dd735295ad", "comment": "Malware payload (AgentTesla)", "value": "e97c69540adc456f440cc0114355f013", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635493922, "uuid": "09d5e289-638f-4558-8b83-665d8e68d423", "comment": "Malware payload (AgentTesla)", "value": "21b4695c83a77a47769394061187e39beadeaab63058552bccdf7eba3d7ee019", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635493922, "uuid": "fb5e9dcb-80ef-41ea-a453-bffe37cbf8e3", "comment": "Malware payload (AgentTesla)", "value": "d4ea6f5307db0b8d6d77f4001abf34e9f8f54773", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635493922, "uuid": "068bd20d-8619-40eb-b9e6-bb225dc76fee", "comment": "Malware payload (AgentTesla)", "value": "4cdd635d7d13c1488713c00676e5e68a66f91999e0a2e396879f38dc37022f14eae15d64f68fa53632223ed3415b3f11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635493922, "uuid": "130fb281-9a33-47c3-9277-9c368eabd4d0", "value": "T13584238AC59E89F0F3AD5995B630ACFE992CE4044734E32A67DA22C317F81D8C05F5A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635493922, "uuid": "e8f99f58-0a5e-42db-88d7-7d403bcffb39", "value": "6144:etfbATB9sZM4LiJK3P9rmhrBXlLwCcQMyCgDdBPKGV2pZfRnJPlJtmGChPNlw/CW:epEd954L6ThrU6bx2pZ9JPlJxqg/CYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635493922, "uuid": "776af8ea-6a59-4b02-83f3-8a91eb2832be", "value": 395806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635493922, "uuid": "3ee4e666-bfbc-4073-98b1-ac8616a0a681", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635493922, "uuid": "9c9f67c7-8d5b-4e47-aad3-dcc2fc6bf6c1", "value": "#102STATEMENTS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2e9d48-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485580, "uuid": "adfa56f2-217b-4929-923c-eade6581d595", "comment": "Malware payload (RaccoonStealer)", "value": "af017912cacc3feed7b51bc683eb4e6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485580, "uuid": "7e1bddc9-5c5d-4254-8774-418523cb7906", "comment": "Malware payload (RaccoonStealer)", "value": "21bbaa87c03c30215b45e0886639f3861608f8a78621570e57c8826973e298c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485580, "uuid": "b572c2b2-3e3d-4d27-ba4d-51e52b0ddcba", "comment": "Malware payload (RaccoonStealer)", "value": "00d97f6eeeb6e70791a7e5d4806354fcaf0a97c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485580, "uuid": "fefeefe4-c568-451d-a0c3-e55077347f10", "comment": "Malware payload (RaccoonStealer)", "value": "710e70eca9d212f9fe3acbb298b9bef9e24a04b870f989e0f65acc080e66b3bef34b8a53bb0c8cde50249c24dc7aa0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485580, "uuid": "23670686-d3c7-4e8c-93b5-bd7c55a47b50", "value": "T18A749D10B6A1C035F5F212F859B69369B93F7AB16B3890CF12D516EE4A74AE0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485580, "uuid": "c83543f9-9dfc-44be-96b2-8099ec267bae", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485580, "uuid": "afc41d7f-1846-4591-bc48-e71fe89f5583", "value": "6144:YZUNQpq1+i+FLYTblXFvUx6wb5H2lXj4H:Y+6pqtwLYXlXFvU4wbGX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485580, "uuid": "727a4c19-f019-4f20-a3bb-9c01e15b9b2c", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485580, "uuid": "0e29bdd9-9748-499e-aaf5-fb8731a212ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485580, "uuid": "6e27f274-0712-4246-aa20-fc02f2f0603a", "value": "af017912cacc3feed7b51bc683eb4e6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e933191-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635494761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494761, "uuid": "763e0d3f-7422-4c56-a9cf-b78e3f98d236", "comment": "Malware payload (RemcosRAT)", "value": "ce7ffd5cf4dd8ecb462720c2e806bbf5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494761, "uuid": "52adddef-3ab3-4ffa-9ae8-7c33b5b2c71c", "comment": "Malware payload (RemcosRAT)", "value": "21bbe2b9f2021766070094d35c12fee35bc4ab339f957fa7212a681baca56d32", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494761, "uuid": "12edca66-a211-4e59-8ad9-9ff954e2211a", "comment": "Malware payload (RemcosRAT)", "value": "8734989ea20502650362dfb7379cb43773c81f27", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494761, "uuid": "ac5e8c01-abd8-4196-a234-a4595b219e16", "comment": "Malware payload (RemcosRAT)", "value": "ecf650e121dd9d00ea91d294ddf1378ef3d26726dd7bb8f4f5942b217c80d5518a1c86a3c1bd4a17da3a6b4970f8454a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494761, "uuid": "2f13d01e-8783-4e9c-baef-2bcd1c4079f7", "value": "T1D4F4089C3EA12B7AED0ED1B26011D969BB570F037A509AB307CB35C6974E07B2CA4CD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494761, "uuid": "4e00e5b1-8ab4-496c-bbce-313d6248eb4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494761, "uuid": "aa8d9536-6e37-4351-b6cf-7b984c405139", "value": "12288:JpxOYGiPs87LOn5LbnvN5TgiCIComSLPLZ6AG0vYJG6LCsZ:Txja5/v3TgpDomGP1C0gVu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494761, "uuid": "12e025c3-a1f1-475d-a2d0-a453eee6d08e", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494761, "uuid": "4085803f-73fd-4fcd-9a8d-3b7d5bc69471", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494761, "uuid": "a63a0fd5-11a1-433c-a44c-bab16bcf4b29", "value": "Dhl Waybill Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec064ab0-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635530352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530352, "uuid": "690b8b9a-cc39-4150-918c-79ca4d9b7b6b", "comment": "Malware payload", "value": "daf5109871999a1af06107fcc30bd1b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530352, "uuid": "c2490173-b47b-4fb2-b1db-cafc140e88c9", "comment": "Malware payload", "value": "25ee28f218596b74927a206d895c42733afdfe5d1520f8c6cad7a5933381929b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530352, "uuid": "028cf4f9-6dd4-47e2-9c3e-5ffc62181860", "comment": "Malware payload", "value": "ac779b0be0f8f3a19a6d68e24f3d8021d85bc711", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530352, "uuid": "c2ce210a-5fb8-455d-8fd0-c79e661fe557", "comment": "Malware payload", "value": "f4c77052a587a9d27dee6b23a4b2c47c56ddde50822a5afe435017af243fcd812b3f5d2f6dde9f78e6732b7e95820a78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530352, "uuid": "a0600d44-f826-4791-9ea7-096e2b6e4e31", "value": "T16AD2D020E9982F6FDFFBE5A01DE0DB8173D21BDEBB57C91070461E11A024D9B76849CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530352, "uuid": "9fd2630a-239a-4ae4-add8-8f4f427395ae", "value": "768:2nRcLE3+nauwBr8BPZ96IaWAUzMtYd4ii64uVcqgw093R:oaY3+najr4B96+P4K4u+qgw09B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530352, "uuid": "932e8039-7bfa-4fcc-9b62-cb010abcad9d", "value": 29804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530352, "uuid": "9896a587-4399-4d3c-89a9-9a14a4bd228d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530352, "uuid": "7015b190-272f-434b-a2b0-757473c69419", "value": "daf5109871999a1af06107fcc30bd1b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0b02ee-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635484290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484290, "uuid": "b9af60e9-5172-426b-82c9-e2c6720a0df9", "comment": "Malware payload (Vjw0rm)", "value": "141b981a8468e109d39c54a3a425ff66", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484290, "uuid": "599815f6-7e2d-4680-b25f-e13b9ae7a50d", "comment": "Malware payload (Vjw0rm)", "value": "25fa1b8dca724a1c9e059e76ae2654ad249242f8b8c82358b4041061028bc80d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484290, "uuid": "e631ab15-a1a1-4509-9cb8-8c8b7c9845eb", "comment": "Malware payload (Vjw0rm)", "value": "92878aa2adea4c26dc639e60a3d9c0f76e536407", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484290, "uuid": "46232f92-e017-4fa7-95f7-4a7635a6a688", "comment": "Malware payload (Vjw0rm)", "value": "12608e57912057c59908e7dad49041bcaa51fee359e2df9f55efa3058894bff2b54f40a5cb3a2797e1314287f870cd5d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484290, "uuid": "6ebdfd40-5adf-4c54-98dc-562994cbe546", "value": "T14083D7419F421C87B6B8D69350AD0025CE5CE2F8CF6AA49AD341F9CC0EEF2476793E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484290, "uuid": "822fbbda-4220-4a2c-b580-54579374c186", "value": "384:gPnPI1gYzbBg55m/3guL67X/g/W/W/w//a/t3J/QSOm6wUgf:Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484290, "uuid": "0ed3b48c-7d63-4db4-9b8b-9f321cd9f51c", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484290, "uuid": "75547c79-e5a3-42f3-a508-c7083c558613", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484290, "uuid": "a0f9329a-cf0a-4f0c-9e72-155296349e1d", "value": "v1m5_Payment_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2432ae34-38ce-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635521856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521856, "uuid": "a61dd1e2-d652-4175-b819-0253eb77dfe7", "comment": "Malware payload (NanoCore)", "value": "00d8921a30d82b0b25d66fd146839f77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521856, "uuid": "87a571a8-7838-434d-92f7-f4ade004f7e6", "comment": "Malware payload (NanoCore)", "value": "2605a1cb2b510612119fdb0e62b543d035ad4f3c873d0f5a7aa3291968c50bc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521856, "uuid": "52ba2526-d5d5-4149-bba6-1afefed3faff", "comment": "Malware payload (NanoCore)", "value": "b6cf72aeb65430bc75cdabfb8798897462881d83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521856, "uuid": "bc4ee9cb-94d3-47d5-a3de-f6138f726eba", "comment": "Malware payload (NanoCore)", "value": "eabe9e86d02781284df604ee8ef564f4c5d65569cd6585859f3dee5df8219bd8963358d04d67d235cd732d02c7946116", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521856, "uuid": "1a92ab3b-2d6d-4f0b-8641-bfa08cb6a1e7", "value": "T17A14CF6637A88A2FE2DE8679711202429378C2E7D8D3F3DE28D455F64F667E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521856, "uuid": "8c083f65-a65c-4909-8628-347821d1837b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521856, "uuid": "4cb4a127-373f-4aaa-93a4-675e6798e718", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIIUhv3cnQBpRc0vcGW9TMxRCwS:wLV6Bta6dtJmakIM54sQT5yqRC9OC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635521856, "uuid": "247111f8-de1a-4a18-bc24-dc4e874d7536", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635521856, "uuid": "37310b89-6614-4076-a246-3649104b7101", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521856, "uuid": "0f4ce222-3b43-48e8-9b00-aa2ee6f16b1c", "value": "00d8921a30d82b0b25d66fd146839f77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87306c0-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484389, "uuid": "da469e42-bc4d-4ac9-8a6b-8012673fb788", "comment": "Malware payload", "value": "6b2308c7ab3f9ea726ed64279c2295fe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484389, "uuid": "c4a6be77-fede-4ac7-a7a5-8593d2a13a3b", "comment": "Malware payload", "value": "2653950daf75294569eff0de5a2c8bfc8612bd4f39795485202b70f748a7d2c6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484389, "uuid": "97920cd1-9860-4875-8cf8-4ced10358265", "comment": "Malware payload", "value": "ed1fcd3c6ce1ea2113d9a2929de7cc927f93b178", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484389, "uuid": "868b6657-d2df-4f10-b5d4-5c99dccd65d8", "comment": "Malware payload", "value": "e720804562878789253888091740a7d7cbc544a9d34035e59e495fcb640a391a28447dbacea3d079c72ee69f911d09df", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484389, "uuid": "1fcde806-4d1f-4fb2-887d-ccae77c7d668", "value": "T115D42392B1D4DFDBE41B6A391CC3D09C7E18FC889E6DD20B3A45BB5F4EB97258102819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484389, "uuid": "1541870c-4585-4644-9194-cb0cc752b453", "value": "12288:DbqTtukI4DLk+N76BI7G+eDYYQgc6gID6ijVAm5vbZ82NHKLtO2:XmukI6Y+N7uDgl6gI9VAm5vzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484389, "uuid": "898eae3d-7507-470f-bc66-290fcfb82a56", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484389, "uuid": "345a33c3-3f1e-48b0-af81-3ce91fdb69bf", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484389, "uuid": "04a62044-64a3-4a38-8bb9-16f49740b1cc", "value": "Product_Specifications_Details_207106511_RFQ (1).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d9aa01-3874-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1635483503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483503, "uuid": "44b5f6d1-5146-4d63-9418-001612f1b1ea", "comment": "Malware payload (CoinMiner)", "value": "29886964ea10f89ee4140010fcd25963", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483503, "uuid": "be6b464d-59ea-4ef2-a86c-63c37599b9f8", "comment": "Malware payload (CoinMiner)", "value": "26735f64b1bf3afd403ca4661dd9f3499518c642225ab686612c56bbc3ca459b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483503, "uuid": "4910a912-b1b2-4a37-aa05-044dc86b3827", "comment": "Malware payload (CoinMiner)", "value": "bfbdab0bdf4865ab763ea720e279e8cac77be945", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483503, "uuid": "cb89f92a-670d-422c-9f0e-6475debc4775", "comment": "Malware payload (CoinMiner)", "value": "1c6f01d2c29e3a7064dbae4a29f1f9d7e9d09edc1907d4fb72ffe87d4952104b20b3896df87e219f2e310d20f68012f5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483503, "uuid": "d855f1ae-fe9f-4ac4-b3f3-20fc36eee833", "value": "T17A63021261EAC1F6D17A44FBBC3045D42320BBD09A45862FA3A87FF6CE1248579B518F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483503, "uuid": "1110288b-2446-4edd-bc3c-205e891cf7fb", "value": "27516fd8750f40bdecf52a1420a0296a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483503, "uuid": "92eb8558-e5a5-484e-834e-c333ce1ed38b", "value": "1536:mqtsXIW70EQoiPQ1vO3BK1xGdjDzQ7nGtTdS:mqsI3EQoiPYGUx+jXSnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483503, "uuid": "84064f2c-8f67-4bd6-a914-84154e438675", "value": 67926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483503, "uuid": "d33a6d18-aa22-4baf-8e82-b7d35370f714", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483503, "uuid": "28d67ba5-7542-4bd9-ac7d-f21750f8bde2", "value": "29886964ea10f89ee4140010fcd25963.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a8b5a4-3889-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635492252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492252, "uuid": "75436ba1-2905-49b5-b080-ac16b707aad7", "comment": "Malware payload (AgentTesla)", "value": "07748ebd1bda591e66017f56de3d2214", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492252, "uuid": "1a47ee8d-3e69-429c-80fa-c7e920b3d920", "comment": "Malware payload (AgentTesla)", "value": "26aba98eef96fdd76e1f5edb1e1da4d3b7b6932cf86db3c57b1d604e14d622dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492252, "uuid": "576359f7-adb4-4a7d-8170-58843b3996b0", "comment": "Malware payload (AgentTesla)", "value": "0a915906fdd5ad1d50eb2be745e8834f5b03d0cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492252, "uuid": "b4b327d2-7309-4f16-9bd2-05883348047e", "comment": "Malware payload (AgentTesla)", "value": "71178c2addc5e8cdc64d38dbd5a452d474d22588af6403eb987cdc6d5dd7a85ed0116588f22a11371f7be273d0fee141", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492252, "uuid": "6ba45bf5-4a40-41c4-af53-c1053466bbdb", "value": "T14EA469E1349CCC9DE78E07380DB9A97B61A50C786960C50EFE54FA69FBF7AB11C81241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492252, "uuid": "7ca1d079-a3d2-4fac-baf1-9db3426c2a52", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492252, "uuid": "daaf8f6f-751f-4c20-a9fb-ce5ff9961d62", "value": "6144:HBlL/5IZkqI5YCTZcFkG32KMPaIcOY8JNX+TQn1Iv7n:hYY5YC1xG32KMXcOYQiA1IvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635492252, "uuid": "deaf6b2c-59a2-42b0-bdeb-7225844dff59", "value": 468974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635492252, "uuid": "5365ae56-29c6-4f9d-83e9-2f5853d1ec78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492252, "uuid": "4f249540-f068-43ca-b258-1b71b921175d", "value": "FB-108N & FB-108NK \u8a62\u50f9 - \u7530\u52e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad60163a-38c5-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635518221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635518221, "uuid": "1e4fbee8-0bb2-465f-934f-1dd2c541505a", "comment": "Malware payload (RaccoonStealer)", "value": "82a9b7ddd0634337aa591a0fb27544af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635518221, "uuid": "58938790-5708-43ce-82d4-d73aaa5f3a72", "comment": "Malware payload (RaccoonStealer)", "value": "279239c5221fa485655f1963010c98259a4ceaa95a3ffec454d514948fa8dcb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635518221, "uuid": "0485d052-c5c3-4f87-a617-5290f650b60a", "comment": "Malware payload (RaccoonStealer)", "value": "5c2d6ddca933570253c0ed24cc183d6251570912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635518221, "uuid": "8513c224-575f-4257-a438-043ea2207c97", "comment": "Malware payload (RaccoonStealer)", "value": "9a6e2ab0657fea0b9d8b10d2aa869902240714b727b0adb74ed7036724e48836db01b7e5132891fc569a14acd100b743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635518221, "uuid": "682248cc-d3c0-4935-a0c2-666e08859005", "value": "T1BFD4E100B6A1C034F1F212F85A7A9369B53E7AA1A77494CF13D91AEE4674AE1FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635518221, "uuid": "e218d496-80a9-46af-8bba-e3c8fce6147b", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635518221, "uuid": "fda45480-94b8-4213-9e42-bf10c0642062", "value": "12288:ZGxI2wCBJUM6NqaxCyrmk1RlVJYveqgg4Q2K+6:g5wCPUMaqaUyzBG202", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635518221, "uuid": "b2e3c3b2-66f4-424c-92cf-9fe482f0e799", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635518221, "uuid": "b7f6b309-34d0-4fa2-b950-f4480826de53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635518221, "uuid": "7931d399-f126-4aba-8d38-2a6204e99825", "value": "82a9b7ddd0634337aa591a0fb27544af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4062ecfb-38c2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635516749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516749, "uuid": "f5c8809c-07ee-4939-988f-d68f64b710be", "comment": "Malware payload (RedLineStealer)", "value": "15bbb32f6336bc6dbf411dd4fc6a95d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516749, "uuid": "97551d00-e553-43e3-84a4-0ae61ab0b84d", "comment": "Malware payload (RedLineStealer)", "value": "27df3f983fa82f3f61f8d5ad0fd382eaa9fc47ed2d37dfa4227817890f19787d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516749, "uuid": "8a0fc1ad-aa23-4d07-9018-9ea4fddbc992", "comment": "Malware payload (RedLineStealer)", "value": "28430c3b7bb49a636e65f664ad40dccbc7723878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516749, "uuid": "51d728ff-4fa5-4a23-be33-c6622b53257d", "comment": "Malware payload (RedLineStealer)", "value": "142e755110055249fb26ffc450a53ffc99bcf1d4aecdde5bfe32a57e3dc42741d1a4aa75c51dc604261ab8a5b29ecf30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516749, "uuid": "c0392f9c-cf19-4912-ab22-dfe4101a3dea", "value": "T13616232322B6016AF2F2CE399427BDE172F313674B42FC7976E57AC818255A1E207D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516749, "uuid": "bfec26bc-b0f1-4087-a00f-6571c6967baa", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516749, "uuid": "335a5e4c-a946-45ee-b828-c1c8a5d2ef14", "value": "98304:uxmC6r9RQJe3hAbxSCjmq3wS9GDO0noyWi:9VpRBabxS8H4ZnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635516749, "uuid": "45c9445a-5895-46b7-b964-07f403d6f5d1", "value": 4313088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635516749, "uuid": "1fb49eb3-8052-465b-b8b4-4adacfff846b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516749, "uuid": "5b49304b-6741-4e6c-8a9e-c5e896d776b4", "value": "Unicore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322df717-38f9-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635540348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540348, "uuid": "51fb3772-5384-49a0-9fe3-b179c0390734", "comment": "Malware payload (RaccoonStealer)", "value": "40bdf2bc53fcfa03c8b0312a13e52776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540348, "uuid": "ea4f0a0b-4df3-477e-90bc-24f21ee52008", "comment": "Malware payload (RaccoonStealer)", "value": "27f4d3cf0e58c693683b238df8b9e83e7d4545ab63012f874b614f7ddb117700", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540348, "uuid": "c9422fd6-aad9-40fc-a897-80fae80dd030", "comment": "Malware payload (RaccoonStealer)", "value": "ffc3292f528af3930de8d78bd4a60a74a51ad624", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540348, "uuid": "3ca8f600-42f5-4565-a4ae-817e5c485970", "comment": "Malware payload (RaccoonStealer)", "value": "e8a2307bff8a68c57ca661e8403cb52138fe82fd7404ad65b6e07d2631ee3412c509b2ab7f39eda4feee350d12492b59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540348, "uuid": "4d87be2a-a1b0-4bcf-9eda-49121d34309b", "value": "T1E7D4E010A6A1C034F4F612F84ABA9368753F79A1A73854CF17DA16EA4B74AE0FD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540348, "uuid": "6fbb9167-c035-4a20-92c0-f56fb04758c8", "value": "518d84bc9a231f5bb2827b0550b9f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540348, "uuid": "9d15ec42-63e2-4093-a7f4-3a2fcf4c18eb", "value": "12288:MVjzFhLjWIWKW7nFHgxSU3SkHKQ1MAuVt/vWSxWkoZPXl:oj5hLCIWJ7nduh3/KQ1lu/NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635540348, "uuid": "079b4e31-65d1-4653-8f47-e37ee6e1ee08", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635540348, "uuid": "f49dce2c-38b8-40a8-a6a9-bb8fd18e6999", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540348, "uuid": "1f9649d2-3799-462c-adbe-18af8967067c", "value": "40bdf2bc53fcfa03c8b0312a13e52776.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d546f8a-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635485552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485552, "uuid": "9fbf6eb5-fe1e-4e03-98a0-270c3e525046", "comment": "Malware payload (AgentTesla)", "value": "ecc0db88c91ffe969ab55ca20cd27d9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485552, "uuid": "b3419262-3b10-4a4c-bea3-90ed6b69821d", "comment": "Malware payload (AgentTesla)", "value": "282644fce03c9e5414f047c286bc94187bdbc21fd50819092a477b9bfe629c7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485552, "uuid": "e4d6245c-f6a0-448d-bc57-a04fd39e4021", "comment": "Malware payload (AgentTesla)", "value": "5409366840674617893cca024df155fee50f8c87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485552, "uuid": "9e77747c-692e-4f67-a5b4-f68f4bee984c", "comment": "Malware payload (AgentTesla)", "value": "6e33c2952b116580b92070fbc36c1aca85022edfa4d32659e9dbe4ee28a5d75b57655dabbc916d7457314b3575d102dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485552, "uuid": "643caddf-5368-459d-8158-b8036006720a", "value": "T1EE45CE0B725CB79ED15A8F36B4751D309660AFA31302D603B5DBED9D4A2E3CD9E006E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485552, "uuid": "71643cfa-e716-42ab-8cab-cbae47af58d5", "value": "12288:UKjiYQsG6Im6hPGfhBZpN9TcHn+2CPyZgTrqC+xog6fnjqJ20:Xj5GxpkBZP9Tce1Kgd+xog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485552, "uuid": "14cf511b-5449-4771-a7dc-c46506e5d837", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485552, "uuid": "4c4785f5-01f2-4aae-8544-639d89eb0114", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485552, "uuid": "2571c333-80b0-4f8a-8197-9391613cef36", "value": "Order_Specification_10282021.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccc981a-38d6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635525575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525575, "uuid": "a8b03e24-2641-4311-8efe-0aaae3f553d0", "comment": "Malware payload", "value": "41c1dd1d0d6399e9eb4284edddf8d854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525575, "uuid": "f45651da-089d-4dca-aab8-ed55a09c7526", "comment": "Malware payload", "value": "28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525575, "uuid": "1ed9c053-7843-4239-83cb-ea882e287ab8", "comment": "Malware payload", "value": "69e38a7a4928b34919ec793b48b9bc2d86267b23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525575, "uuid": "e3ae4849-2042-43e2-a1c2-7f4f9edc8302", "comment": "Malware payload", "value": "e010b5d036b03ff1b43031f9d12ac2d254915e3f6717b237b3b2fe95b3f738989e326d04211a4da1aeb17de37b5e9543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525575, "uuid": "e5bba391-dae1-4765-b141-a49ff1c7bfc0", "value": "T1E5B40118B748602FCD9DDE3785057730A26FC5C6BD1B8B162DAE5C2B2C71283495EB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525575, "uuid": "61ac9f2c-87fe-4995-b735-22140d142f6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525575, "uuid": "19e1117f-28b4-4a89-a756-c87c0d37bcae", "value": "12288:Ow86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+8+:OVhdLVg2Zep7njXzPDxC+8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635525575, "uuid": "9e1cd0dc-a117-4a11-8821-2debf4c512be", "value": 518584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635525575, "uuid": "8bc6c9bb-cd6a-4cac-8898-aba1a300c614", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525575, "uuid": "c58a6901-0bd5-4467-a920-2488068ddeec", "value": "bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653b21ae-390b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635548164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548164, "uuid": "32d94c3e-c4a8-4c10-b2dd-134c4520d235", "comment": "Malware payload (RaccoonStealer)", "value": "6582b80f6e3888ce81385fd307188df7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548164, "uuid": "14d26d56-c2e2-4751-8c3c-be0ff482bb68", "comment": "Malware payload (RaccoonStealer)", "value": "289d70994ac2acc5fac5a93bea096b3f9347d9cbff4d861b0af04a59b408c42c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548164, "uuid": "49a2fe14-359e-4b18-ac7e-c94ae112a804", "comment": "Malware payload (RaccoonStealer)", "value": "6debd7da02a48938e982ebc27ca0957fe6708242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548164, "uuid": "c503e33f-630b-4b1e-b546-a5661459af05", "comment": "Malware payload (RaccoonStealer)", "value": "0e9c57feeb2ed694ad7940465c938db66c4a3b3bfe1f90b71e3999305c9118bdc4d98cdbc5845bd4f49377da46fd3fcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548164, "uuid": "b46c134a-fd24-421b-95a3-0585153cb0ef", "value": "T172049D743298CC71F5577532C8608EA15A3AFC62A974858B3BD4262D1FB0ECC4AF539E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548164, "uuid": "b1f7f8af-677b-419a-813b-a43bd439d2d9", "value": "c698dff9877941757d23fcd110965bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548164, "uuid": "11b8bd03-0295-40ec-aab5-63d34e0faece", "value": "3072:RtvDfK0h+7R4VJRlmFsC5bBNmByBP2pVZLlWrxpzbgqru:rvDthW4TRo/nAJuzbgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635548164, "uuid": "b9a0003e-319f-48fe-be5b-13c006e215f5", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635548164, "uuid": "82cc6e67-56bb-4415-9ed9-f225a892c50d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548164, "uuid": "a3c5b639-7c40-4263-80e5-3207a508c48d", "value": "6582b80f6e3888ce81385fd307188df7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab4dd51-3889-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635492500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492500, "uuid": "7f84ec82-f7cc-44e3-8b91-9380cfe8a84d", "comment": "Malware payload (Formbook)", "value": "026df37a937471af093a3e8bc8636b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492500, "uuid": "b4c3b812-d52b-4fc9-9956-fba77be73675", "comment": "Malware payload (Formbook)", "value": "28b77890ae9535db2da6bf03e7c41471d173b86fa67b907dafa38aede34fc148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492500, "uuid": "39ecd373-4070-4199-ba1b-8d406bf5acb1", "comment": "Malware payload (Formbook)", "value": "57d0b25b3dd1d648c710c3ff5e44041d39d0cafc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635492500, "uuid": "cad607c7-d714-43cc-b1bb-9899c233d3d0", "comment": "Malware payload (Formbook)", "value": "811af8e181b1c5d4a2f2d59683d9332d7b09be40fa79f0046a9be2b82a0fecf84ec9519e366895611bd9b8a6d6393e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492500, "uuid": "b74f5602-d346-437a-b43d-e612f13523c7", "value": "T1B884F298A379D7AEE17C07BC44A3151457F6A8233262FB524FDA34CA1D33B824D15AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492500, "uuid": "7d8e7ede-679b-4d6f-91ae-44d6a9cbf1f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492500, "uuid": "21c53fd1-f2f3-4b62-acb1-c92957b3af25", "value": "6144:plfZxxcH614b47d6f4Gz4K6HCFWZ1BVAHEyf7aqzQlL5l/cvdugjpkUAcifxYl9c:plfZxSKBXyf7awQljEdugjYJmcvkDpjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635492500, "uuid": "27cd7b6a-85d6-420a-b052-3b402f3b79b9", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635492500, "uuid": "08d7194f-be41-4ada-81ac-4b7ee88c5730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635492500, "uuid": "7257c8c9-8a1f-40b1-9a56-861322fe7ba5", "value": "PO_#10292132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deb1aa7-38d4-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635524395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524395, "uuid": "a6062321-2834-4601-8a12-d86755cac4fe", "comment": "Malware payload (NanoCore)", "value": "524b7776639249ac57f6575cc4f05ab1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524395, "uuid": "4368b1d0-fdca-430f-9a77-0679261d1e73", "comment": "Malware payload (NanoCore)", "value": "28ef1f6f0d8350a3fda0f604089288233d169946fca868c074fc16541b140055", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524395, "uuid": "846831f3-8924-4fde-8956-b42fd70893cd", "comment": "Malware payload (NanoCore)", "value": "f0b440d893d1ca3fb144fa5846c12dbae614c8b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524395, "uuid": "e1da917a-9e66-4a3e-8fa3-22d91761f5c4", "comment": "Malware payload (NanoCore)", "value": "c3e1b0acbdad8228e361fa36332d4f2e4d968155125b1bc7317666dbdc7947e4eb6374bdaa1c1012821bd32ee25b0fea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524395, "uuid": "cd3d64c7-db23-4aaa-bf22-91832df9255c", "value": "T13714CF567BA88A3FE2DE8679601215129379C2E3A8C3F3DF28D415B25B667E04A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524395, "uuid": "fe247e30-1d77-4f7f-a138-10768431ed4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524395, "uuid": "119bc5c0-f497-47c7-adf6-983f02ce7440", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIfTIE8nA2VErmL4llWrg1933si:QLV6Bta6dtJmakIM5vEYA2VcmL4lQ0si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635524395, "uuid": "9fea58d9-2115-47e1-957f-f4432e3c8563", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635524395, "uuid": "9e0b269d-8af6-4c36-bed0-a94d69068f9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524395, "uuid": "92d15a1d-fa3c-42c5-a3c5-5d098a9f7e90", "value": "524b7776639249ac57f6575cc4f05ab1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5894efb1-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635530104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530104, "uuid": "b5ddb85c-bf1a-4df8-af3a-1e7dff955109", "comment": "Malware payload (Vjw0rm)", "value": "a1a3e5dae77dc6f0583baa8aba265e15", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530104, "uuid": "15d8de75-9fd8-4c33-a05a-79ae5c69af6a", "comment": "Malware payload (Vjw0rm)", "value": "293873306a36a941044538e83294552b6bb9ec7519be1c3d0f022b7e1eac204a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530104, "uuid": "ea55aaf1-6449-4554-8be0-d445a2490800", "comment": "Malware payload (Vjw0rm)", "value": "336a077a4bb9bd5256326d8499da778fa96ff253", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530104, "uuid": "0390efa8-2dd1-4198-9aa5-4667b6af6af7", "comment": "Malware payload (Vjw0rm)", "value": "02f026d65c76130518bec8776e028214473895fc72b7e4f0308bcf168d1ab7d59ac9450f4b82bf378414b054273f5fa2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530104, "uuid": "fa25e17c-6dac-400b-9735-b05e6417b382", "value": "T12F72CEDF8B360DB90F8FC4A925CF594A9D857FAA53A7DF3C4C85ED8121A53060A34860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530104, "uuid": "00f68672-158e-4e86-be8e-073a8558c6cb", "value": "384:a0TC7OYDDI5OGyiHThWgdJ/+rVLR3HDVsp:ZKDozhWOJWrxRhsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530104, "uuid": "f914499a-16e8-422a-aabb-3bca4565fe9f", "value": 17119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530104, "uuid": "51385c32-819c-4daf-8581-872e64c6f817", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530104, "uuid": "94718979-5592-4259-98e6-10ee7e2d0405", "value": "#ZOOW1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1451657b-389e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635501213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501213, "uuid": "73cf8fea-58a5-4abf-829b-8dcd4e39d3da", "comment": "Malware payload", "value": "d6e0c6a6f4680e63a5644cec118bc087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501213, "uuid": "c4f239e5-2e4e-4dd5-a212-cd5c13e8a7bb", "comment": "Malware payload", "value": "2964482bd22a21e08cd1b0c9c1d562adc5f0ac0178da5f35360aca767e440ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501213, "uuid": "84d7b37f-9180-4113-bee1-9e457952c75b", "comment": "Malware payload", "value": "1dffe8640410d0060f87056cdef033cd9275f130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501213, "uuid": "3e0b3f09-882b-4584-9116-7ed8cc4bc349", "comment": "Malware payload", "value": "285ba92fda8e1bb1af6e9e097008fb00c72439373a125637d82a9c80b3ec338013f4c294ae564ead12c601cc208644b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501213, "uuid": "c7881b9d-ba59-46a5-8b27-8a84f8a33b37", "value": "T14F44F71D24BA57D5DBFC84F01F5CB2180993AAB05BDE7A81C8733D19FA225B1762C84B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501213, "uuid": "207c0dd0-1b3c-4463-af90-ade5eb190cf6", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501213, "uuid": "3a5d0316-76a2-4a85-8d2b-eaf776f02a4f", "value": "6144:NBlL/B4trbLedP8aw7ZjZ77S8GTU1K6dMbb:7UA8GTUc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501213, "uuid": "3714ddb0-54cb-4cce-98ca-a49d7c6189bf", "value": 263807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501213, "uuid": "d373a0c2-51fa-4da4-8d93-893d66393ab5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501213, "uuid": "b6221a3e-7b56-427d-aff0-b27141e0c0ca", "value": "987654GYYHGFD34567890-0987TGH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5930d4b-38cc-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635521348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521348, "uuid": "a036b7ff-9291-4687-9997-e70cf8474239", "comment": "Malware payload (Loki)", "value": "65cf1c0c378f8dd772ad922a28c0d20e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521348, "uuid": "a052a76b-0b4d-4d91-a958-262213b3ac2c", "comment": "Malware payload (Loki)", "value": "2972b6b42068e0fad5bb1a30f2388fc1114c3acfd55ee26376bdb81b7ebbda3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521348, "uuid": "8f055dcd-81f4-4382-a966-b9a047ac9574", "comment": "Malware payload (Loki)", "value": "90d479016c70aac120ecd9cc800ebaec0c3b0f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521348, "uuid": "66cfd0f2-9d4b-4249-8bb9-dfec2534239a", "comment": "Malware payload (Loki)", "value": "2e3104c1c9aa052a8195fdc2a33ce0c597db4df8c6f48ce02279d086754d57637498cd3ab66685e8aa24fce2c910e5fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521348, "uuid": "fcd405d7-415a-4edb-b86f-b2ff68a82c76", "value": "T12634122973E4DCB7D14792B09137C716E736CA25041863CB1B70AF3FBD246D269AA385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521348, "uuid": "7f9105e8-9242-4d0e-93aa-af81790651e9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521348, "uuid": "f6933410-cfd2-467f-85ab-ac7067c9ecc1", "value": "3072:wBynOpL12riocLMOKg4WEQT3gne6MIjg+NnV7JMEv0R5NuPAln3rGUn4aTF6uzyJ:wBlL/cOKGXwegjr7JMYP2nTsu2E8v4Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635521348, "uuid": "60bb6461-cd29-4826-8de5-207566dd6f0c", "value": 248959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635521348, "uuid": "9177da51-4586-4e54-b2c5-a6e39f66e4f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521348, "uuid": "a83ea635-051e-455e-85e5-17941c0625aa", "value": "IRQ2107797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8739a1-38b5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635511293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635511293, "uuid": "90ef6ba5-6059-49cc-adc1-5daa489e0d3f", "comment": "Malware payload", "value": "6684b0095b69f76c12587614c986f4ae", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635511293, "uuid": "88e799ba-5daf-43bb-8388-19892b34f62b", "comment": "Malware payload", "value": "2a981eb121e596b8f937297dc28da0bf939e4acadbd4e2b77985e77aa4c171e0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635511293, "uuid": "d2960f6f-ba04-49d4-b894-8979902762a5", "comment": "Malware payload", "value": "75ff856b74e20b6d1271d5e8c6589a31ed9886fc", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635511293, "uuid": "df19a610-1c06-4ccf-9a15-e1d5929a3fbe", "comment": "Malware payload", "value": "1e07166c80363a6e2e81f13716a9a97045dbff134be93e20a8a0cc2b530dbc2e2f86963a9e6bfd5d405fc0b789026e2d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635511293, "uuid": "f7f8c53f-5c2b-4843-80c5-bc78055ca332", "value": "T16274C0F62BA45223F55F52B92691E845D7BFDDE31A0056B80078FE0830FE751EA9F10A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635511293, "uuid": "4d926a28-4b04-44f1-ad29-15b39b5c1e2f", "value": "6144:nMJOn8kf2WFZLwMqUzIAgXpNl0BVAOXHS0BiogkAQKtfwPjyG1ZFxytFfqcp+F3v:SOn8kf2WFm7UsFZNluWOXH9lItfZLfFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635511293, "uuid": "082285b1-850e-4671-ad0b-e5a40bffc9d9", "value": 366456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635511293, "uuid": "a96c899b-8876-4b9b-908c-8ce4b800b7c4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635511293, "uuid": "0dc36f17-4605-4833-9bf9-efc31fc5ab88", "value": "RPA Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ba0cd3-38f6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635539260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539260, "uuid": "0e293fd1-19d5-4c31-8dd7-3df43ab7cb25", "comment": "Malware payload", "value": "af41813cc051b8d0c9c418e99ba345c6", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539260, "uuid": "439bab7b-0afc-4ba4-8caf-232b22065c55", "comment": "Malware payload", "value": "2b29c80a4829d3dc816b99606aa5aeead3533d24137f79b5c9a8407957e97b10", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539260, "uuid": "18735fc1-a99b-46f4-a6f9-bc682162d083", "comment": "Malware payload", "value": "cfd11187f820e2f915bce06a32ad4dc71ac340c2", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539260, "uuid": "8efe4847-de69-4332-a14f-4584f63d5f3f", "comment": "Malware payload", "value": "17fcebab6b1dd2ab2189cfcfd593b9a57c945cea7ffc60f61d258c54bf24127d3b0a2cb15aac471b70d07a1693374322", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539260, "uuid": "304354cb-f016-44f0-833a-4a617d322c42", "value": "T12E45D683EA7361E0E4BBD23582A67627B97135148334C78B87015B175B62FF4D9BE388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539260, "uuid": "11cd5e37-e60c-4a95-97f8-c2b815e895f6", "value": "ccd94d54b49b113bd9c8eb4e3fa720ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539260, "uuid": "02e3618b-a5f1-4063-9f31-7d6a78c42171", "value": "24576:h+5jq+9BGqWeU33V8V0HmkKaH1S2807SPFL3EOGTWqG5QVEzAJ24GOy2irA8+fj7:h+keU33V8V0HmkKaH1S277SPFL3EOGTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635539260, "uuid": "1d8c532d-29a8-4db6-8c76-2d04a4acf30d", "value": 1202688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635539260, "uuid": "cdf4ffce-9a6a-49e1-8e3a-3d6d1877b30c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539260, "uuid": "1284c843-bfe3-4437-b273-8910843a054d", "value": "trendmicro2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92612745-3895-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635497559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497559, "uuid": "bd6153de-bc2d-4739-91d6-c2d25f8c20bc", "comment": "Malware payload (RaccoonStealer)", "value": "e8c8e2d4aa4d55c1fbf9fcd2afff162d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497559, "uuid": "5294fab1-a97d-4f63-abf9-745d4e32d7dc", "comment": "Malware payload (RaccoonStealer)", "value": "2c17e653adf08ff0f16d005e7525bb48e13e07a5d744650d41bb6e94aa053287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497559, "uuid": "26626b55-001f-4501-9100-eb33dbaa2d72", "comment": "Malware payload (RaccoonStealer)", "value": "3e297bfe2ea3b8cb5c4c9de6bcb5baf16d7ef008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497559, "uuid": "abb5aaa1-b2f9-43e9-80df-3e7c73decc2e", "comment": "Malware payload (RaccoonStealer)", "value": "5123109b976aa90cee5c4e94526ca077d568e19973b7a11bdf9b46412109806c6649062eb2402f00acd856351147e142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497559, "uuid": "7843ec2e-f56b-4dbb-b66a-0bb6bc69c61c", "value": "T153D4E010AAA1C034F1F211F84AB69279B93F7AB1A77895CF12D916EE47749E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497559, "uuid": "5ff9c91a-ac1a-4de4-ad35-7b251ec89f12", "value": "8554f137e95e1371295faad9355adee2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497559, "uuid": "fc3a3515-c823-441f-b15d-ce25f10347f4", "value": "12288:aSjSie4CMl5t0P7JYwMIIJRlgElta2yMf8i7wR6m9pN4c5oO6:t3CMKuIIJ+2bidd4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635497559, "uuid": "a702ffbd-93c9-4cf4-9386-8b2d6351fe93", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635497559, "uuid": "f3ab8fd1-8de9-4091-a159-80e51b8992a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497559, "uuid": "7e16dd90-8856-4d38-a154-c1394e636ba6", "value": "e8c8e2d4aa4d55c1fbf9fcd2afff162d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55123db-38b3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635510476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510476, "uuid": "1b53e8e3-6582-4481-b8b8-a211ee4989fa", "comment": "Malware payload", "value": "dd3331428fe8070e0cd89a20b1c4620f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510476, "uuid": "911dffbe-2d55-4cbd-bb92-2c915cac0653", "comment": "Malware payload", "value": "2c452e378b2ad8e0192bc804096eae9abc1e3fa3b9bd9cce4994217acfa239b9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510476, "uuid": "e1e148f7-abcd-4419-a900-b11435af8a39", "comment": "Malware payload", "value": "68c1c50083d968c5b92937cf8a87bc1c1df69420", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510476, "uuid": "c861d239-b2e9-416e-a7cf-13129beaa4ff", "comment": "Malware payload", "value": "687b22fefd302f1c673e6000cfabe846e3e0580e85de14486ca9e0a413e0297162bd84a2b799a86805aed5d60b77e5c9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510476, "uuid": "8bfb66c6-8bc1-4979-a575-895d422c00e2", "value": "T1E8B412AA3FC08D27E453893D9046C213694D74DCA08EB52B65F6AC9A5C70F851B07AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510476, "uuid": "5b9fb93a-d7c3-4b31-adab-b24d26f0648e", "value": "6144:N0LdWGQKchbBwJ//LHsJzYpxDqHhX5qjKqBCX3DlKJ+XVn10L0nYSdC2y//aOphN:IdWGQN1Wb+oDopJX3YkXtnzJynaOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635510476, "uuid": "09dd007a-8bd2-4f31-8f1b-73b47fdd53c4", "value": 507695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635510476, "uuid": "79b883d6-4b71-4e17-900f-0e103e0e3e2d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510476, "uuid": "9fd4cefe-1019-4f62-995c-53e883dd6142", "value": "dd3331428fe8070e0cd89a20b1c4620f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a829fbd-388f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635494808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494808, "uuid": "6a56546b-1ffa-4d9e-853e-0128d691b91d", "comment": "Malware payload", "value": "39ec46e828b4b435ee081d88ebfdd7f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494808, "uuid": "80ea46a5-d0fa-4e2a-ad5b-b6bfa7e9fb38", "comment": "Malware payload", "value": "2d4908cc6bff68903c87eaaa259b3e6ccfb4b222f228004b346ce703b2012e75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494808, "uuid": "9ba16dfc-e78b-4e28-a00f-49718857e4e6", "comment": "Malware payload", "value": "abf9d07e0dc0e7d69a0b700af302625d3809aa7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494808, "uuid": "4ec79df7-e676-4636-bef6-59777ff302b0", "comment": "Malware payload", "value": "5f059bbb2b3daf3010d54ee052ed1e66f00f55aa3e7f3e3d92da0d3ea08006ff7229a79db1296ac83fab166a707ba9ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494808, "uuid": "89295f55-f6ab-40e3-91f1-019a0f3534a6", "value": "T1F154E011A3F60286F3FB5F75AD7204820E37BCA1BD75C92E4248118E09B5E68CE79797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494808, "uuid": "a237771c-ca9f-4c3b-8ef3-bce3dad128b3", "value": "6144:gLN0RHp6oePRG+JG7vCHkfs4LRTbqpNlUptW8VqzAG:gZ0j6o4RGjKEfsoTep3UDW8Vop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494808, "uuid": "3f5377b9-7af1-44b9-9b1f-611f71873cf6", "value": 293630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494808, "uuid": "8755ce2c-8d56-477b-aed9-30504e176742", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494808, "uuid": "6b5ef53d-537a-4259-b7c6-bbc7bce46d6e", "value": "39ec46e828b4b435ee081d88ebfdd7f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c80242-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635484977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484977, "uuid": "85e61b02-4468-4e2f-b43c-7f01ebffc4b7", "comment": "Malware payload (Smoke Loader)", "value": "8b4cc067b10ce5a1ec9af799805180fc", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484977, "uuid": "13db6cc4-dfa9-46d5-b35c-fd59a4b1d5e4", "comment": "Malware payload (Smoke Loader)", "value": "2f14a092d5b4c2c4b371b5603e3db3543530df9c9bc590bf4df944289d710641", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484977, "uuid": "7f851bb1-f5ba-415d-b8dd-6debfa8f803f", "comment": "Malware payload (Smoke Loader)", "value": "1c97adbfb7c9462756d4e5b41aa4fb7bcadf2eae", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484977, "uuid": "369801df-ffe8-4990-9be4-ba743b19333d", "comment": "Malware payload (Smoke Loader)", "value": "b026ed2b9029243c7f214778d9558aef70ab11aad1b8febf6f03fadaa12058dcb20e3709a4a0b1496b07fd074c0823b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484977, "uuid": "c8386b90-6ec7-4603-8416-39ff9f710307", "value": "T1F904AEF0B2D8CC71D063393149B58AA45E2EBC61EA2095473375239E1F72ECC9AE535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484977, "uuid": "f07aaeff-2c37-4cdb-bd07-3a2abda1e4ea", "value": "5ec7965957c5433534918911424a4e5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484977, "uuid": "5bdf3203-67bb-4c6d-a859-e6320b3e21a0", "value": "3072:XXGG/8tP5vaTl7rwQFA7v25Bu3F7ixGYCZI9WrxpzbgqruXhspVggjcGkNIVqI:GGuP5yTl7rzFGv2zugCI9uzbgwu6L7Il", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484977, "uuid": "705b9c23-d3f8-44fe-b682-5bbd53eaaf8b", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484977, "uuid": "a65191a5-f1eb-4dd1-8f28-e1d9214d2717", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484977, "uuid": "a13e3cc2-cf64-484f-839a-03b18c8989b4", "value": "8b4cc067b10ce5a1ec9af799805180fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94121539-387f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635488113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488113, "uuid": "53e66ab3-7d51-40fe-b34c-e8702e7b5d4f", "comment": "Malware payload (AgentTesla)", "value": "6630fe4347b416888a51689b376c6ec0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488113, "uuid": "3d3d6ad6-7aa8-4dbf-90e6-fd62c1bbe842", "comment": "Malware payload (AgentTesla)", "value": "2f7f960f3c5c57727d479a58cfc484dc4c01ab2673ca53023d0a7f00b55f5591", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488113, "uuid": "b5438ea6-ac66-438f-b6a4-a4667911d010", "comment": "Malware payload (AgentTesla)", "value": "f9bf738a885a146394b1c16425d11e64effa8649", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488113, "uuid": "de09f257-069b-4f1f-be19-5676c499a2e4", "comment": "Malware payload (AgentTesla)", "value": "e3155c4e474dba219c454c06802cf530f0fb04f26ce7826e451c0375aafc2953e62fc485acc300b0de92932aed1d1fda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488113, "uuid": "52afd6b9-bd8b-4e0a-90fc-0d840bd949f4", "value": "T151E4235DEE5400FA7C5B210401D3F2C5D176F4B98D4368ABCC99AA325F9DA40AB39FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488113, "uuid": "e30b3c50-6ee8-4f18-b0ba-9dd470037bdf", "value": "12288:UJRA16M4a8B9rgpHseu9N5yVMNci+pRFLrFefVp9ZXOCfz7JGaTHkrESg1BFHZqj:ojM4a8B9bec5ymNciYFLrFefVTfz7JG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635488113, "uuid": "132470f9-b522-4ac1-8887-da5528f67565", "value": 659826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635488113, "uuid": "efaedbe6-02f7-4af2-b807-e5a1f354999c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488113, "uuid": "b438bd79-506e-426a-a22a-1880a33e010d", "value": "Q.2021.03.17 PFP...zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38da49cd-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635484954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484954, "uuid": "63d75352-b8b4-4afb-b60b-26940308ef7c", "comment": "Malware payload (RaccoonStealer)", "value": "41782df61da55951569405027ca87ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484954, "uuid": "5bdabfdb-cc68-40b9-b275-e017d54e0264", "comment": "Malware payload (RaccoonStealer)", "value": "2faa05bc4d669ac2e5dafb2071ff12480c8f554f1746683722545fe2b07db981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484954, "uuid": "ff7f0d80-ee27-4acf-b496-63534f6a4c1b", "comment": "Malware payload (RaccoonStealer)", "value": "cd16cbc3b2241ca6906524af5633767ec319e74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484954, "uuid": "d3c468a1-7113-4af4-9af8-56d7edc44165", "comment": "Malware payload (RaccoonStealer)", "value": "7ef4da7aef732d7703efdca8218c23c97cc45d7b46911083df32d9de9aa8c46b46664a34b6f2ac2caea5d8ebfe5d1cad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484954, "uuid": "51d928bf-7631-4183-82d0-b475fd9b8963", "value": "T19CA401F0729CC431C4A335748C61EAA94939BC61E521B14B3BB8177E1A70ECF5AE536E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484954, "uuid": "8ac27b4a-c29f-488f-9948-1c8301c99c1f", "value": "18875662b19ade4ddd6bba43f9abb4a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484954, "uuid": "856be611-a6fb-4d7d-b085-75c66412e266", "value": "12288:vGOuQb1EhgRNaRRpFG4sbIvm1P5wWunnF7:prmhJdFJtm1P5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484954, "uuid": "2d10e043-ab2f-4e9f-8949-cce5f9997a42", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484954, "uuid": "58ddce94-5cfb-4636-b454-0e217b896610", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484954, "uuid": "168d1e28-3deb-46f1-836a-97f215952575", "value": "41782df61da55951569405027ca87ddb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b659d2ca-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484305, "uuid": "16244d2c-efc1-4d59-9cf3-dd24ed2c6814", "comment": "Malware payload", "value": "021f1231f7863094d6ab0e57eaa7c66b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484305, "uuid": "bf58c635-1ae6-4693-810c-3c0d8bd5c243", "comment": "Malware payload", "value": "300749a83b80de412b1c29ea10ad57bc6644ba99e2d90b4f6aefa54b50971fa0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484305, "uuid": "c5398508-aa24-4e14-9e53-b8b86302b405", "comment": "Malware payload", "value": "1fa45f756ca7c07365e75ac4bcb1d76e975bd6d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484305, "uuid": "55047294-e96b-4e49-870c-204384491f48", "comment": "Malware payload", "value": "d1f74e9f7fa5468672749b64801551a0a6df0dbd0326035b11d933c46e35491ee470e47accb53464fbf48c3ddd022c51", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484305, "uuid": "69dffcef-2602-45c3-a3f7-18d19cec64df", "value": "T19405601A30C774FC4F63C5C4B6EA4698D2B97B69B56C4847EDE0E0002BA8633D775A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484305, "uuid": "25bc6965-ab3b-4533-b4d8-1393df242441", "value": "3072:bkwiBO95K9sLFMl9U7D7NHUZHTcaJtPYrRUGLVxM:b/lK9CUZHHAVBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484305, "uuid": "118da3a4-8978-4919-8922-532eaef5c754", "value": 833513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484305, "uuid": "0a5dac85-b81b-4538-abca-cf54fdfb19ca", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484305, "uuid": "cce7e642-9bcb-4fbd-80ae-5790c04a1f5f", "value": "2975406_10-28-2021.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7204af-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635530189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530189, "uuid": "194f1795-2cd6-4b53-ad7f-3debcb7b76ad", "comment": "Malware payload (RaccoonStealer)", "value": "6ce1ea7dcb5d2eb155c5d7e031ab9314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530189, "uuid": "89f49587-e7db-4f8e-a9a0-48fac9f51fd9", "comment": "Malware payload (RaccoonStealer)", "value": "30e0ed12460cf6bb4e2fd212e75126aed3e02ff7fabf6a8d5963fe843870748a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530189, "uuid": "98ca5f0f-92f0-4e49-ae18-b0b177fc7cca", "comment": "Malware payload (RaccoonStealer)", "value": "afa163c1d6b6169710dce684f92fbe37c450b8f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530189, "uuid": "47391a18-8c9c-456d-b16c-4d66de9d1ee3", "comment": "Malware payload (RaccoonStealer)", "value": "80c182d166d8d10aea86d7a413447b6ad7c3ee729852db3100dfbe313454749246600d9ee8e428ad1951bfb65aa829bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530189, "uuid": "d9c978d2-3adc-44e8-a130-0820af948359", "value": "T10ED4E010B7A0C034F4B662F849BAA2A8B92F7DB1673454CF53D526EA4674AE0FD31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530189, "uuid": "0e22fd52-1087-43c9-9f2e-974eb14c02e0", "value": "c970a99d772492be772af8cd607c5701", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530189, "uuid": "36d3fc48-743d-4609-a416-4eb0147da870", "value": "12288:D9rofKC0hiC9Gvpo9gXrbDO61aWqa6wFu/mBHcXX:ZroyC0gAGvOm3asW+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530189, "uuid": "c1727fab-81c8-4b55-9691-8b1b12f2f6e1", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530189, "uuid": "490a5538-cbb9-499b-a247-d4914e3b5ae1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530189, "uuid": "79b89d89-df8b-4c65-a342-88a09467f9d6", "value": "6ce1ea7dcb5d2eb155c5d7e031ab9314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d84868-3875-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635483684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483684, "uuid": "f00d838e-cc7e-4a3d-ab7f-0edb2395973a", "comment": "Malware payload (SnakeKeylogger)", "value": "92abab3b3ce587f1e5719706049ad13d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483684, "uuid": "e2069ab8-9b53-4792-a3c7-a3491576a748", "comment": "Malware payload (SnakeKeylogger)", "value": "3111845a18e46a06aed2519481b0817f9a360de72256387881cd116b10b7e7b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483684, "uuid": "f287d7ce-92a1-4506-991b-cda284a02de9", "comment": "Malware payload (SnakeKeylogger)", "value": "588e51a013453ae0c074540aa63e03cb2cbc8155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483684, "uuid": "a598a20a-5005-4a95-bffe-2e2275736aa2", "comment": "Malware payload (SnakeKeylogger)", "value": "afb494dc0c280df98b3a66e1d0f2920a420fa474df71ff00f9bea1ba837cac25c41b42461878de39a021e69ad5a28fda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483684, "uuid": "2940f6dc-fdf9-4bb0-a4ef-27aaaf59871e", "value": "T155F48B1C20BA57D5CBFC85F01F0DB2194993AAB05B9E7781C8737D19FA225B0762C85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483684, "uuid": "fe46db79-cfa3-476f-a089-6712294c7d6b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483684, "uuid": "42699cb5-24c9-4d76-9874-c8c96bbc8c89", "value": "12288:7UA8GTUc+F1is9tLrd0FmsWRIdUt3nORb1U68Hvo1Dg1MRNjpPBT:4A8GcFIMNr2kRIX1XOw1DeGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483684, "uuid": "9251aa93-98a8-44af-bedd-69e33e1b9016", "value": 783492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483684, "uuid": "6f41124c-9327-428f-9af5-e9a67b12721d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483684, "uuid": "48a051b6-d5a5-405b-9493-78626a77c04a", "value": "987654GYYHGFD34567890-0987TGH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6f14f7-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1635530196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530196, "uuid": "68424843-38f2-4dfb-9101-138be5f6652b", "comment": "Malware payload (njrat)", "value": "b671f9ee1edb1e6f2911c22c4e6ebbaf", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530196, "uuid": "4d415eca-9c9b-4921-a9ca-a377d245a1c0", "comment": "Malware payload (njrat)", "value": "313bb9d87b5bbdc4cc164ee429b41bcac1605401e1c3e7fa8d1fa287277e3cce", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530196, "uuid": "ef66eddf-9338-41be-a1d4-5f278ec6570c", "comment": "Malware payload (njrat)", "value": "6de6dfee5b87a8f52ce34bc0c9d147bc69faa04e", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530196, "uuid": "06c28c14-a1de-49a0-9cdf-1dbcdd53bb99", "comment": "Malware payload (njrat)", "value": "ce507858ed7aa4ee98c3a5715e1471ed7ddf99e5123e5956f775c978978734ff6dd1c6c56b268c75e4facea16d14344b", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530196, "uuid": "21e45997-5c19-48b3-8128-6837efda2c77", "value": "T18672567A19D2175A3E78A19F7736F8BBAFA739043E3A57D908B541A074B0804076CF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530196, "uuid": "fe8a07f7-6cba-4078-bf76-4a75730fa60e", "value": "96:SXXXXXXXXXXXXXXXXXDpsE9HNlqfRr5STqcFWqABXXXXXXXXXXXXXXXXX3:+pV9Hn+rSqc2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530196, "uuid": "2cad7646-5222-41dc-81cf-c416c677edd6", "value": 16039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530196, "uuid": "30a105a7-3885-47a2-a297-6ed67bc403b0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530196, "uuid": "ed8fc23e-9cf9-4594-a55b-d79162b757ee", "value": "Shipment#45523666245.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c64b5d-38d4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635524442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524442, "uuid": "0e7a12ff-8cfa-4f54-bfd6-95409223517d", "comment": "Malware payload", "value": "1b19155bf4f39cbf7131820933d94bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524442, "uuid": "0ec9ed34-1420-4628-b2ed-247698766f72", "comment": "Malware payload", "value": "3157138aac0858461aa30193ef4ef08ec464ce9f1c5b70784ad0e07a1d2f68d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524442, "uuid": "aab005ed-2bad-4558-b13d-9094af29f7cb", "comment": "Malware payload", "value": "c9f09fe99a450931868021838a000148418c9c74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524442, "uuid": "6c01cdb3-7940-4807-8d16-c4c772c45418", "comment": "Malware payload", "value": "d83dac79b101e3f276c3cb2178605fd6afdfaa9169b6105aee5539a425e758d9bcc7c428d4c68cf9c73026965616e7c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524442, "uuid": "2df9ecf5-0d16-4e86-aace-9b551e2b2003", "value": "T10684BF3362D7AE8AEF7F1FB4882131404EF5BC576B3DD24BAD8A01A611E7950CD50B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524442, "uuid": "bbfd16a0-2677-4e02-b80f-49f71cf3d12d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524442, "uuid": "c60071d0-d73a-4f8a-b6f8-87d97883b581", "value": "6144:18FtM2JyE5MuvCyGrfWILZT1NRRDs5wxeO9v7K+SUyxT6vN3dYQWBrhIwaWicSu5:18Ft8uLqJFTPbnp7KPtwNt7W8wagS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635524442, "uuid": "fe13f93d-bf64-4e5f-87fa-7421ca5e9e50", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635524442, "uuid": "92c64f79-c6f5-4109-a926-6880fa2c96aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524442, "uuid": "43ab9804-2bb3-4e8d-a7f0-f6e51d11c799", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82bc276-3875-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635483933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483933, "uuid": "fd9dd587-156a-4b7f-9615-21599d4e654b", "comment": "Malware payload (RemcosRAT)", "value": "733471b2013ebbf7699a4580eefbc40f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483933, "uuid": "b863b008-22a7-4e33-96c5-442a415d8670", "comment": "Malware payload (RemcosRAT)", "value": "31ccfd52379f73629cf34d1e2864648befed8f571785811c1936919f36b807c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483933, "uuid": "34319399-28c3-4461-9b83-2d1fc66a4882", "comment": "Malware payload (RemcosRAT)", "value": "5a8c99eed0183b106abb96a7229eb6cec7a0ca65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483933, "uuid": "2f50e9a7-4ec4-4c6a-a7f5-e32eb0f0e87a", "comment": "Malware payload (RemcosRAT)", "value": "3ef1f9b69e8c8c8682f243fd192c25d97c4c9e883b08bacb2560443d2620f6ac91db4987a0fcde6d1b074db14e27af7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483933, "uuid": "cac62e1d-ffc4-43a5-8318-d3267fcb88c8", "value": "T19425AE13B380BA36C03A9F78CC57E2AA6416FF502C619DC636F47E49AF356443E156A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483933, "uuid": "e1eee66c-b384-4c28-bc94-d592ca49c245", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483933, "uuid": "2cd4e694-3d8b-4d55-b5e4-cdf2bb20413f", "value": "12288:qXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4J46NuLpjqayC94M0LdEegD:q4uBfTG2pM9o6NN+swhY4DMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483933, "uuid": "1d22c11e-0c10-468d-9c6e-35364f5529a2", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483933, "uuid": "a3613223-68ae-46e0-ba2b-6a3b4f91546b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483933, "uuid": "d3832cc4-a50f-483d-850d-c160c998825b", "value": "AWB # 2617429350,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d47dba-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1635530078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530078, "uuid": "59520264-761a-446c-a7f1-6c716afbc0c2", "comment": "Malware payload (STRRAT)", "value": "e9498f2121765d0b5210ab5ddff8d296", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530078, "uuid": "9de2f2e1-af2c-4e0f-b786-8e95d3dc802a", "comment": "Malware payload (STRRAT)", "value": "32a130384ae0e8001bd7467b5f307458a9ee34b45457b815e4aa0a8def00c8b8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530078, "uuid": "92277599-91af-4b1c-b99c-6bd992e5d707", "comment": "Malware payload (STRRAT)", "value": "e7a072460b5c13c692a43b255f0670a3002e52db", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530078, "uuid": "80f143a5-64bf-47a0-832a-9c0395cdf910", "comment": "Malware payload (STRRAT)", "value": "c699fd25d03c730152c49311817e75b35ff124403f3cfa026ed4a85413c17aa62c5e690dcc6b6d9161cff56db9502a22", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530078, "uuid": "fcf45cbf-b952-427c-9b9d-7dbdfbcd6712", "value": "T16904011EFD5FD0E5D10B413A5945813FE60C59AAA006903F6AFE069A0E76F7E1306E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530078, "uuid": "c9437cae-1cf0-4205-95c0-6fe264acf12b", "value": "3072:MB3YJr+2lv73kl5esymzaefyEwlQ2rKrz1StAlSpl6PRdQT/rWyxw85+/:i3a+2N73kl8mzaeaVlQ2mlSSZQ7r3xHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530078, "uuid": "aa8cdb34-e132-46f1-9933-d959f62c743d", "value": 188978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530078, "uuid": "27707956-894c-41f1-9d67-c5d29d2e8bff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530078, "uuid": "ced98319-01ed-4eb1-bcb7-d4436a0f225d", "value": "INVOICE.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14325a29-38be-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635514957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514957, "uuid": "7c905225-ab24-41fb-bafc-7e6fead870a9", "comment": "Malware payload (RaccoonStealer)", "value": "d02c5bf9533cce0e9ea3eafc2f594a49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514957, "uuid": "bdc650fd-6763-4200-ab35-ffd0746b5b31", "comment": "Malware payload (RaccoonStealer)", "value": "32c06152828c3d144b82e6e1f4ef18381be1dfd307105851827e358c64156949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514957, "uuid": "14445b01-4ab7-4a97-a60b-31030f5827f9", "comment": "Malware payload (RaccoonStealer)", "value": "843bc6b17ad8af53ce851f5c05d21bc03b434e5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514957, "uuid": "02f9358f-2d3a-4a8d-ab3f-f3d1140ec74f", "comment": "Malware payload (RaccoonStealer)", "value": "40cfe9206c1c9d89ffa1d607b39aee24a25f79357a1c9f862298a2b2fd5a9893c5dc40b004a5b190d5d57a3226e36a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514957, "uuid": "09b1afbb-9a75-441e-9348-59d061b9f4c3", "value": "T174D4E000A6A1C031F5F662F8497693A9B93F3AA1A77494CF63D456E90734AE1FC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514957, "uuid": "0687c339-108b-443c-869e-e329f8eae51e", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514957, "uuid": "76c6ae30-9f19-4444-8b2f-d2fb5437b4bb", "value": "12288:kGukYO+PJKZ0NZviBsCUcU9Yveqgg4Q2K+:HukCJ1iiCf202", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635514957, "uuid": "def484d8-2831-4720-b418-73e92d533fc7", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635514957, "uuid": "509238b6-7ba3-4fdd-8497-13d5331336af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514957, "uuid": "c3ec7695-33e0-4617-9b65-cc80ed6fb945", "value": "d02c5bf9533cce0e9ea3eafc2f594a49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36e8fac-389e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635501480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501480, "uuid": "5efbc58a-6508-42c7-8813-fb13088ac9ec", "comment": "Malware payload (AgentTesla)", "value": "13f3e60551593f41b95dbe2b34cf8c98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501480, "uuid": "b1065841-907f-4683-afb6-fce86dea27d2", "comment": "Malware payload (AgentTesla)", "value": "34355df8d0e83c3b68c6886748f0ae59191e35c799524b5baf09e24672cf03fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501480, "uuid": "43692fe9-1d9f-473b-aaa2-9558658cf473", "comment": "Malware payload (AgentTesla)", "value": "c48d91c70a007b11bfb539e271265ec376fb30d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501480, "uuid": "349530e5-d763-40bf-b59d-f4ac1525712d", "comment": "Malware payload (AgentTesla)", "value": "86fceadbb4c1dae081cc5bee3b97ea2134968905679e9e45a17d95618e70477351a67a7d9e21060d9c62c52963bfe252", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501480, "uuid": "c29e3d0f-02fc-44ad-842f-ae53ac764687", "value": "T11B840106B364BB9BC4BD07F80093A42467F37926B171DB061EE539D62A337409E99F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501480, "uuid": "edc50b7d-14cd-49a2-af59-7cbda496f6f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501480, "uuid": "802b0ff0-dd4b-4d17-becc-c5d957d221bd", "value": "6144:4vwOQEomr6BxXHpsn6cIQSt1Vs044Gf4efaW0G3Qdfh9hYfgw9bVMvD5B:gJQEoVB5yvOtDnBGfhajfzhIgwv8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501480, "uuid": "922fc145-cc36-4145-8de2-984ff2bbb584", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501480, "uuid": "4693f638-fd58-4f36-8c47-e98f95116c1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501480, "uuid": "cf76b712-76d6-4fff-af33-850c4fbc1f46", "value": "Payment Advice 28-10-2021 SKMBT03783930484080488904003TXT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce04689b-38d0-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635523000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523000, "uuid": "bcfd3cdc-9b17-4a39-ab9c-eef47b6d4481", "comment": "Malware payload (RaccoonStealer)", "value": "bb71d72e7391e33f98c1291c0f499ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523000, "uuid": "41651481-5ed4-4eb9-82bf-febc0d544631", "comment": "Malware payload (RaccoonStealer)", "value": "35231486153cee388c670fe38e700810cb7f4bb265f42d6d68c1b9494206360d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523000, "uuid": "30cdf4ff-5d83-4f10-a397-e32e3ea72711", "comment": "Malware payload (RaccoonStealer)", "value": "1c6d44c11343804c707aa2f3ab6b75b66f61f1e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523000, "uuid": "7abee6ee-be77-4acc-b042-6b4af263d6ba", "comment": "Malware payload (RaccoonStealer)", "value": "8aaafdbc03cc1b68e85cd797154d6e27bc2693fd95e151309a06ac0b496e6ae2d44b937ae31c2924ee3077e20b020d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523000, "uuid": "f38cd547-2f5c-4022-8afe-48e26ec80614", "value": "T181D4E001A6A1C035F1F252F459BAA3A9B93E3DA0677480CF13D522EA4778AF1EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523000, "uuid": "7567c966-e1e8-4b81-aaea-8fba92f92edd", "value": "4649591756a77695954d3f167e28cc87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523000, "uuid": "c1a1c2d5-b67a-4f26-a5a2-afc4ed9af805", "value": "12288:cXFozgk6zKJTHUqEiPEnvnoTYPjPX12r0OqvOw79vU6i/+95v:GFE+zgcnD2pg/Uc5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635523000, "uuid": "939d15a4-de30-4e21-bc1c-f6792b5ffcde", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635523000, "uuid": "6c0d625a-263d-430c-b598-59c103dfb23a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523000, "uuid": "d608b7b1-7d19-4416-a38e-355a7509937e", "value": "35231486153cee388c670fe38e700810cb7f4bb265f42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429de239-38a0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635502150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502150, "uuid": "9ab9cb1a-849f-4c7f-971d-81b2c9832f30", "comment": "Malware payload (AgentTesla)", "value": "9c4e09a650d47413c2ede2fc506cb617", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502150, "uuid": "37684cf7-4869-4345-b957-6b1516f05d79", "comment": "Malware payload (AgentTesla)", "value": "35261a12369edc17c155e08b95b786169f8faa918fdd62b0f0b2292418b07261", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502150, "uuid": "400aca53-a432-402f-8911-cb0cd8fec05a", "comment": "Malware payload (AgentTesla)", "value": "28840d8728c98289e7aadbfa2407a4c4a871d7e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502150, "uuid": "46dd2647-fbee-439c-9aa6-d8947b5c3400", "comment": "Malware payload (AgentTesla)", "value": "38b6ec3b16d53597b0d551985ffe76742a8084086af3e36fe7c7037de2377b9bdaa0bb449d606df2892baeabe8b4fd10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502150, "uuid": "faa5493a-e0f0-4a36-9f19-2406a6acd1e9", "value": "T18D94020073606FD7D17D43F914D3A625D3F25A62B231CB426EE634DA2A71B848E91EE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502150, "uuid": "69379042-bcb9-425c-9d9f-4bcdb1bc2748", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502150, "uuid": "4a26f1d4-35c5-4205-b676-cc9c730cd09b", "value": "6144:3bUQ/TnCCZLaWQJIKc/BR71iGwP5n3M2XteJoPDJv1phdqBYxu1JalUk1bCBW9:oQLnCCZ+WQJBSBRZxkc4t37dHUeqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635502150, "uuid": "58de8500-7581-4efd-8b6d-15c2b39beedd", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635502150, "uuid": "daea719d-a423-49c1-9d20-06a4fd4ce8c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502150, "uuid": "6892722c-5998-41dc-b51d-e39684e664f1", "value": "BANK SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a708252-38cb-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635520632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520632, "uuid": "54b4a6d3-d505-458b-a3d1-ef6efa395f4d", "comment": "Malware payload (RaccoonStealer)", "value": "5eb13887d3dc0b841aacc50770a87213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520632, "uuid": "8532f014-0130-4a72-bae0-c8c35c497737", "comment": "Malware payload (RaccoonStealer)", "value": "3563d9f6b7170b84d5fc589df6ff72f754025c8575d3d92c7fee09446beac0c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520632, "uuid": "ce8092fd-499f-4998-9103-6bf5652ffb69", "comment": "Malware payload (RaccoonStealer)", "value": "72302d13d2a6297dae81cc936292354a73fbe738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520632, "uuid": "92a0f968-7b09-4236-b736-f98640932475", "comment": "Malware payload (RaccoonStealer)", "value": "61afc716df08a0ea9101d79bd9e104f4cb9b7b7fdeaf7f295c5360b8ef2a0da43c6aee8a9b935f664604255b664944d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520632, "uuid": "98ddd975-143f-4247-8290-e02941fb26e3", "value": "T160D4E110A6A1C030F5B652F849BA9269B53E3EB1677894CF13D816EE87386E1FC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520632, "uuid": "a6d25585-c07d-4f47-804b-bcf611439bd1", "value": "4649591756a77695954d3f167e28cc87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520632, "uuid": "ba346848-4b04-45a3-bae0-6f2c3cfa8c06", "value": "12288:x79Dl6jlKg/rfYxZYr62zbdYLZMQQugYKM2GJc:J9Dsj5MXY/bci962", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635520632, "uuid": "2abda9d5-bab0-4702-9d12-6fde16058993", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635520632, "uuid": "7b22921f-f28a-46da-a960-a558923524e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520632, "uuid": "63eb2c25-6d9a-4570-877f-2fd8978282ca", "value": "5eb13887d3dc0b841aacc50770a87213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d887fe-38c7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635519154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519154, "uuid": "2a6ef8ea-b55a-443d-aa13-48b482009f02", "comment": "Malware payload (RedLineStealer)", "value": "b0f619b2ec7f23d1d8b5763a36fc7c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519154, "uuid": "15afa15c-eee3-4797-8d61-bd8c68482837", "comment": "Malware payload (RedLineStealer)", "value": "3654f41fc486bc1461cf70e3b7954d6e8aa8e8e6b4f7d3885bd9fd753a7dbb9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519154, "uuid": "2b3bdf58-d921-4ef8-9cf6-3bf4a7abe042", "comment": "Malware payload (RedLineStealer)", "value": "98cee82d116276f3d5392357d3c1df2a1755d93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519154, "uuid": "e1fc1b1f-ab30-4cb3-bce3-2f6b10f9df3b", "comment": "Malware payload (RedLineStealer)", "value": "7eef669b93c3a3bc68853b0074a2f619b0687eb24ad101780c91608fc31e3f269abe14fc6bbc38bbd7a9796f042001f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519154, "uuid": "6a048dc4-8799-474e-9bd1-93d9610df361", "value": "T1F2051AC6E1B3608ED3A3B0B90F0155864A471C7A6B119AF56F35E96B21F37A1CAD7303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519154, "uuid": "d55b2a67-6a00-4a7a-8c11-b99bdf4b3fe9", "value": "835da68f7e7e29ef9a08f899d20e0925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519154, "uuid": "df306058-77fe-4e1f-878b-8777aab273eb", "value": "12288:gFLtAmi/mXGY1aeWL3fmwB/fmxdJYlmXsglfiNZypMBVHFrs:gHALmXN1pWL3OwAL1Sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635519154, "uuid": "84abf2d2-8ad6-484a-9807-06cfaa28e0cf", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635519154, "uuid": "c30b0732-e9d7-4528-ae24-b0491ed5c086", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519154, "uuid": "8bd045e2-e227-4b29-abcc-5fe9b30183e7", "value": "FortniteHack v3.8.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f1b458-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635526525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526525, "uuid": "1dde658c-a6b4-425a-8def-ac39593bcc65", "comment": "Malware payload (Mirai)", "value": "7fa62d351e3f5cdd8e5e1ecd9794727b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526525, "uuid": "3b2a4c0f-8c72-4c8a-be23-34cd6cc869df", "comment": "Malware payload (Mirai)", "value": "36f872e3400c1a069332f287daa53029cbf24bd9c9970edea688712d31af5b9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526525, "uuid": "40bf914e-8b68-44ea-b489-f8e2abc1a404", "comment": "Malware payload (Mirai)", "value": "cbdf69d21d157ab51de4ffb34589e2b0bf3bb31e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526525, "uuid": "ae6c00b9-25f1-410e-a0aa-87ea581bcd63", "comment": "Malware payload (Mirai)", "value": "e8f97c814e691dbacabde3fa21f9581690b2685a9133e23cf7de56c8e6184e3c87779a6dcc3c9eeb97bd91bfe56f38a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526525, "uuid": "3964d1c1-3f8e-4639-90b9-b1cf9c99bdaf", "value": "T10D735C99F4019D3CF84BD67964160E0AB931239947830F27A6EAFDE3BC73164BE02D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526525, "uuid": "6c5ed381-0e45-4817-b4ae-4ca62c13932c", "value": "1536:8W0DDZiWAUFcV1mI1O8zk/nYE0n2hvoKo:8dDFRFcV1mQg/G2hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526525, "uuid": "946b8060-f0fa-4a40-a0d4-44157ecbb704", "value": 77100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526525, "uuid": "88bac205-9701-4105-9d25-32cb90e4811d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526525, "uuid": "88d8a2a6-4208-4664-8453-9e362dbc191b", "value": "7fa62d351e3f5cdd8e5e1ecd9794727b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd66497-388e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635494703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494703, "uuid": "67fe7c90-7945-4f74-b6ae-aa9f7541d2c1", "comment": "Malware payload (Formbook)", "value": "36cb5b8f4ca5793231f945330bc7a5d4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494703, "uuid": "b9f77c64-425b-44e2-a3a6-1c73a557cbd8", "comment": "Malware payload (Formbook)", "value": "37b7cfa5736003569340c3dcdfde528b1e7535ecb4f55c5b44d5b68cfdbc6881", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494703, "uuid": "3cb4fe6e-f177-4c96-abcc-b96c08aa816f", "comment": "Malware payload (Formbook)", "value": "2c8f4edc92662c0588f5d5f782a5b69e3db99fcf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494703, "uuid": "e0d21c80-5ea7-4732-bd86-a1fa81d9bb7f", "comment": "Malware payload (Formbook)", "value": "a8e7fa5125f253eac182a90039de78aea1a3130239d437b9ae33b5b1fed1076f8977677ce6e7073f9eeac92740905374", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494703, "uuid": "631bdea0-4eaa-4b1c-9513-bb4acf3565e2", "value": "T15E74D0872025DB80FFC7E1B6BB2A38B615ECDFC42AC9D6991433781F607D10396AA355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494703, "uuid": "000b4b66-3f1e-42f3-993e-98c10532ae37", "value": "6144:Dactlg5rwZexWB1/q15E8GQRvPEprwW/x6meppIRVb8K4SGJPq:ecPEwA9GQW5wix6dppIRCK4SEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494703, "uuid": "322550cf-c25a-46ec-b568-b9f409bffbd2", "value": 357336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494703, "uuid": "d608c818-5a49-4b5c-9e82-5a7850b371cc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494703, "uuid": "4d95737a-25b0-4cee-ad2f-9cd3f512477a", "value": "L.T.D Galtami.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5d39b0-38a0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635502244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502244, "uuid": "75a68ff3-a91b-487a-9947-76ad8bdca1d5", "comment": "Malware payload (AgentTesla)", "value": "8e38e22ec211bc84ddcf523fed587bb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502244, "uuid": "d24d48ca-ffba-476e-8c9e-2cec87925b22", "comment": "Malware payload (AgentTesla)", "value": "37da0a2185eaffa5476afd9f21dc1ffbb6db279cc92b92372ae647dfec0ff92d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502244, "uuid": "7ccd2de2-1f47-4808-801a-be37fa22883a", "comment": "Malware payload (AgentTesla)", "value": "6f493e8d0c5e4c86bffc10db06498de21c52fa72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502244, "uuid": "415eed04-9107-4233-abbc-4a919427a006", "comment": "Malware payload (AgentTesla)", "value": "10ab2a07f887a54c7850f5eb1f41c865fc990517afdf78db4ec6c39d549c3b2c9cb0af4e4f33d4d77614a014aad42594", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502244, "uuid": "17e6aae1-1e20-4ffc-b2ee-3a6507f51ec3", "value": "T1FC94120193B887B7D09E8BBE089765A41B36ED727151EB1A5ED0B0DDAE323811E50FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502244, "uuid": "958c3b41-09af-43a7-8ce4-28a22991883f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502244, "uuid": "80561be7-0964-4302-8767-18d63c484968", "value": "6144:sW+PQ4kq4Wic/kPdOFGczBvghl1Ufw14tPVWFeChjcUGIEO7E8UXwG+MGk4hN:/sQbqFYdQ4+2WcFJg9O7QT+xJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635502244, "uuid": "bebeeb86-55b1-4067-9281-f1ac2e33f793", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635502244, "uuid": "d514d344-9018-458b-aea8-ec7cd923c0ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502244, "uuid": "c7242afc-9ab6-406e-9734-a171ab61a647", "value": "AWB5032675620_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cf658f-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635529972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529972, "uuid": "e28b5ac5-bf4b-428b-b399-85d4bf26ee2a", "comment": "Malware payload (AgentTesla)", "value": "f59e8414e96e36110100d03c404bb3b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529972, "uuid": "8bee900c-d7a1-4cc8-ab82-574b85dbc88e", "comment": "Malware payload (AgentTesla)", "value": "38028aa93c9baedaa2f00cb34b2493a0959662fb34823b045c3e931c325221a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529972, "uuid": "0198b779-e6df-4664-aaa8-2bf8ddc083c5", "comment": "Malware payload (AgentTesla)", "value": "525468306ef5edea6b5e2aab720703a0a37b3b7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529972, "uuid": "cf87ac32-3706-4343-b706-bffd88a60fda", "comment": "Malware payload (AgentTesla)", "value": "66c4b26bc0b8f9c7c09dbc0cc597e7c5638ccd41f70884f473613ce4e89fb33433206af9fc2b68fb37a6c87ffff08ba5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529972, "uuid": "ee7db9a7-f40b-4ace-8965-51aa4536ad97", "value": "T1C8940205A2E43F9BC47D83FA109BA16463F1A557B670CA092DE635CA1E73B804E51FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529972, "uuid": "0d352530-8e33-44da-af1b-5f89c44d6322", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529972, "uuid": "867fe46c-06b1-4a16-9e34-052a2be3febf", "value": "6144:aoQxtBjGhA/gjb2vQtRl1dg8/HMM0p16BM2SJkN2AsLl/:bQtjGAShtR+8vB1BM2SeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635529972, "uuid": "956cf676-5bf4-42b4-83fb-20b63b34231a", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635529972, "uuid": "73d312f6-341f-4e7b-8665-9425146d2660", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529972, "uuid": "85614354-03ee-425d-a89a-090132a9d6f8", "value": "BBVA-Confirming Facturas Pagadas al Vencimiento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd34370-38e3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635530970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530970, "uuid": "653484aa-28f1-4f40-bb03-c0d23dc1577a", "comment": "Malware payload (AgentTesla)", "value": "b07b62d883ad5768cbf783291d175108", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530970, "uuid": "cedf6197-aa59-4352-a3b1-ebb70634372b", "comment": "Malware payload (AgentTesla)", "value": "38461fc3fca7395445eacab9d83379e55d151aae2826cef3b5f3363b055c6567", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530970, "uuid": "80959ed2-2787-475a-94bf-ab5aa5f62389", "comment": "Malware payload (AgentTesla)", "value": "2a10af085fa7b262b1cf85e878a578efa8b46ca3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530970, "uuid": "a296f70b-c663-4990-aa55-a490d0777b06", "comment": "Malware payload (AgentTesla)", "value": "47298b41c1854dce4abf77ed574976b0fc4edacdbaf216ca1d39973b2b6dc8136b16e3de9db05d3f74b6384240d14b9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530970, "uuid": "6b3dddba-7d50-44a1-8383-bca7b29aee03", "value": "T17F242A166714D561CB5F417FC01A820831F1D703A72AD2CF5AA6D8FA2F812CEF92B9E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530970, "uuid": "e550460d-9636-41ba-84d2-93186c58752f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530970, "uuid": "4c1ec318-b8c4-4c11-a1fc-49b66d22dfd7", "value": "3072:xGWqj1zGFKN04N40qkQvQUsq1lsWxIjLdwTwPwDCLzdOQneU4WkkK8Wtpcz:x+04Pq7IUxlqdXDA1Wkk9Sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530970, "uuid": "a5920459-664a-4774-bc19-a4efdd35a462", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530970, "uuid": "5c66abc7-1008-454d-8210-f449c2e230f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530970, "uuid": "f6e6fd09-a17b-4489-8684-408e98dc4f8b", "value": "HVbeQgeMsXDRWoMEMOjuumCpmfX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780c0fd5-3875-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635483771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483771, "uuid": "def761e2-6b3f-4207-8c65-b567920cf3aa", "comment": "Malware payload", "value": "3c324706e3bae0b7187b134a813011cb", "object_relation": "md5", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483771, "uuid": "0f732fda-1563-4748-9f7f-c370c120fbc1", "comment": "Malware payload", "value": "38ed248501bd35cd140f8376ac42e2c5a46ed4ec71cff0cec290fbc93678f323", "object_relation": "sha256", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483771, "uuid": "a00b7b50-441d-44c8-85ae-c13cd2d9d949", "comment": "Malware payload", "value": "ed94bef7f2d99ee150bf38d263a902586672c7d8", "object_relation": "sha1", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483771, "uuid": "0a51c0da-cbdc-4f4d-b394-fb1c1fcb6021", "comment": "Malware payload", "value": "1b6ede2e8f6d315e2516d76d9a8f63b7a22c23db1f3169535dd26746389109e18e06ce7a36a3ef82d2225f2f017acc99", "object_relation": "sha3-384", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483771, "uuid": "98eb61db-7ff9-473c-83b7-d1ee86898cfa", "value": "T1972422AADB14390DF784C47BC7E02CF6729EB462A427C08F65DFCC02F99A49D2961853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483771, "uuid": "dfb953cf-ba41-42cb-b41e-7f86bb0573f7", "value": "6144:v+qXdu/Oj/y1zKxYNg/lnxFEMEZnAgqYWAyUCBJ:v+6d1jqV+nxkAqWAy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483771, "uuid": "ab39cca3-7473-4b76-8950-3f8bbecf5b7d", "value": 214155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483771, "uuid": "53a5b8dd-ef63-4e28-bd42-3bbcd19708a6", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483771, "uuid": "ba01e49e-b510-4e2e-b83d-2781bb398c50", "value": "FiCas AG Job Description_lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd5b3ae-389f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635501766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501766, "uuid": "efd169ca-d560-4bca-ac82-c498ee7fd95c", "comment": "Malware payload (RaccoonStealer)", "value": "46c7b262a649daac0fc11ef2a5fb6a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501766, "uuid": "b6cc7e06-bf91-41dc-96fc-f07d086eba99", "comment": "Malware payload (RaccoonStealer)", "value": "3909715a0ad1126b31e48c3603f265f64f7d2c92f4204d7b527eec96f52ae987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501766, "uuid": "140423a6-ae01-4c1e-9313-7e0df49261a5", "comment": "Malware payload (RaccoonStealer)", "value": "cc4c4be8ece5b0c35cc689484723109dea12eecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501766, "uuid": "52f37702-77df-4c78-a913-ea8195741470", "comment": "Malware payload (RaccoonStealer)", "value": "a96e10d674269ef341b0c5e774db8800c70d2af98431fbfc6cf290a724a7aa96d3647dac365d8630176ca8b5fbec072c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501766, "uuid": "1f280a5a-234e-4150-9833-ad4df63cf4d6", "value": "T1CD749D10B7A1C035F5F212F849B69269B93F7AB1AB3490CF12D516EE4674AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501766, "uuid": "332fd858-8aec-4e4a-84b8-43b39ad8a367", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501766, "uuid": "306fa38c-c038-4215-a930-11bdf04b4536", "value": "3072:+IBaBNjyw06UXVug8Bk2EH/MmjZTSZnsjXFzQqy/Q/b8UyrkznO7hqorp4bw5zKP:DBuSJ2a5StSQqLb8Hr8Mhqo9+wo5IGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501766, "uuid": "09e2127a-37d5-407a-befb-8d57f15b1540", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501766, "uuid": "3841a311-cecd-4bdd-b515-2bd4f9ca571d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501766, "uuid": "a14e7c39-2758-4bcb-86ef-9ae498383515", "value": "46c7b262a649daac0fc11ef2a5fb6a4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e774342-3870-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635481581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481581, "uuid": "f88e1b23-0c2b-4f9c-9b24-54b605937234", "comment": "Malware payload (AgentTesla)", "value": "a24e69b120c61ace2e54abca13d8df76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481581, "uuid": "5d705c9e-da90-40b2-8a44-23e402634e4c", "comment": "Malware payload (AgentTesla)", "value": "39a0278b21f02a9d95607834c2bf1f8531c8aee593cfc38be7431a7cba6a52aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481581, "uuid": "d0d7bce5-ae8e-4fc6-8258-675c0821967e", "comment": "Malware payload (AgentTesla)", "value": "a7629410a4ce7e32aea2d24022521f294c557c39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481581, "uuid": "1b43b775-114c-42ed-9489-a68a8465a535", "comment": "Malware payload (AgentTesla)", "value": "ded57e68eef937eaa5159aa4ab1984ead8096eec6aff9607f2ede4455690674f0e08aa441c27dab50101e8407f99ebe0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481581, "uuid": "c1d2322e-e6d5-4419-b9dd-b96df9081bb3", "value": "T1CDB4E00173E56526D37E0F7548B301502BF269A73D22E39F5E8820DE697EBC40A51FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481581, "uuid": "9e889de3-f57a-40ab-aefe-e1969724e731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481581, "uuid": "ac3576ee-895f-4169-a41a-ead9bf9f1ca4", "value": "12288:GZ2PzuIYJ0SQLzNG0NVODpoYIdZMxO1+ye/e:uuuE/HNV7YeMee/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635481581, "uuid": "fae4ebe0-7f28-47f4-b56b-313badd4fbbc", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635481581, "uuid": "e5435b93-b0b5-4717-a286-aa5689f7b8ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481581, "uuid": "9105d30b-cffe-480a-bc43-35ac7710c36f", "value": "Details OF Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab0a46d-3886-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635491265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491265, "uuid": "5d1b7a4b-6d4c-4096-8272-9db1dc33ebeb", "comment": "Malware payload (RaccoonStealer)", "value": "34116a5b219a4644838dcb7cb38d9bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491265, "uuid": "329de142-8fc1-44d4-85fe-745b466dff6d", "comment": "Malware payload (RaccoonStealer)", "value": "3a2f83d66838e275b1d788a7e20d618dfd66cc804cf5565f2886c6b9d27e3410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491265, "uuid": "0b09ebcc-fed3-4307-b0fa-f9f546afc9f9", "comment": "Malware payload (RaccoonStealer)", "value": "8d7b56de2a3af977c6031968e23c0cbfac6b4484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491265, "uuid": "90acf522-5f20-4415-9acd-1f5c4e2ee30e", "comment": "Malware payload (RaccoonStealer)", "value": "d50ac576da5b040b2c8c4f63f29594db1f6a5de62887ef2fab6a76f30e2faa33ea30f278cd067cab4fb25c0cb81fea7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491265, "uuid": "3ba49121-742c-4128-874b-ef367542277b", "value": "T1C8D4DF00A6A1C030F5B752F859B6A368B53F7AB1AB3481CF22D517ED4678AE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491265, "uuid": "a41629e1-7274-414f-9cc2-0c0b6ad04ec6", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491265, "uuid": "e1f89c54-5292-4fd9-a28a-daa884dac5f8", "value": "12288:7BfQJ7VcVwHb+YvBfY8pGUHIAll7Ay4dRojxU+9H:FfQJ7mVw7TR/pG7Al70E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491265, "uuid": "7386dfca-d2e0-4f82-a7e1-cfc8e2e5f35b", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491265, "uuid": "187b084e-db58-4af1-99be-746240e856a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491265, "uuid": "74c42e23-72bd-4cf9-8baa-3b66b2d0be9d", "value": "34116a5b219a4644838dcb7cb38d9bfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afb16f2-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635526350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526350, "uuid": "0fc393b6-b818-4251-8325-22934aab87f7", "comment": "Malware payload (SnakeKeylogger)", "value": "b1e87ca29d9e431de6d405f30d5376f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526350, "uuid": "2bc2e9ff-8647-416d-b6b1-20d082160b2b", "comment": "Malware payload (SnakeKeylogger)", "value": "3a7cfe8ac39e0571eac608f6c132169c36cb0036bd865cdc0c121b64b1b3e7ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526350, "uuid": "d7ee886e-5964-41b9-8626-42e7e80ab5ed", "comment": "Malware payload (SnakeKeylogger)", "value": "db69f7fc059884aa00bf55bb46769056c51fc131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526350, "uuid": "1aadc446-320e-4923-bb3e-0d7c25078429", "comment": "Malware payload (SnakeKeylogger)", "value": "52d1e24ac73b3f2b283e1fb1a7bb9e1fa194d79abb0138cbfb4415197dae193d7073fd6bf32b783c5674797efd1f9497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526350, "uuid": "69e803cd-e93f-45d7-92c1-781b01a3da21", "value": "T18384CF06369882F5D7392A777A83930D3BA23CF5A943D24DABC3F15A09B23614D705B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526350, "uuid": "192d4fff-c4d9-4014-a542-c64acf483cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526350, "uuid": "0e278486-e816-4f88-ad9f-f526453cc513", "value": "6144:V6Uqd2GhNOfMS6VsA83QLw/594YjZULEFXxzFhvl4lZcDe:MUi2iN+MJVs4UpjZEEbFh9Be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526350, "uuid": "4c602989-1dcc-4cec-a097-7d3055f70f22", "value": 378944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526350, "uuid": "0042336a-20ff-47c1-9081-1cf2b44291e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526350, "uuid": "10043d9e-8e5b-4fc8-86fb-b46d39deb2bb", "value": "b1e87ca29d9e431de6d405f30d5376f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481377a3-38e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635533512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533512, "uuid": "ad2c8143-7c1b-4eba-a8f7-b28e0cab4af1", "comment": "Malware payload", "value": "6c4a4577b05acbeb2d7daecf27658d03", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533512, "uuid": "cbf5ac05-ceef-4449-8adf-0a5e562e27dc", "comment": "Malware payload", "value": "3b581601796d4459571b4079419ea4e33065675c4dfb309877bace18fc8d1f63", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533512, "uuid": "435d7b12-ff2a-4b8f-b4b0-4e112916ea91", "comment": "Malware payload", "value": "609fea5345fc11357c1d2dde6b33ac8db1d8b0f3", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533512, "uuid": "117d3e46-b297-460b-9cd9-0377bdecfa8f", "comment": "Malware payload", "value": "264e648eea798401eeda25f476da91220b2f5af9330b146bdb2ced1180c11277abb6443d4ee165b36abb5a38c3181ae8", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533512, "uuid": "538faa09-0ed2-462a-9fa7-9b5e6765240e", "value": "T18392DF7EF58B0A48DE56D6A8061A7BA5064DF51D72C440E23ABCDB387B5C8178B23D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533512, "uuid": "45dc1b66-5267-43de-8a3c-60e675136328", "value": "384:/8prEPKGGZujaDypqyg9e8GX9KN7JsJcohcIERHm/eyzqO7aQ/naiEec:/8prIKGGZujaDyAFtyJcohcIqm/1PN9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533512, "uuid": "44b1bf48-b6f1-4da5-909a-5ffe7e959061", "value": 21142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533512, "uuid": "cc079a84-6be4-463b-ae34-8f0f9b940c72", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533512, "uuid": "0f04a679-5390-44a2-9a0a-ac7cd56f6895", "value": "6c4a4577b05acbeb2d7daecf27658d03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5f2c37-38e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635532765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532765, "uuid": "17ce2b38-3858-47af-a609-e86188dc42e1", "comment": "Malware payload (Formbook)", "value": "b570d7c8836e9828981a3a801d287f1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532765, "uuid": "54164ea5-de30-45ba-a51c-93f07f13e237", "comment": "Malware payload (Formbook)", "value": "3cf411dfe4bd60c8bb4c7e0c77d0418c885e65570c7a5b8458d60cdf06423960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532765, "uuid": "6c266286-ab9e-4d37-bd37-233ffc23c790", "comment": "Malware payload (Formbook)", "value": "d1cb9a8d1823ca4785f4cfb1913f6ca3288ee96f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532765, "uuid": "51faa182-cbe9-496d-a231-65d319235a75", "comment": "Malware payload (Formbook)", "value": "18fb884183a681446f9c42aeaeb480b46c0cd24c7a9a735944bd3736aa7654a89e5f16894f452120e38038e7328dd00b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532765, "uuid": "d61c5004-55e7-4fcd-abce-d57c99105609", "value": "T1C084F145633897ABE5BC03BC40E2126557FA98633271F7695FD934D72E23B820E01BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532765, "uuid": "ce8acf4c-b737-49c3-bede-bba397fac904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532765, "uuid": "c365dc34-76cd-406d-af65-d6ef5fbf959b", "value": "12288:ulfZxbqB34vqFQThhGjnwdL9VaJ84TL2eWEq5UQI:ulfZxbnrGjwdL9VaJ80yQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532765, "uuid": "081a507d-f88e-4da3-aa90-b2eb01260a5f", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532765, "uuid": "0c0dca81-bc93-44db-9c32-f823e7728ab0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532765, "uuid": "2864488e-50fa-456c-92cd-a420a17687be", "value": "b570d7c8836e9828981a3a801d287f1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d8fa0e-38f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635537235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635537235, "uuid": "5145be5f-1224-49e5-ac85-be2f4dc72736", "comment": "Malware payload (Mirai)", "value": "3640ddff3622bee61c9a25deecc46753", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635537235, "uuid": "d436d4f3-12dd-4f0f-854d-b9b0d95dfcc8", "comment": "Malware payload (Mirai)", "value": "3dde2aa0f8245a930a5b4b292c6e97835d1b098c2ed4f1dcfe6a45f48f4a9fef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635537235, "uuid": "e6a8dc68-d3bb-4af7-bf9f-b2b245f4e0cc", "comment": "Malware payload (Mirai)", "value": "322591afdcbcd5d4c87d5e53676444048a820867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635537235, "uuid": "566a701c-85e7-40c0-9a00-88bfca055179", "comment": "Malware payload (Mirai)", "value": "a18c44094dc1804a58568ec4bad57924db3b98ae64c905633d3fd4d42d76aa3b95396d56b1b0574b8a43b1a0dd82acef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635537235, "uuid": "6daf77cd-0497-4bb1-9b85-1aa6d5dd9764", "value": "T105F34C46EA418B13C1D31776FA9F414A33229794E3DB73068D286BF43F87A5E0E57A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635537235, "uuid": "8d8b9dca-eabb-4873-aa9c-b41cad00bfbc", "value": "3072:JrE0wQVvhhMM+tKXaRGLKW3Sfz8azYEBPFsleM/96O1M:JrMQVMZsXaRGLKWCfXDBPFsQM/96O1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635537235, "uuid": "cf447395-c9b4-4d38-8d90-01575458b6b6", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635537235, "uuid": "ab012174-6fd9-439d-aaf5-ae9c5f80be77", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635537235, "uuid": "0be7f73d-c7ba-4f07-a7b2-a5f87eaac55c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e919d456-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635530347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530347, "uuid": "43a4261a-65db-4eee-9c88-13d1de79e621", "comment": "Malware payload (Mirai)", "value": "83c2ec1f380fcedba1a2ccbb69bdfd01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530347, "uuid": "1280a7ce-b2e2-4be7-b3b9-905d4bf07a82", "comment": "Malware payload (Mirai)", "value": "3f95d31666865e917884b92f5a5cb41c5cad0e1a742f6576d5e829e34ee2ea55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530347, "uuid": "d4f38df0-d771-4ca6-aea3-c85e7563ac23", "comment": "Malware payload (Mirai)", "value": "c70694354a46e680898518a44288c2822e6958eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530347, "uuid": "54405b0a-1c4f-41f8-bcfe-78c96a974cb7", "comment": "Malware payload (Mirai)", "value": "422b454109a4750b2380b4854cc25f6ead656e053bfff47ad606a56e2ffeaadb30b412f2e6d003780dc05f81e2bf24f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530347, "uuid": "2088ad5e-7590-48a4-b8ae-e1d1f671d4ef", "value": "T18A239EF3C02DDD98C54902797A285E3D5723F50086271EFB5E9A86A59007EECF60A7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530347, "uuid": "35db090f-f3ee-4265-825a-84593db64b8b", "value": "768:0ad/hnrsPxgOH59EEvo9Nhq/lJPtsqFaRxDazC7o+CqEprCrr:0ad/tsFZ/o9Nhs4Tqz+EhCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530347, "uuid": "090c5ec3-ac98-4fb2-af9e-0e240703f116", "value": 47220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530347, "uuid": "272216cc-5894-4e29-a1d5-7563bb926afb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530347, "uuid": "4bbf7376-9490-423c-a9d0-3270531ec14f", "value": "83c2ec1f380fcedba1a2ccbb69bdfd01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8053c5-3875-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635483831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483831, "uuid": "3af6d1d1-1cb4-43a4-86bc-cbbc59102312", "comment": "Malware payload", "value": "36c73a4536eb68c04b0fa019d16fe149", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483831, "uuid": "0ee11de2-73e3-4545-a2ad-e5744bfe00d2", "comment": "Malware payload", "value": "3fd36b9e8ffcffec6f18c3c698c9cd69ec01bb08aa2b56df07f395386e10c1f0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483831, "uuid": "78f169fa-9446-4375-aa8c-c344f71701e3", "comment": "Malware payload", "value": "c861aad2e5519fc14eccbbf46052ff2593ef3e51", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483831, "uuid": "31382457-0982-4a67-8ca4-1f74767c473d", "comment": "Malware payload", "value": "aea59350d7b0c61a8e4433320214411272c4fb2955ee88e22d7cbceb51e46ea4b7b90699d6c87414bd7749b8def89d23", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483831, "uuid": "6b8b4489-7b4a-43ff-b0ca-5de2b7e696a7", "value": "T1F7A39DF07358A9E1DB9E86438519BE9D0736F17FAFCA2588004AFBF9176B341890DC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483831, "uuid": "dedadd95-9921-434d-9fdf-a6e0a3e629c6", "value": "1536:oGNmNpIdfpeUpW+Zr0fpTkvgmk7cOZTOkhUtGU+F1iUJ/tRDYQVN8ATJ5G8ywBf+:oY5AOkN0Sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483831, "uuid": "1720032e-d1ef-4ccb-805d-577296a81fb2", "value": 99556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483831, "uuid": "b224c72c-dd76-4b66-a23d-359b69c9a62d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483831, "uuid": "e26a8c48-baf6-4487-852b-2015ba1f3754", "value": "290102021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee404fb-38e2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635530652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530652, "uuid": "fbd6b7ab-242a-4f75-ad00-a98f64353aa5", "comment": "Malware payload (Mirai)", "value": "32167ecd41fd0a0a2cf1cf9db65b9e0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530652, "uuid": "2e3d5c6a-db3c-41b3-9fbf-968da6a6468e", "comment": "Malware payload (Mirai)", "value": "404afa3c5ce562b339afd7e02b561168ec15a4baccdca22deb34024e969b6ef2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530652, "uuid": "41234c2d-50bf-40bf-ad82-83a415d85fbf", "comment": "Malware payload (Mirai)", "value": "b18653a994bfc98fbc6df17684cca4ac85a8cda3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530652, "uuid": "a99ea561-8317-4a38-ae2a-d052e0fd9a4b", "comment": "Malware payload (Mirai)", "value": "b8496f2449a7107c896d2097033e674286ac6e01821f85b46c2e635b7aa4a10756dde1bae1bc7edb7f97363b1d161b57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530652, "uuid": "fba7519c-64fe-4fec-aa1d-f73fb76af026", "value": "T19D836C61697A2F26C0E0E53F12F74365B2E1574E3AE8C61E7C620E0FFF2099065175B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530652, "uuid": "34deeab8-14e3-41bd-bad8-df5194f6969f", "value": "1536:VhT/5UtCT3Ev/UzSEAMT0PY3TlXNFKFGUDuT+h:vOcGNolRUDum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530652, "uuid": "37321024-f102-4075-bb73-7f5841b6456e", "value": 82952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530652, "uuid": "c258a6bb-843f-4509-9c7f-400f28e1d71e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530652, "uuid": "498997df-f3a7-4d4e-afa4-f8cd262e5a3d", "value": "32167ecd41fd0a0a2cf1cf9db65b9e0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd5c3bc-385e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635473822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635473822, "uuid": "669a1425-c106-46aa-9bb5-a4075fd25ab9", "comment": "Malware payload (Formbook)", "value": "d25773010f5aed66b9b5f79b81983593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635473822, "uuid": "4935375c-d852-43c4-ba06-011b9f13420d", "comment": "Malware payload (Formbook)", "value": "41de1c603509906c3ddcb2550617c980ba3dd192048a52b449e3894d94e1bad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635473822, "uuid": "d3749984-2178-471f-849f-4373c25f5937", "comment": "Malware payload (Formbook)", "value": "71dc0f0edb6940bc05dd9e7ee27f1e248c789c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635473822, "uuid": "668b4cd7-9db2-4bea-8f49-26a62502847f", "comment": "Malware payload (Formbook)", "value": "ece7f7ae037a414c2b85bf6a5d0a1aab7724fbaf88411c3197c7734a89ecf4ef85ad610f65496e76a51a3f28df115035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635473822, "uuid": "d64feb85-ed98-47ce-883b-58cab644c38c", "value": "T189A4E00163E54A26C77A0FB6097321101BB1B9573D62D78F1EC860DE6A7EFC50981FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635473822, "uuid": "9ec66040-397b-403f-a716-4fe6f3362af6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635473822, "uuid": "66e03731-2288-4cc2-a564-a061bd2b74e7", "value": "12288:BkheNK7QfyTyiY327xuo6/QwGa75oRH0N3:meNKRTyiY32kb/jy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635473822, "uuid": "17bee3bb-617a-4150-abc6-5ba8ed44a16c", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635473822, "uuid": "c36eb00d-b65e-434e-a5d6-3ea58e707c82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635473822, "uuid": "abb1ce3a-0dd8-4e92-a3fd-15b1482bb22a", "value": "Order No00020212910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c926b36-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484020, "uuid": "ed7127b6-6cef-40d4-a0d4-451f4e33e976", "comment": "Malware payload", "value": "791e527a2082e6207d1ac9b9b4550fdf", "object_relation": "md5", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484020, "uuid": "cfd18e6c-9046-43ba-b1c0-89fb085b4ddc", "comment": "Malware payload", "value": "4228efa547d22dcf38c44243e1e468a2ded17d4997b728ebf88c79d12346fca4", "object_relation": "sha256", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484020, "uuid": "86a7fcf7-d46f-46af-adb6-d186e249e1c5", "comment": "Malware payload", "value": "88a5a6d55becf367a666d5538a2683a9d4c8c3fe", "object_relation": "sha1", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484020, "uuid": "78c25141-8d7f-4c75-9365-9a01b3555d68", "comment": "Malware payload", "value": "dde416286d59191fd814955ba965b28f2d39129480d0c46931ef99a05f3fa4fdd139ee6ab12df8d6f01fb320356b75ec", "object_relation": "sha3-384", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484020, "uuid": "dd5dffb8-8687-4a8f-a817-00811ce26c84", "value": "T18701E20C4D822B22C331CD3A04DAA31384357A47EDA2AF6A01E417D92529210E275DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484020, "uuid": "eed3c166-eafa-46df-90e5-3bdb1c949a97", "value": "12:8AlXGC3pQVe/4VfgFDGR2W+feDJLiDmNf7+lbYqlKBnml1kK:8ArpQQXF6J+fe5Lzab/oS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484020, "uuid": "715804e0-d4b2-4f20-a33f-284af08e6562", "value": 708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484020, "uuid": "eaa8d4ec-d0bc-4657-b8db-8905e9f9431c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484020, "uuid": "81922511-3ca9-4fcf-8301-39291aadfc9d", "value": "4228efa547d22dcf38c44243e1e468a2ded17d4997b728ebf88c79d12346fca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f336db-38e9-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1635533568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533568, "uuid": "6193dedb-5623-4b29-863b-7c02504192a8", "comment": "Malware payload (BitRAT)", "value": "26c16490a5170b645ca2b363589f0a3b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533568, "uuid": "a3556bb8-18d3-4cd2-880a-f6ecc6c891b2", "comment": "Malware payload (BitRAT)", "value": "4251ebd4c8908b8822ca47a236a24b1e537602917e8ff9b45f0e430a0702922a", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533568, "uuid": "f33efda3-c739-4466-bcd3-558d45296d8e", "comment": "Malware payload (BitRAT)", "value": "239f7bb70bcffde9718be12746a70cdcaa870171", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533568, "uuid": "58e6a30e-4a60-46cb-a9a7-50e04af7b290", "comment": "Malware payload (BitRAT)", "value": "c71feadb292c978631b2d55c4bccc707fa3a7d0d225cdb5c7351763d44e2c0138013bd4f4cc4419c64054b730d855815", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533568, "uuid": "42eb9b45-503d-4c5f-a68e-6b31f0cf9dad", "value": "T1C225AF07F2C09C7AC0727AF85D6762AC9A27BD252915FC8537F82E0CAF6D2D0741A467", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533568, "uuid": "041e64c6-51b9-46e0-828e-887379275458", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533568, "uuid": "8cc9f89e-41f6-4cb2-840a-fa78b8e3e6c6", "value": "12288:qXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4JA66NuLpjqayC94M0LdEegD:q4uBfTG2pM9o6NN+swhY4qMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533568, "uuid": "e0de3226-1fe2-48da-b8c1-b0e59613232d", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533568, "uuid": "013a02b0-3d5e-42e3-90b7-73e5efc767f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533568, "uuid": "68a314d2-42a2-467b-94fe-7ea8e8103423", "value": "Enxhyacvpdnlapppigsqmcxwkooppbewmx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bf45e0-388d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635494094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494094, "uuid": "43db9116-b524-4db4-88dd-b1a2be814231", "comment": "Malware payload (Formbook)", "value": "c53b928439c63be72caa6984a1e52211", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494094, "uuid": "6f1cffde-02e6-4fc5-89cd-2a954436c31e", "comment": "Malware payload (Formbook)", "value": "4251f83558d8e813b0d715a87d964d020b0b0cdcdf6876da5285dd3d01f5ec38", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494094, "uuid": "67f10d9e-2a58-4a5d-aa36-256fecebdee5", "comment": "Malware payload (Formbook)", "value": "b1095bd4820ef7dc277a6f76218e380e141e5b85", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494094, "uuid": "3d505c1f-c598-4ccb-8696-ad2700850275", "comment": "Malware payload (Formbook)", "value": "5df3862e2803562991cade83a3b477d754dbd4e83ab71ed620f9a1906565d1a32f05b11196ca34891d68d655d049ad73", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494094, "uuid": "c2d951e5-c0f5-4c39-bfa6-71f96316a353", "value": "T1A8B4234B166F399C4A923AA83796312F3D142718D8B2A61B3FB6C47C5A350198EDB432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494094, "uuid": "67cc82c7-0694-4974-b635-15979732296f", "value": "6144:5GP9RUvsZvPrRYr38jkUvg8UD2DKwZp3udL4fV40YEXDasbJjR1+wPqsOzsHl8:UCsFrW32RdySKw2l4fS0VesxREwSWF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494094, "uuid": "73a7222f-769e-47ed-ad2f-be7eb35dec5d", "value": 517621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494094, "uuid": "1931ed69-6397-4e6d-96fc-2fbba973c668", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494094, "uuid": "222b220d-3d78-4ee5-8ff6-30ec358ce55a", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442cce81-385b-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635472517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635472517, "uuid": "77a94c1b-d078-4b91-9c10-b770c9f35668", "comment": "Malware payload (DanaBot)", "value": "4d8402ec09f9076ed9edc4841effff68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635472517, "uuid": "c6d763dd-6423-478c-813a-47e9e2c5939b", "comment": "Malware payload (DanaBot)", "value": "42867a85488fa02a8586ae78c033bfd5c4324cef6395b7e15a483c378c34904b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635472517, "uuid": "8390d985-1d4f-41d6-bea6-d29a68e1074d", "comment": "Malware payload (DanaBot)", "value": "74e1ba7ead83ce2a5d8bda8e1c761e2ba5b45e8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635472517, "uuid": "8291f6fc-e0ec-4012-ad59-2eff679a1084", "comment": "Malware payload (DanaBot)", "value": "9a7100b1de13196a9a5c416b0be693a422150325913573423ee19231a95938aefee5ca30ec1d3b75505dfc3fa2d81f9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635472517, "uuid": "fff8bbae-8357-4071-bf9d-f107acaad450", "value": "T1135633162A5A94FBDFBB1C320ECCDE05364A78747DE158E03B13568A6470C7ABA271C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635472517, "uuid": "913f0701-772f-48b6-b7ff-23882797e00e", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635472517, "uuid": "50c806e3-cef8-42f5-b18e-350fad9a39b5", "value": "196608:Wt9UHEoXAELJup0Mf3PKlr8izyLgHPSDrNtFbz6z:YqHbLJuf3tHLgHPSD/JzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635472517, "uuid": "45e98a25-07cd-4d9f-b340-2db1e16c0cff", "value": 6309922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635472517, "uuid": "cb4b634e-e237-46bf-997e-b313862cadb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635472517, "uuid": "1ab7370c-06f9-4267-a171-e55a3d4430c2", "value": "4d8402ec09f9076ed9edc4841effff68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4a05e9-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1635526193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526193, "uuid": "3c3f2705-7fd9-4db7-a95b-0135853a484b", "comment": "Malware payload (CoinMiner)", "value": "f96f0f70b1298db2b3e378a8497b5c56", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526193, "uuid": "64892e64-9c8f-4f87-a29a-401e42a3be32", "comment": "Malware payload (CoinMiner)", "value": "42d8660460520cc995d9e871953c424a6a95cba8796fa763fb9ebe46cbc7189d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526193, "uuid": "69d7b0ee-6956-4814-b9eb-3257e32df8f6", "comment": "Malware payload (CoinMiner)", "value": "c5fa8d3724621a3e60426a5ab152becfd9cb00da", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526193, "uuid": "a759c75a-fd5b-4109-83d8-be737c1261c6", "comment": "Malware payload (CoinMiner)", "value": "9c000451115cd0ec7721c83a112f9655c156a55109eff276399439335134012c3f42dd595ad41c86c743f9e17a5eabe4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526193, "uuid": "b1a03525-4686-4419-8992-f215cf4a4a8e", "value": "T183A53306B3218CB3F6467A7064F75DF723E6CA16896A87820BC92E27F451166043FD9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526193, "uuid": "7d0a5175-499e-4083-870c-971cb72956d7", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526193, "uuid": "70365e26-7bd5-4e88-9db4-46c64a902019", "value": "49152:e1R5Zt9svSJNDF4AcSb3BPkQ0W8zsF3UloQSf0zGO:6QSJF4yRcQ0WbCVSKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526193, "uuid": "9d2e635c-92ce-40a3-b0dd-dc9407c52965", "value": 2102631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526193, "uuid": "f4198810-089f-45bf-9575-6f4c14c81bd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526193, "uuid": "f4a7dd40-7701-4699-a337-dcf56dcc9539", "value": "f96f0f70b1298db2b3e378a8497b5c56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dee3a88-3875-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635483781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483781, "uuid": "66e3045f-d778-4d77-bb1b-aaad779075bf", "comment": "Malware payload (Loki)", "value": "29078dbe726973e076f4391f7f495df0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483781, "uuid": "9a796fd4-8ce1-49ad-a14d-d34122dda073", "comment": "Malware payload (Loki)", "value": "450b24cbbef66abf47379692556145f7816ee0ace220d552963b34bff393fa61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483781, "uuid": "9a44b733-ae8e-4cca-bdcb-f97cbe807f2f", "comment": "Malware payload (Loki)", "value": "ec2852af48bc42dac2c0677f2ddde12d6b791a19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483781, "uuid": "9e766544-aaaf-4b81-bc35-26cbeb75f11e", "comment": "Malware payload (Loki)", "value": "976dc6af6e55be634ca7d195b3e61b722290249d9c1f012937943b158918f8a3b3dfa49524a6eecc8e2a493b363324f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483781, "uuid": "8c1f8cb1-2379-47f5-8401-f3fd2a8211be", "value": "T19D04D036EFA81975F15341B21DE5E6B43A627C529A00CD4722C5F9680DB2A43BDF232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483781, "uuid": "6db86368-974b-4726-9e8f-f8750734e419", "value": "3a196462f17f4821d4c80ed2f22a0dfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483781, "uuid": "b37a83be-3b3f-436b-ae0a-296f2d22a0fe", "value": "3072:pcENNI5MoSnvbiKakpgn7Wb9PG54/g+rlzid7dTiXekXB:vn2SnL4c9PGagh71MB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483781, "uuid": "c6d9a278-08bb-4098-a6d7-52d6ffcc86a0", "value": 184248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483781, "uuid": "0ede217d-1b3a-44b0-8746-01efadd7d654", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483781, "uuid": "9fb84d42-bba4-453d-a620-39388d721743", "value": "PO99817581.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053d438d-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635494746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494746, "uuid": "b5fe9972-b28d-4329-9142-c8cdbf8c2b9f", "comment": "Malware payload (Loki)", "value": "bcaf06dc176c435ff3e569e9f296f8d5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494746, "uuid": "9fa70dd8-0cdc-44d6-a3c4-74ebfc89b3eb", "comment": "Malware payload (Loki)", "value": "4541687d828cff421786a7293db48eb834902b486438f581f60ca1df041b873b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494746, "uuid": "c0deb745-5f12-4f50-8863-7345d79e772d", "comment": "Malware payload (Loki)", "value": "9d18f3b980dabe7aa1ea50313b18a9bf19551616", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494746, "uuid": "6b6d4c17-e514-43ff-8bf9-89289db5fbc3", "comment": "Malware payload (Loki)", "value": "7ce038bb7358eee7bda17d574a9313af1c5d0cc2a23bfb4e8ebe43ad6e319d65f8be8c445f9148cfdef6870933eb483d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494746, "uuid": "e0b335b6-60bb-45d2-b3b7-b1bc274e33a5", "value": "T141A4D00875B5275ACB9BF6F628964D7B6F005F2693539AA730CA73138135F13E43882A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494746, "uuid": "5dc2e6d6-8a4c-48a6-8b20-b5d0255c46a5", "value": "12288:RyId2kaRavXQCFAShFjO41uYOFwMlushHC2k4xUu:Ri/gvB6SHj1+F6shHDV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494746, "uuid": "46bd4994-06d0-493a-b449-b6cad0c61848", "value": 451864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494746, "uuid": "d40304ba-4f2e-4069-8d85-3bec82925c85", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494746, "uuid": "1ecf916c-cfdd-4845-bf70-6c07548d1bed", "value": "MV SYROS ISLAND.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdadf67d-3899-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635499377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499377, "uuid": "2f829b2f-0f21-4ef3-9603-ee5205b29f26", "comment": "Malware payload (RaccoonStealer)", "value": "65b4a10ea545eba0864ad19cb6a52344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499377, "uuid": "a01ad3b2-c10a-46d3-ab80-4ec911109305", "comment": "Malware payload (RaccoonStealer)", "value": "454c6911d9c1366004780ba02560dd9d9cafb4b211b604143629320b6a990c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499377, "uuid": "e910a1dc-0840-42ab-b528-4cf3cd942ea7", "comment": "Malware payload (RaccoonStealer)", "value": "1a03599b8f379953042fbdc3bb796bdb8cb637d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499377, "uuid": "f671da68-0441-401b-820f-4ca1e72847d2", "comment": "Malware payload (RaccoonStealer)", "value": "82f2fbc750a635797a58e8763312fe446f11fbdb56f854ff903e04bad8e4c12c6f29e8b6e1185135e236c3394b4204da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499377, "uuid": "416454d3-26fd-4954-80e1-6bc42d369f47", "value": "T128D4E010A7A1C034F2F752F459B6A268A53F3AA16774A0CF23D526EE4774AE0ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499377, "uuid": "0ed97879-1527-4b7d-8396-b3481d0add8a", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499377, "uuid": "f915eb9a-50d7-4e61-ba4d-060d25f76bdb", "value": "12288:HRsKIWR0mDkYsNa85wUY3r9UbtG44hPegxHmzJyfZ:xsijDk9aotGDtUJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635499377, "uuid": "4adb91f6-7ca8-47f6-88a7-03ed28d7ab0b", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635499377, "uuid": "df9ae93c-92ed-4522-a7c2-1304e0b5e8fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499377, "uuid": "68c415f9-6a10-4350-b1a8-4c0aa83e078d", "value": "65b4a10ea545eba0864ad19cb6a52344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1867e9-3877-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635484822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484822, "uuid": "2c82de08-9e55-4f6c-801f-fca92f9ad144", "comment": "Malware payload (RaccoonStealer)", "value": "bef5f08ba35ebcd7398253dc6e56b84f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484822, "uuid": "f576d1d6-d2ac-41a4-9857-46c77c43c77a", "comment": "Malware payload (RaccoonStealer)", "value": "45df89746c787b84b94af23a4bd20cef022c5ed3a34a424a713a4d4052abd927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484822, "uuid": "9669e1d1-80c9-4669-aa61-34cd141c1558", "comment": "Malware payload (RaccoonStealer)", "value": "4bf7aa08549f0d3abad920828b23cefab84fda7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484822, "uuid": "02963b4b-1ca5-4498-a035-c279258f94eb", "comment": "Malware payload (RaccoonStealer)", "value": "f56bd02486b40cf58b47906eb809a0dda5b70cfecc53d62a4dc86f26332b77efef39ade67a22a18990d4cd25df386a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484822, "uuid": "cc91059c-5f60-41d6-927d-c02e86821160", "value": "T139A402F576A9C031C5A32A308D648A941E7B7C22D870954E37741B9E1F73ECC6AE631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484822, "uuid": "1673c3c5-e03e-44b2-9617-0f581862f1db", "value": "5ec7965957c5433534918911424a4e5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484822, "uuid": "013a6be6-5f13-46be-bfa4-58d3541e062d", "value": "12288:bfr9XsP2z7PQE/ergCtL2PkaO9T1wJtmrWunnn7:P+4rKgM2PPJtmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484822, "uuid": "a85a5fb5-d577-4921-90a7-2f7036d3e2de", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484822, "uuid": "8cf22474-74c2-4ce2-9128-f1e25b6c0411", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484822, "uuid": "e0bcfbca-ac04-4f77-9bf7-9075d2292811", "value": "bef5f08ba35ebcd7398253dc6e56b84f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a9b2d5-388d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635494067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494067, "uuid": "56f19fd4-a0f7-4972-9626-cd8f1c9d31a3", "comment": "Malware payload (RemcosRAT)", "value": "a2c487386864ff13a813df5d8850d9ac", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494067, "uuid": "434a1c3b-bc17-477b-abf6-9b750eda282b", "comment": "Malware payload (RemcosRAT)", "value": "46d6f81151b7e6ca9c8d50b57efd424b6cf4256d44f320f15e6d5fe52b206db4", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494067, "uuid": "35a5fe26-8f28-4b6b-ad00-ae81ec4e3558", "comment": "Malware payload (RemcosRAT)", "value": "e47c94bbe947c7c746b69ad17e31b98ef7bb0c1a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494067, "uuid": "53046fad-2003-4dc0-a184-07b8579c860f", "comment": "Malware payload (RemcosRAT)", "value": "286d46287122829062c5440c96c132f54022b0146e25230f605154649c72091dd4b3ce2941bc4d4e04a668f0e5adcb8e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494067, "uuid": "b9928795-aab7-427c-9ce5-cab13237613d", "value": "T1E48423F27030BF387969D964D1BAE4B5F26F7B4B991E8341C03466DE1202DB30766AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494067, "uuid": "40759a21-59d5-4414-8353-8f3cd40cf009", "value": "12288:pWo1Iz7RqLRi5i+iaPCt+sWs+HTWwgsU3:pfGz70irPCt+sl+zWwRU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494067, "uuid": "c12d5ce7-e1f3-4056-b3f0-7aec98264739", "value": 404750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494067, "uuid": "fc1e1073-8be8-4115-88ca-12dc38257e65", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494067, "uuid": "d944d08e-4c78-4352-9ee9-78be749ee7e0", "value": "PO#BTX18000211.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa67639-387a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485869, "uuid": "859f0f3e-ee2d-4f1e-ba0f-a7841b35b189", "comment": "Malware payload (RaccoonStealer)", "value": "61f3ba81a9f543af788b63a9c2070a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485869, "uuid": "6b17d738-e84f-41e3-808c-3605edd0650d", "comment": "Malware payload (RaccoonStealer)", "value": "47059697bdfbb3366a739a6f2c0e298ce1246bf81b98ab2e10fb7f049d627618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485869, "uuid": "02aad311-320d-42fb-8d09-927f8a8edf1b", "comment": "Malware payload (RaccoonStealer)", "value": "b19ae67ca547f4491e397973b82463c655d97592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485869, "uuid": "e3d4f25c-b1e9-46d8-b4d6-d486be9357b9", "comment": "Malware payload (RaccoonStealer)", "value": "80bbbc0128e4967452c468bd7431428f548747a4feec2d349ac54e64aea0facbed85fd2263bfa0fbcd9a3954363c8500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485869, "uuid": "5e465930-a288-4346-b1f4-1c5acedd7601", "value": "T1CCD4E000B6A1C034F6F712F44975A269B93F7EB16B7490CF22D526EA4674AE0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485869, "uuid": "73aa8c95-58d7-4221-b408-b3c930e76c33", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485869, "uuid": "3343c2ac-ddd6-41f2-ac26-2181211c3c91", "value": "12288:Hwr4zMWUDWF5h3FUgdyAF52GZpS1SGWx4kys:Q+t5hRp52igsly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485869, "uuid": "3c8b0695-073c-40c2-b677-390bb5dfb9eb", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485869, "uuid": "bee01c3f-ecd7-4b55-b17e-3faf22f2aac0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485869, "uuid": "9cbe4000-a34b-46a7-88fc-ab57883772bd", "value": "61f3ba81a9f543af788b63a9c2070a4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc5dca1-3898-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635498756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498756, "uuid": "83f13125-b7f8-4d18-80a4-f66632321d18", "comment": "Malware payload (RaccoonStealer)", "value": "bc0bf0526be1bfbb272278e129f36277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498756, "uuid": "c98546c1-edef-4a10-acf3-4b98fcee0680", "comment": "Malware payload (RaccoonStealer)", "value": "476d59d84e2a25f5fcc3dd2efd952f138ddd5137d7d5aa0c6cdff9a23b95ea95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498756, "uuid": "a29e4049-d32f-4429-b9d9-62d13211a860", "comment": "Malware payload (RaccoonStealer)", "value": "d6e5fa4129654f602417a99d62e1ac51ed782010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498756, "uuid": "8a28d739-c436-44f0-8085-ba137e61d128", "comment": "Malware payload (RaccoonStealer)", "value": "96b7992fbe6dde7dfdb449af017de01c1f3c26a05c37b70a5cc6556df1fef5d524daed3b000b266ac756168d3bd124a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498756, "uuid": "46a09f75-d0cb-4b7e-aa5c-90e1215d3538", "value": "T1D0D4E000A7A1C034F1F662F84AB5A2A8A53F7EB1673851CF13E516EE5674AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498756, "uuid": "85786064-398f-4ce6-aff4-d30898a36bdf", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498756, "uuid": "2d23094c-6737-4fef-be18-dfd43c35a84d", "value": "12288:lGGMnXpPAsX59c26A0D+2Ojl/MP+wWVT/ue:sGMnXm0J6RD+lJqS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635498756, "uuid": "1d891c12-59cf-4135-aa9c-f875566ed795", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635498756, "uuid": "d95955f7-d081-405e-a1df-23bb824b9c09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498756, "uuid": "08b66b1a-d735-40a1-be2f-449d467db319", "value": "bc0bf0526be1bfbb272278e129f36277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb43389a-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485253, "uuid": "65cd3ead-8464-4ba4-a245-13613241533a", "comment": "Malware payload (RaccoonStealer)", "value": "79536b699c8f0ff0e17ff00baa67cea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485253, "uuid": "1fbd2a92-a419-4f60-a4ac-1a443a1a1547", "comment": "Malware payload (RaccoonStealer)", "value": "47f6bb4e926484b7abe0ed7353f8a88b685f7d43bc265ef4c86a1b7c3b2abde3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485253, "uuid": "5145160c-9215-40da-a69d-316947554a5f", "comment": "Malware payload (RaccoonStealer)", "value": "507997574eda952f16cc78602f00e3cc9ece258c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485253, "uuid": "256b5996-3fda-4ebd-af27-5a2abadbb6b3", "comment": "Malware payload (RaccoonStealer)", "value": "cb9f83f6b4a487fd89192a188112b1b8e187b10495e9af2cc41a3b462efb9251c22501909a53b86427fa89504590591f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485253, "uuid": "375e9fc0-d82c-4779-9546-5b9e04bf2bb0", "value": "T12BD4E010B6A1C035F1F612F44976A368A93F7EA1A77491CF22D516EE4A74AF0EC31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485253, "uuid": "a0d9b297-25f5-46f7-ba91-0aa7028862fe", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485253, "uuid": "e12568a1-1774-4ddf-b1e4-e0430abcc0d2", "value": "12288:BdDnostnD+6KVnu7mkgpEjCxrGB7YEEB:/Tosh4wngpEG9QE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485253, "uuid": "30d8c890-9f00-4f85-a01a-774b246318f4", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485253, "uuid": "b7398120-2413-4f18-8d85-52634bbfdfa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485253, "uuid": "edb924e9-3357-4f8b-b9a1-429386fa1b74", "value": "79536b699c8f0ff0e17ff00baa67cea6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa567fc-38f6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635539342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539342, "uuid": "b35d1ab2-4199-45b4-a16e-54e375ef1a87", "comment": "Malware payload (Mirai)", "value": "e366ab6bfd7da8aeee5f5e28d1ed1fce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539342, "uuid": "9515b152-65e7-44ed-a805-ff8f578429c6", "comment": "Malware payload (Mirai)", "value": "48bdf9916ba6c297f36d6f1c284b2609d77a699ba79987a857c11417ffdd6960", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539342, "uuid": "cd0a40f0-f6d4-470b-917a-fe937a941332", "comment": "Malware payload (Mirai)", "value": "70d8678dd353236acb7298f9e0e527ac5a9386b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539342, "uuid": "ff77f03c-777a-43db-b0eb-7fa8578629ae", "comment": "Malware payload (Mirai)", "value": "4c29595473657031f5b919f68de2d0d62208add0374e88d5c7fb3f7001cd93b1f868b4f42ff00a8bc70e080c0eb53b4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539342, "uuid": "d4718337-03d8-4c71-a217-cf61694bf00b", "value": "T14A64F1CAFF11AD3AE9C006767AAF074DB3B59B99C3C3F150F250C61A39A91859F76084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539342, "uuid": "740d5f77-e542-48ab-bb0b-6d5e745178d1", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiozsKqqwPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiKsKqqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635539342, "uuid": "5c72b5fe-ce80-415d-b275-9674727e2b7b", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635539342, "uuid": "5976af32-297d-4f27-a02f-dabdc68c7976", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539342, "uuid": "8079e4e3-2aa2-41b6-a6b0-ea885d18097f", "value": "e366ab6bfd7da8aeee5f5e28d1ed1fce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d7de1c-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635484303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484303, "uuid": "1e964210-5204-41ff-9a89-a81a04123997", "comment": "Malware payload (Vjw0rm)", "value": "0355ab6db7841384d49c07c3bc8c0013", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484303, "uuid": "0f4a1f48-1210-484d-a651-52dc8b166a1c", "comment": "Malware payload (Vjw0rm)", "value": "48cc3d563d8b6760056dbe7c6d37482643b8fa6a91bf32ba88adc038f6595475", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484303, "uuid": "438253ee-9340-4854-a779-ce2b02ec016a", "comment": "Malware payload (Vjw0rm)", "value": "972660496f6751ec26929b891e891e0bdfc6a23e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484303, "uuid": "bb4ebe41-312a-4475-afea-2eae108d884b", "comment": "Malware payload (Vjw0rm)", "value": "699a38e0b65ca030226db762b4e855ed754e57865b2e3bbc4853045bc823e54ad31349631cf3f1a7d0deb02872e749cc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484303, "uuid": "d267884f-568c-4577-8cc2-59bc8f1f3993", "value": "T16D838F019E431CC6F5B5C6A2209800E4DE17A6F4CF6AE4DADE4649CE0EEF24767C7E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484303, "uuid": "180e7709-0b78-49c6-baad-caa16f6be011", "value": "384:APnPI1gYzbBg55m/3guL67X/g/W/W/w//a/t3J/QSOm6wUgX:vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484303, "uuid": "7444b85e-f29a-4e54-90c5-aa38f6177a15", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484303, "uuid": "8c8ed6ed-87eb-455d-8092-2a5caa7ff17d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484303, "uuid": "ed0ab6b9-d2ab-4b6c-8737-d7ff8de3f927", "value": "b3m7_Payment_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb88927-3851-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635468426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635468426, "uuid": "912d8c42-50e2-4a6c-820c-89fbefffdc99", "comment": "Malware payload (RaccoonStealer)", "value": "57d5b93c5aaa58f9f71d957ed29cdcb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635468426, "uuid": "1c89e0ae-5abc-44e5-91f6-42ece6b6d98d", "comment": "Malware payload (RaccoonStealer)", "value": "494a9acdbf459f552a136a263ddd7ccb8e5df1530f1244c621a3b4f0d90a799e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635468426, "uuid": "31b88ef5-9bfe-4efe-8983-fec2ed76efef", "comment": "Malware payload (RaccoonStealer)", "value": "1c885f2a17681ce57765e85b36d5d5bc72bd28a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635468426, "uuid": "ecbef836-2514-4be4-b95c-b5fb9d8bc9f8", "comment": "Malware payload (RaccoonStealer)", "value": "4c6f3466bcec5f1f1f07ecddbe5421ce30082c84c100c810b4398f24f66be88367061e29d8d6e2ff2a61216e8d877964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635468426, "uuid": "a5b8a59f-faf8-46ba-bd01-4ac6719d2e71", "value": "T14DA402F2B59EC076E01779304C75CAA9592ABC31D520C04B7AB42A6E2D71FCD5EC932E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635468426, "uuid": "90880e9d-81d8-45d4-a4a9-6022277fdb84", "value": "18875662b19ade4ddd6bba43f9abb4a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635468426, "uuid": "61d37315-f9ac-4667-8a62-a5c8d97ba27e", "value": "12288:+2+RlQkBgGaFSQlUBWiCJuD/SBhMxJoHKAXnjunnF7:MwggllWWeUeJLAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635468426, "uuid": "0335590f-9ce4-42ff-9c8d-ef30a0947f65", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635468426, "uuid": "6f0288b4-7157-42ef-a81c-d310a73f6676", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635468426, "uuid": "d8347e55-5c82-46c8-923d-2c67c9150ef7", "value": "57d5b93c5aaa58f9f71d957ed29cdcb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3cd956-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635484988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484988, "uuid": "bfe307a3-b909-4467-b34c-35f6cdb79379", "comment": "Malware payload (RaccoonStealer)", "value": "5fe07134abda38e8870c74150caa6b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484988, "uuid": "1866ccb8-2a78-4c59-a54e-914db12d348c", "comment": "Malware payload (RaccoonStealer)", "value": "4ac1fd5714d68c3a015611027bd42bd354207d7f9c8417a63a4da31295580ffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484988, "uuid": "de1f4c8f-5189-4e7d-bf83-4e8d4b140f2c", "comment": "Malware payload (RaccoonStealer)", "value": "2e50a2dd334ce25c29c09f89e71c42b3242de3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484988, "uuid": "66fafcc4-9d3b-4bf7-8384-a1ef0a54652e", "comment": "Malware payload (RaccoonStealer)", "value": "178d298a49a6ffdc4d94937da08d649329a8f04ac887c1a5a24b32df1ddcd6dab03fb211880294eeb87e92999555152d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484988, "uuid": "68b2992f-5884-4989-a0fb-dbfd277cc049", "value": "T1F1A4F1F27299C832D45339308C52CEA04E2F7D51D5A4C94A36782BAE1B72ECC56E635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484988, "uuid": "110dc7d8-b6b7-4ac8-9dc4-3fe440875510", "value": "3b1199a1c69f3c58e3fe863179769379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484988, "uuid": "caa84d25-f640-42c9-8a6c-325d28e0e36b", "value": "12288:oyOweLyQiLY8HMMQy0N5J0xMlDyunnn7:oZqgJ0SDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484988, "uuid": "b774dcb4-e98e-4ebe-8b03-393c4a3fe905", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484988, "uuid": "e4ef0dac-9ca1-4f9a-be36-9467bb39e449", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484988, "uuid": "1d54fd45-d425-4d3f-ba25-fc9c24dda37f", "value": "5fe07134abda38e8870c74150caa6b68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc7ab4f-38d3-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635523993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523993, "uuid": "98c15141-f8a5-4740-b6ce-7446f929eee6", "comment": "Malware payload (NanoCore)", "value": "40b8eb513d3b5150daa1f62be7e10b64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523993, "uuid": "d75849ef-5b00-46dd-aa6f-67b5ae61ddfb", "comment": "Malware payload (NanoCore)", "value": "4b61697d61a8835a503f2ea6c202b338bde721644dc3ec3e41131d910c657545", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523993, "uuid": "ff34e4a5-c8d7-421c-b51c-c1f601e3090c", "comment": "Malware payload (NanoCore)", "value": "84fd5b160e4e48a6eaf814767c60ba3e2e9d324c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523993, "uuid": "b9bee62b-0def-4e04-9d0e-9c3c830d7687", "comment": "Malware payload (NanoCore)", "value": "c5d57b999815cf8fc446ce0005bced5c2194ca31679ba2b422301013a562f33c0b0a6fdabcfd5739e0f411baa9b3afa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523993, "uuid": "9c90b150-9930-44c0-b233-f154b33d72e6", "value": "T1ED14CF567BA88A3FE2DE867D601215129379C2E3A8C3F3DF28D415B25B667F04A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523993, "uuid": "7aab52cb-fc69-4051-98ce-031fb66e363f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523993, "uuid": "ecf82f1f-9fd5-485f-a92c-8e6969229d26", "value": "3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI5PIE8nA2VErmL4llWrg1933sj:QLV6Bta6dtJmakIM5xEYA2VcmL4lQ0sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635523993, "uuid": "6ed198b6-6cbd-4081-8cae-f1a0c2f8def9", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635523993, "uuid": "5d1cd7af-32c9-4fb7-9df7-7d8b7bac5610", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523993, "uuid": "987cb76d-fd2d-4e49-af50-567373c70801", "value": "40b8eb513d3b5150daa1f62be7e10b64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d88932-3903-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635544563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635544563, "uuid": "16b51c3e-4df3-4369-a59c-f6e1bd03a0ec", "comment": "Malware payload (RaccoonStealer)", "value": "d0cc848be4f35e61c5d27310841fb514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635544563, "uuid": "efc400c8-3c6e-47a4-8028-2f332d0b17ca", "comment": "Malware payload (RaccoonStealer)", "value": "4c28bee4f8fb8af42fa504549bd0f6fcf33064768fc81fd7cf0fce5db38673d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635544563, "uuid": "674e1735-104f-4ac9-8a86-d4a6a92e16f2", "comment": "Malware payload (RaccoonStealer)", "value": "ffe9b08fa8c60efd3f42281c8082ece081075ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635544563, "uuid": "38a5a752-07d1-4631-b59b-7859c6f89df3", "comment": "Malware payload (RaccoonStealer)", "value": "36ff9998d7bb3f00db9ff0712b8d5f78f9150e4fe3078bfebadd467203c7bdba4a0e83139985e7a11968d30f850998b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635544563, "uuid": "a6ba2227-bdd3-43ae-a4e7-1fa225b99f4f", "value": "T194D4D000A6A1C034E5F622F85A76A369B93F3DB16B3454CF12D517EA8A74AE1FC31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635544563, "uuid": "a72bc9f9-7f5d-484f-8fdf-21736c6c29d6", "value": "518d84bc9a231f5bb2827b0550b9f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635544563, "uuid": "861dfaea-d4cb-489e-87ec-3c3dea999946", "value": "12288:jkDd0c866gSPcyx0Tc6XKDtsuJkcqFu/ffSofkIKl:47ug2DxwtuDqEhfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635544563, "uuid": "d333ea48-3999-427b-b0bd-98e97e855069", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635544563, "uuid": "94a2de7d-b041-4778-bc72-4f076a4b3429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635544563, "uuid": "4aaf3ef6-eaaf-44db-9814-0baba8cc8798", "value": "d0cc848be4f35e61c5d27310841fb514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48865588-38a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635504307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504307, "uuid": "0fe29827-1c8c-49df-add5-caa18802f5fc", "comment": "Malware payload (Formbook)", "value": "acaef58b0bb5cb7965052d41570b5686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504307, "uuid": "12917517-cf10-4846-8363-56f73d44ed4b", "comment": "Malware payload (Formbook)", "value": "4c382fc031bb1ca0e9e075fe60ec6ce335050799c3ebff9fea3bd1531f2aceae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504307, "uuid": "66a60788-b5c4-4a01-8204-45f29ad08a1b", "comment": "Malware payload (Formbook)", "value": "1668c7470fe1c5d9330f66267d987b0e08b0f8ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504307, "uuid": "aca3d96f-b130-4c56-a198-61a80a13a9de", "comment": "Malware payload (Formbook)", "value": "1d637c5f12bd2cf66beeb22faa9ea605bafa3b2ebcf06f0b5b2f580072dd6bf7118b7f57820d6677a28f226087452cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504307, "uuid": "4864c222-bed6-477b-be17-a374957bf88b", "value": "T17044223A26D044BBD9A70DF2577BB761A7B1C70A1424D04B7B6A0F673DB0EC3682D182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504307, "uuid": "35c4dd71-0298-4c41-8bf0-c4be964020ea", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504307, "uuid": "415fd88e-1812-4783-a54d-3bfe4f89e668", "value": "6144:wBlL/cnxZMILiL8FrDVRKR3ElZxierLvoTuM8YkOChvO:CexZdiw3VdrLAaM85O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635504307, "uuid": "4ec4062a-4356-4f23-addb-0b9ad42451e4", "value": 262735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635504307, "uuid": "28cce9ba-d4e5-403f-9790-fb80d9610394", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504307, "uuid": "309e5d60-7ece-472d-8c41-f98ea2d18e70", "value": "DH146890Y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc6a06c-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635526325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526325, "uuid": "049ffd61-e6d2-4b37-b481-fbc37262da80", "comment": "Malware payload", "value": "e605c74aec51b82e10a69a8f348832a6", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526325, "uuid": "0cbb8f2f-b964-4363-bf04-868316b08bd4", "comment": "Malware payload", "value": "4cd612a6b3a9155c0ad6e00f4cfc10d27e3851fdf6482847f327b23624b19cd3", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526325, "uuid": "fbb01d18-6641-45c2-a02d-31a7d9cde269", "comment": "Malware payload", "value": "6a69fdc1fbf829426f429ed7791dabaf6e7247e9", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526325, "uuid": "056cfbf1-393a-494d-bbf1-9d3d0a41762d", "comment": "Malware payload", "value": "fb0f1cef65f647c315772b449a3cbe13318e836325fbd03283e8e053d6c078a8c7a3981423518e4522c248cee667baae", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526325, "uuid": "05bd857b-e282-437a-8d6b-49fcd168f4b2", "value": "T13F8412B9CFB94852C30BE1359A1CECA98904D82E905EEB6B5DD0520D8D46BD0136FFDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526325, "uuid": "3133dede-4fec-435d-982a-c836d15def48", "value": "12288:4oWS7obrM3/QgWO6tazx7AyGkNNALRiiiijjNaU92+yzQd6T:4oWXbr24gWO68zx7LG4aFjNhYz6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526325, "uuid": "7cd36ee2-dde2-4998-a5c7-87365200302d", "value": 399276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526325, "uuid": "b3049eab-13af-45f1-b29b-38cedded059d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526325, "uuid": "ea588083-4ef3-4162-8bb4-56153f2f8921", "value": "order.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d669c85-38a9-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1635505926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505926, "uuid": "bcc32282-7b4f-4b2a-aff0-a46cb6935dae", "comment": "Malware payload (njrat)", "value": "b1fbbb82ba785eb41c3a3ab5bc107e8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505926, "uuid": "4375232b-10b7-40ed-8748-dde5b3960796", "comment": "Malware payload (njrat)", "value": "4d1b824634586c05b0649513096c57840e8f707f9b8b85d12654f0c8364f20a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505926, "uuid": "1fd45dec-49b6-4b8e-bb0a-75b0b8985d7d", "comment": "Malware payload (njrat)", "value": "dd054587b966b94abc8e0b7fecb57e4f1713626c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505926, "uuid": "66c05c59-6854-415f-89d0-3e18fe641ea5", "comment": "Malware payload (njrat)", "value": "ff000199ec1f1cbf0d9b67423938ca35db3cb51a1ac2ed26074694226030c997dc00faaf48a8249534878909aeab7f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505926, "uuid": "425f1862-3847-4a33-99fc-518f424f565e", "value": "T171D5120178B650C3D9A8133542925218361D9EFFB838F2EE5AF4BF4D5B74B8608DBE64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505926, "uuid": "4b5c4c12-e849-49cb-82a3-d77cc8fa8a16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505926, "uuid": "5a9beee4-45e5-4c8e-946a-cd34bc07b277", "value": "49152:iTXIk2ssawvSLkS0oiusoV0GYoSE+RpMaJd+zbr8NRp1r73SGPXy/q:iTXCLSkSBsL9MaTabr8Ln3SoXy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635505926, "uuid": "8e555a46-edf8-473a-b55b-759e62603b13", "value": 2776576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635505926, "uuid": "aec57ff5-7953-48b4-a145-1611f03dfd5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505926, "uuid": "25009cae-900d-4b63-9a11-5c98db0c40a1", "value": "b1fbbb82ba785eb41c3a3ab5bc107e8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad10fd0-3888-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635491856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491856, "uuid": "4a32b663-6c40-47c1-895b-d6e1fef44212", "comment": "Malware payload (AgentTesla)", "value": "93214a58aa6411a96be864cb21e74748", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491856, "uuid": "2453365d-246b-4943-aada-e565542e0ea9", "comment": "Malware payload (AgentTesla)", "value": "4df5631c4107dae32d13f6c7540fc10fb5a942ad00160d8cd5b33085422b238f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491856, "uuid": "29352b8e-e32f-4154-83d3-88857dae515d", "comment": "Malware payload (AgentTesla)", "value": "bedb584183989dd76654cdbebf98304650bb5257", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491856, "uuid": "5ab41d0b-9b4b-4590-8223-5ada1cfc2bcd", "comment": "Malware payload (AgentTesla)", "value": "a61a37d10fa6523479923cf8586d09c5f75c4767b58ae2f2d26cf57179f7e2cdc057bdbd27e67242ff6d0d84b26a0fcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491856, "uuid": "91920584-7475-4762-ab5e-5977b8f62233", "value": "T195B4C036629AAF89EFBB5FF95C2025404FF57C23AB3DD249AD8601D611F2950CD20F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491856, "uuid": "d7b026df-dd3c-4ed4-a65e-dcf3b279a0bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491856, "uuid": "11e2747f-1cc8-4527-a361-634ab6ae1251", "value": "12288:6jqJFTPVR48BLFEx4iMTjxfvtGxtj1oDSq:6jqjzLOr2tvtM5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491856, "uuid": "b6f38096-9908-4bf2-8ef0-8b01d560f138", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491856, "uuid": "9ec90dc9-bce3-4d08-9cf9-bfb0b66914a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491856, "uuid": "4ac2a8b2-032f-452d-a7c8-da052967a60b", "value": "CONFIRMED QUOTATION FOR NOVEMBER 2021 RFQ 49994839003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e13967-388d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635494029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494029, "uuid": "acc6292c-a84d-48a7-a9e6-0d228219efdf", "comment": "Malware payload", "value": "8a2af4f23633cd3f653a7f652fd077ac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494029, "uuid": "fd2c7d3e-5b66-440d-a0fd-2cb635844c18", "comment": "Malware payload", "value": "4ec157f11b2b22072e1a87fdc00c187866149c5de3b98bf954da3bf5d6bbe6b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494029, "uuid": "8f9f70bf-d5b3-48da-bbfa-05f74b687cc8", "comment": "Malware payload", "value": "8fe69eba059935256f0be401f4e3d062d833b47f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494029, "uuid": "e2544648-a2c5-4089-adba-1e861d8b7721", "comment": "Malware payload", "value": "37727ab0760ab08de9fa32083e4a2795c6887cd20ea8ef5d3d23b7ae72ccf9df9c8458d82141a0b37859cef26bb7f1f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494029, "uuid": "267c0d14-e96f-4158-9c36-e090af66add6", "value": "T122C423F512404FC1E22A1914AA0DC94FF3B14680D9BB64733BEB23B7A5285B5066D2FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494029, "uuid": "9c96c244-d46f-45ec-bfa6-f4c02b12faf3", "value": "12288:/xeNVkOqkFeOcquhBwBuqVsivFBV8ZPH/388c5vcYm9yA:425JheuqnBSZHa9cbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494029, "uuid": "62df6f4a-ed3b-4232-b534-f8936a8851c3", "value": 587702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494029, "uuid": "88f8d1c5-fc21-4356-b6af-ccdedb406626", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494029, "uuid": "8fc2a9ab-c8eb-4ab7-a158-4ea9c7d0fd7f", "value": "PO#8946.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284c1ac4-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635530023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530023, "uuid": "8d3cd5b0-225a-4cb9-aea6-751eef82222e", "comment": "Malware payload (AgentTesla)", "value": "49dc7de98ac24a533a836e9347a5154f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530023, "uuid": "754f9367-8775-4184-afbc-95069eb451ab", "comment": "Malware payload (AgentTesla)", "value": "4ed899211dee493b523561cf3c183033d3bab0bca8190b4040c26c0061abe319", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530023, "uuid": "af915583-bf94-4a0e-aa0a-b5d1a0800b9a", "comment": "Malware payload (AgentTesla)", "value": "d8603a8a9cddb8d0c1618a9b637f1c902d74bfb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530023, "uuid": "1b4a5b43-d732-4886-bfd1-5a262a414ab4", "comment": "Malware payload (AgentTesla)", "value": "b7024c4548e24b77dc0287efbb7be4d08487043a5729e74697dcc49aae7bc7d7e266aebfad955ba1b43b30db8ffb024f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530023, "uuid": "09f42082-813b-4472-a1bb-a2003f22a3a3", "value": "T156C49D9D7654B5AFC85BCE76C9A51C60EA606467430BE303A45321ECAE0E7DACF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530023, "uuid": "b3826166-6d10-4c74-8522-6fb20275ebf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530023, "uuid": "0945cce7-d186-42cf-a29b-f80399aa23fb", "value": "12288:SKRA+loBQJeor9Jz+GeXnfhlLsv0giEBlblRNXVcXodIy:SKS+OijrqXfhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530023, "uuid": "b76e9a85-3dd6-4018-8e4a-81748f6dbfb0", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530023, "uuid": "001cd815-fd28-4f30-b995-b6fe5ac9992f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530023, "uuid": "756bfa88-c4c2-4a45-b6f0-32f0b0ec69aa", "value": "Factura y datos bancarios.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ae3aea-389e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635501182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501182, "uuid": "c2c4727b-e0aa-45a9-b48e-36ba5da54c8e", "comment": "Malware payload (AgentTesla)", "value": "16de1cbabc3ac5428cd53b04c7cc8925", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501182, "uuid": "a6145004-7612-4bfa-b1e9-2c291eabb24b", "comment": "Malware payload (AgentTesla)", "value": "506dacba57c0deecfd4e8451c62d4f0b8d2391c02499b38f2fb363e44a330181", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501182, "uuid": "9973ba9f-c827-4610-9ae3-a85da1908a67", "comment": "Malware payload (AgentTesla)", "value": "dc09758fcf8871f439bd2eef1a3240a5150f0452", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501182, "uuid": "9bccc88c-25e9-4853-bd36-71ea10ecebc3", "comment": "Malware payload (AgentTesla)", "value": "91e209b50c174e2fe2fc5a651438c277eb451d98cf26051a463ea685e4538dfbc0e9335f0e0fb0987e314ca03bc1f978", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501182, "uuid": "3a21604a-4ffc-47b3-a484-e4e4aa0ec411", "value": "T1EBD4CFCCABD64595EF663E77F8E394101AB16C4F7922CA4ACE87708D54BA7C60802F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501182, "uuid": "7597dcb5-f4bf-436f-9576-7a5f88a2f777", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501182, "uuid": "7274e85a-5bd0-4741-b318-bbfd05be5ea0", "value": "12288:ygUSdrUQI/vxDNIGPzcYINjVAaU/4CDBS9:ygNdr2vxDNIG7cYINjVtU/rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501182, "uuid": "8e961da7-a5db-415c-8889-b2ea9bd13d95", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501182, "uuid": "76610fb0-cc81-48eb-b85f-071644d4ec09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501182, "uuid": "aad00154-62c1-478f-8a7c-287fb3f4dfec", "value": "Re Signed PEARLTECH contract and PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea99dbb-389e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635501284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501284, "uuid": "ecf7d51e-f3e9-4040-8e9e-501925ae3149", "comment": "Malware payload (Formbook)", "value": "80562d1d1817ea8f1cc621e45a851d8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501284, "uuid": "f04491cc-625a-41a2-b40d-f232caac4eb0", "comment": "Malware payload (Formbook)", "value": "516601b7a328bcee918e8c52e46f71b39437045489bdaaf90136c9f899197bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501284, "uuid": "d7f1c970-368d-4407-9765-3137107899fd", "comment": "Malware payload (Formbook)", "value": "6d08847ad1ebae8ba89258f63eb5b51dc0806756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501284, "uuid": "c986d46d-8b6b-4f6c-9b25-f48a60117d1d", "comment": "Malware payload (Formbook)", "value": "304f076271db73ea7d004c9162271bdbd40c08e0cd53e7ce7f9be5dd957eaa711dba31b0943a24f66b83be4e7b89f857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501284, "uuid": "ce83974b-6023-4bda-bf11-efa54e861655", "value": "T1D984B0E1F77044B6E8365378B8B368262123A939EB70144E56DDF72A1E7338305E7987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501284, "uuid": "8d74e650-dd1a-473e-acf7-3be184eba914", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501284, "uuid": "8d6c6e8b-10de-47a1-babb-c1ce77fcb1b5", "value": "6144:VBlL/kE286EZdDqb3l2HI72oupIraJWaytTUmfYJNKcd/7Vjp40BZ+qP8NtPwl:D6E28648lH7f7qytTjfYJNKcdV5RkNta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501284, "uuid": "86590588-ba0b-4241-9589-7a90a82e299a", "value": 371776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501284, "uuid": "e69764df-acb3-4834-8f47-b8e7e24ce1c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501284, "uuid": "bc5813cc-8b15-435b-988f-2bfe1b4895cb", "value": "\u00da\u010dtenka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c371fa-3881-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489079, "uuid": "434be391-bc6a-4e9a-a417-68fd8a770a5d", "comment": "Malware payload (Mirai)", "value": "cbee984c9bdf7de21ba0f968e62391de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489079, "uuid": "efd1cbc1-94a5-4be4-939b-921a9845b066", "comment": "Malware payload (Mirai)", "value": "51bef160d2e488e1f6c6991425ca9a5b0502acd8d9b47e6fe1b1f1e326254d70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489079, "uuid": "3eb322bd-694b-49c0-b918-a20438478c29", "comment": "Malware payload (Mirai)", "value": "7ebbe854a942022d3d20189f03e6f1418c575f3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489079, "uuid": "cfbd0670-acb6-413f-bdb2-40736076231d", "comment": "Malware payload (Mirai)", "value": "6597e0e6c2e5263890c547ebfe73dfd217a6b66983531118576566a06a62fb2acd929b162cc6dc9298b856850ce53470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489079, "uuid": "78217e8c-0c38-4269-8595-7ba36ba2dae9", "value": "T1B3332ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489079, "uuid": "bc9a8896-958c-4598-a6ba-0021e8aca59e", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638gK:mL/4f8F1ef0YgFvimzpZi2UJJnHY83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489079, "uuid": "e1a73376-9bf8-4205-8f86-a601ea75cdf3", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489079, "uuid": "126f0b31-e3a8-44dc-99df-f5273499a2e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489079, "uuid": "0c50fa3c-c0ed-4091-ae1e-0fe79e1c975f", "value": "cbee984c9bdf7de21ba0f968e62391de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc792c5-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484049, "uuid": "ab50d036-7271-41b8-a9df-e91e9155680c", "comment": "Malware payload", "value": "4b9366f2dcab60d56d09e69e21d77d91", "object_relation": "md5", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484049, "uuid": "c33f6696-0747-4348-9e8d-f45d96667ee9", "comment": "Malware payload", "value": "51eaf8af57211f8d9e534f98413e71f4ddf5abcce806a111fc49a30d3bcec696", "object_relation": "sha256", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484049, "uuid": "9216842a-a753-4870-80ba-1b2ed0798057", "comment": "Malware payload", "value": "a46318a25582c2616f33f49f7af986137637ba1d", "object_relation": "sha1", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484049, "uuid": "85c2610e-f46d-494a-b531-424b57f7b1d6", "comment": "Malware payload", "value": "f366f5a62da5f286a1d810775cb35cb7d4be3515193f56fba463d01c9d11cdb94d3cc2985eb239b0ffb710267beb933d", "object_relation": "sha3-384", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484049, "uuid": "72d9c532-21be-49bf-bd45-da2e658b404e", "value": "T15B5501228C4C2EDFE7595BF2AB1F3D2D361D7132F5C507990729CB8661A0A7E498B10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484049, "uuid": "499c57a7-dcea-400c-bad7-ea7beb2e26f1", "value": "24576:p/uikbDN6zMAuWMpxF+uAE0KDBnf9bDy7WEfsiTTJBkmeSsbvdqUiOYBShZA0X6G:MDYYBx7NDaWEfsiTVBLm7ACiBCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484049, "uuid": "2574fc8a-3a36-4473-a2a1-0d5dcbcfe7e7", "value": 1387434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484049, "uuid": "96e3e49f-b233-4d50-8a8b-1fd66c394c22", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484049, "uuid": "50465e92-506d-49ba-8be7-7364e6602081", "value": "51eaf8af57211f8d9e534f98413e71f4ddf5abcce806a111fc49a30d3bcec696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38f0274-3895-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635497722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497722, "uuid": "08366ba2-f193-49c6-9a6d-636db428a2b1", "comment": "Malware payload (Loki)", "value": "d031d354378993ddf3aca597f723b301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497722, "uuid": "6c30db9b-a79e-4681-9dac-51916f8dcc6d", "comment": "Malware payload (Loki)", "value": "5218080ebe69d63196e24cb2d9a08008e5cac324073b13a29f2b660be7398cc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497722, "uuid": "acd8ee30-74e5-4f6d-8764-e30ea0e71fc5", "comment": "Malware payload (Loki)", "value": "b6a6ed3df049e756d57d8d19a22e124b2672ee1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497722, "uuid": "7b558899-a21b-4d7c-8454-ee38f789ebc6", "comment": "Malware payload (Loki)", "value": "1f07827f0becbfed878201b261d3f9bd6f84966156c8319ef56e399736e531f85e480e1f7cb5440f49ecb97731b251de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497722, "uuid": "e1bb5fec-6e7f-46cd-90da-be7c34aaecf9", "value": "T12F44124965F1827BD9A34BF09A3BCB69E0E6D02419246A8F53386FA73C904D3D15F2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497722, "uuid": "8431d52e-d262-4c4a-a691-3f7c0f758541", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497722, "uuid": "40ed4eb5-b2b2-4756-a16b-b6725f9163d2", "value": "6144:wBlL/cgxCC0LdLNLIKFcjB0FjviTC8A4MN/O0NlL:CegfYEjB0FQAF/vNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635497722, "uuid": "8b8ed9f9-e5c8-464d-8e33-65be0d6604db", "value": 276729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635497722, "uuid": "5eb05d66-a94a-42db-962c-dbcbabb3ab7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497722, "uuid": "b6ea68b3-90e4-456d-9477-a1d140375237", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.14384.25917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d1618b-387a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485866, "uuid": "59cd8e2a-c273-44e0-a88b-ed43aa385a47", "comment": "Malware payload (RaccoonStealer)", "value": "f068e9a8faadbca4fb15e69828dbd5f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485866, "uuid": "0f5b2991-0975-4bac-946e-2bbdc05e1c1c", "comment": "Malware payload (RaccoonStealer)", "value": "522389faddd26ccb3652f3d00a3ee7bf7ca2f17d1e66399054dae9b2a7dd9e6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485866, "uuid": "6f0edc21-b8c7-4c81-ab37-a5322ff71626", "comment": "Malware payload (RaccoonStealer)", "value": "8fc25cde561cac6960e232271db0fbca14a995f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485866, "uuid": "2f0a4715-0b8a-4ef0-a56b-471d8e4434a9", "comment": "Malware payload (RaccoonStealer)", "value": "975fbbc15703cb5575768a888412693968cb0ddd9f55f513ec4eb1eb77b1f04584e25fa2d7606f1fdf0ed522ebc9e0e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485866, "uuid": "840bc454-d309-4226-9a00-1beca92ddc99", "value": "T138D4D010B6A1C035F5F612F45AB6A268B53F7AA1673490DF22D916EE4B34AF0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485866, "uuid": "8b2ac717-b715-4511-b687-a9944bfcf6f7", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485866, "uuid": "aa711d6d-9c28-42e9-a565-fb7c36e4458b", "value": "12288:AEQhKogdsxfjLI8/lKnYMrHyBF57e3Dd3IGyYzIkt0:JC7gKjEKlfBaZ49k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485866, "uuid": "4885519d-ba12-4360-af26-992485e2b526", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485866, "uuid": "567c9eb9-f0d5-47d2-aa82-a42ca4b5b352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485866, "uuid": "11423d2d-1b45-4037-a1fa-ed56d30c674b", "value": "f068e9a8faadbca4fb15e69828dbd5f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe6784d-38f5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635538948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538948, "uuid": "8e4b0eb1-b0dc-4d7d-85c1-8e34a8e6d066", "comment": "Malware payload (AgentTesla)", "value": "31deea0af3aefc452cc1a16e768888e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538948, "uuid": "dbd223a9-30f9-4aa5-88fc-c7b5ffab352b", "comment": "Malware payload (AgentTesla)", "value": "528a40ac4d415e0fd5d204596f78f372b11188d2ab8edfe57d111b405c0e4d8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538948, "uuid": "939fd46d-4ed8-4545-ab90-595e85fe6e3b", "comment": "Malware payload (AgentTesla)", "value": "6553ada34d75030a1f628d72315c6005e0e183f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538948, "uuid": "ae06cd4a-0a90-48c8-8f32-08e53a0079ed", "comment": "Malware payload (AgentTesla)", "value": "aeedd603278a043d8da83193b688771a5bb6a95b173b08e63cd4ca4571bc989b44689c902fc9444a605e760d978ab94a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538948, "uuid": "60f7ca55-49f5-4dc8-8eaa-b56c5dc7bae8", "value": "T178D47A0023C681D4D5F542790E19A350D7257FE0E8D3AF2E2D4336AAEA726C176727EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538948, "uuid": "1ae68c59-41d7-44e1-8972-0a74708cf4af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538948, "uuid": "d3707415-225c-4950-9a57-f37e6d4cc586", "value": "12288:kMUw5lIhY3L9hHimSBa3s8T8HMbVTneJaj08mdmSu0sCYTtRFLQ:YQlIhY35hCmZbicTK3X40jY3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635538948, "uuid": "4b400586-16ee-4a6c-8c96-24354e08a13f", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635538948, "uuid": "af6e2e6c-31bd-49fe-b051-75867407e280", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538948, "uuid": "19b82012-272f-4b57-837e-47d33dd21e4f", "value": "PO 2018-000876 CARRIER SINGAPORE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d23e3b3-3909-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1635547292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547292, "uuid": "afa16bed-b8ac-47d7-b9b7-6dea9ac100ea", "comment": "Malware payload (QuasarRAT)", "value": "811f46696830ead7b26c5f23b4416939", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547292, "uuid": "bb3f24c4-e2e9-4920-8f4b-6e7fb6be8a63", "comment": "Malware payload (QuasarRAT)", "value": "52d14c318dd0d66fcba72250ee462f8c633fb9f5c44fd2a21368a1016ae41966", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547292, "uuid": "37034dc1-2870-4eb2-ae58-46a307b5d354", "comment": "Malware payload (QuasarRAT)", "value": "49709a2a5f49f94c11669a5ca74bfbc4707408f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547292, "uuid": "32800601-6433-4eef-a244-1bb6dd5899a7", "comment": "Malware payload (QuasarRAT)", "value": "773e57b70ffcdd6940aa6e82354d396d56c2691b0234cf1b8bf36d7f521c6ba194c767b756e983ea22298bbbd06a28fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547292, "uuid": "3543328f-355d-4330-b708-7f3ffa152abd", "value": "T18CF4BD11279381C9C4F513B80A598391D7217FE0F9E3AB2E794776EAEA722C176503E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547292, "uuid": "4e4fff40-b623-4acf-9389-54a500d75377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547292, "uuid": "a32a080c-d6dc-4d19-a0dd-7c977fa1dc16", "value": "12288:7yDUw5lIhY2I1OKulGJHiK6SxW72z7Of/zm5DtF4ah/VirZ1rUQ:PQlIhYCZlG0SxPzS3zmHitrDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635547292, "uuid": "e5aa188e-361d-4d1d-9924-eb97369bb210", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635547292, "uuid": "50a125aa-1e2e-4937-b996-a61f83a8eaf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547292, "uuid": "94fe608e-7691-412e-8331-0d8972fd4507", "value": "811f46696830ead7b26c5f23b4416939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1c1abb-3877-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1635484714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484714, "uuid": "63c879ae-2953-4f3a-a18a-e94f8562f17c", "comment": "Malware payload (Stop)", "value": "ee564a8d30f4bd8d75b4e4c8b0304491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484714, "uuid": "2c77ef71-90bf-4fac-9591-b789300dfffe", "comment": "Malware payload (Stop)", "value": "52d44751cce977c53335e571317611533fe955f4827fb34656034c0cfe224024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484714, "uuid": "2ae00df0-0eeb-46a7-ab67-e5e0b6a95697", "comment": "Malware payload (Stop)", "value": "b631d0309f47f832c8e342b7bd269986158be9ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484714, "uuid": "c7349e59-768b-461a-8672-ab2acc5477f4", "comment": "Malware payload (Stop)", "value": "7a1cd98e803dbc76ef929e32bf14d066131df7fb4303f80755a1fa5feecf60b4300d400447b7c0297843e7a460496a3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484714, "uuid": "c1ef3654-ea2f-45ac-82cb-46ce3e485587", "value": "T194F412F0B6A98431D4A7293098A58A624E3FB862DD7095C633B0275E1FB3FCD46D435D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484714, "uuid": "152e33d8-9bda-4326-be3d-0200ccbeab20", "value": "5ec7965957c5433534918911424a4e5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484714, "uuid": "f97fdda0-4bab-4e6a-9138-72e1a1677bec", "value": "12288:7wpeZSHPmgkG95H+JcrS+ETKGztyCHKK45XdBXTvSooqjVWw3jqNhuQL82jW/un7:73SHPEGzOD+EeGB945DvSfwyhnQ2jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484714, "uuid": "97e3bc1a-d91a-46f5-92d9-7878cb58d25f", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484714, "uuid": "b97bce2a-a670-4ff1-bae4-3333601f2479", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484714, "uuid": "c50e15f3-c1c4-4c79-8bff-037a9f63bb55", "value": "ee564a8d30f4bd8d75b4e4c8b0304491.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547cbc92-388e-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635494449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494449, "uuid": "0c7e04c9-1160-4452-85ba-0273f8edc1c8", "comment": "Malware payload (SnakeKeylogger)", "value": "a1a0544962387cdb9a4e8e6d490cc397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494449, "uuid": "47e94174-944d-45cc-885a-a7c3b0b53c14", "comment": "Malware payload (SnakeKeylogger)", "value": "53d7b76ac03ce2ced80713d2709ed492fe3165d2b3e991a36326a4ffe8ae077d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494449, "uuid": "f4e00973-a4e4-494c-9c33-d9eef83f851f", "comment": "Malware payload (SnakeKeylogger)", "value": "c0d3a5ef87c9aec6e3a977c98b8a04143beea99d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494449, "uuid": "9b81c886-aceb-4e0c-84b5-f117ae3e50b6", "comment": "Malware payload (SnakeKeylogger)", "value": "a7392b71f5541e2554ddf907ca21df77520c7bb1140e3cd824e6424141f46690f30f01308d3a4456ece21bd2c876ce93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494449, "uuid": "11860a3f-9435-47e6-96e4-df16e6149cd0", "value": "T1A494D000B3EA9A16C7BE4FB5087301201BB5B99B7D72D34B5EC821DE257EB850681F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494449, "uuid": "aeaa0d3b-fbb9-456a-9358-ab674c9abd9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494449, "uuid": "c13bd056-f591-4ad2-9262-41ffb99fbc94", "value": "6144:lwXWIW5aefarpumQ/KmorWKcHeFKaxnVrkSM658QC9THr/1fbrOzO2rFexUwG:6XWzESajQvfKcHekaxnVr1Hadj2rFev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494449, "uuid": "f4627288-7de5-4869-be06-3f4c1c31bd7d", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494449, "uuid": "4831e80a-85b7-4a78-b443-a95725df9eff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494449, "uuid": "cf413259-86a6-4614-8443-73d054cd836e", "value": "PAYMENT TRANSFER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c887b7e-3883-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489631, "uuid": "e4d6c330-bb18-48eb-8c05-5533c223b131", "comment": "Malware payload (Mirai)", "value": "acf775d467b2008bfad563cd934576b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489631, "uuid": "422ee3e3-c836-42cc-8936-250245b0af31", "comment": "Malware payload (Mirai)", "value": "54999861537c5c4f4c2ced5fdf0256b7b005603bee17b25e6ae5bb3f747e16cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489631, "uuid": "2df7a2c3-6b2d-4e86-a7fa-677e29aea0a7", "comment": "Malware payload (Mirai)", "value": "a51182722d62e8d152dfc4bbe8c5c6245e1a11da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489631, "uuid": "e7438d1e-d32d-4e85-b4da-1092dc4c3d0a", "comment": "Malware payload (Mirai)", "value": "ffaa566fd10de98eafec8e8b94475c0eebbe5594ebdfc6c271e748694a6f1be17f5e35f1fb05fd492640b69829b08293", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489631, "uuid": "20aae53d-9e2f-455c-a82f-ba7894ffe9e8", "value": "T163F25353B4F38797EED920F2F60D764AB92983D4B1FE3203EE211EE1799581B29458C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489631, "uuid": "d6a0f81c-4a22-45e7-a969-e558c38f5e88", "value": "384:6iyyqQ633occCImPntbnDVHy9pr1ESW+TLs2Dy8I4YFG+KBUZ6VPoPJIcdNG6vFc:69yqd33ocVHgZKPxAUwVPYCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489631, "uuid": "7811dd7f-8e2a-4f21-9232-6867f7d2ac2a", "value": 36128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489631, "uuid": "4fac9303-c8af-4881-a7e5-8d1ead34720d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489631, "uuid": "5c274c65-00db-4f57-b930-dfbdb164aaab", "value": "acf775d467b2008bfad563cd934576b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa37bf51-3883-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635490003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490003, "uuid": "8d59a11e-e0dc-49cc-b9d9-d518afdd33d3", "comment": "Malware payload (Mirai)", "value": "79ed08a496533dcd97b139c8b8304d62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490003, "uuid": "e991affe-2116-4d93-9046-2182d4f3cdce", "comment": "Malware payload (Mirai)", "value": "54c86d4682085048291895ff3434a78a2dd86fb83f82ce8f472038f84da27394", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490003, "uuid": "37e9f80d-1be3-49dc-9dc0-37885e270ae2", "comment": "Malware payload (Mirai)", "value": "65c742f52ccf33898467e2598dad0bd7947e5dad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490003, "uuid": "1a5f13a9-7d6e-4981-a8c6-be498965370b", "comment": "Malware payload (Mirai)", "value": "b0925ffd4b1504fca1d84ac79f3681ecf4a2364d8440571c7ec2cc3b4f06be722be3285dee5e9fca459a318cb958fcb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490003, "uuid": "b5268245-02f9-4e24-8b11-9dde55d26ff4", "value": "T187D2E1016741FAE1C0B00232E9668A5B72263D79D0D530FB9B3C0DF8A6E9A1D47F8A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490003, "uuid": "911ba97c-4df3-4fad-98f3-8fd03e0d3f63", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgr09q3UEL7q:WRwynNIOQQ1KMwrdLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635490003, "uuid": "29289c36-ae32-454e-a13c-f448e871cb38", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635490003, "uuid": "6fe29024-8c4f-4ba0-8964-3ba5c539115f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490003, "uuid": "402d0457-cb12-4b1c-b209-af6f4943d47b", "value": "79ed08a496533dcd97b139c8b8304d62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b02096-38d0-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635522742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522742, "uuid": "08113880-c02c-4853-825e-2750ce7b96cc", "comment": "Malware payload (RaccoonStealer)", "value": "2ba5d1028f7babca366060bde97bf482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522742, "uuid": "b37544a2-fc2e-4412-9760-22b24742619e", "comment": "Malware payload (RaccoonStealer)", "value": "555fd11933a1bb3a71714e1c234cdeaf7ea3c614f24eebec3786fb61cb3b5b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522742, "uuid": "55d4912f-0adf-4f4a-b1fb-aba94ad217dd", "comment": "Malware payload (RaccoonStealer)", "value": "98c817b375bb002c37c8dfb778116e4c5d07cd79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522742, "uuid": "da9cf447-4d0e-40d8-89cc-7f86fc4a76e8", "comment": "Malware payload (RaccoonStealer)", "value": "b0f1be78eb7254b26a45f57fd268363792639d2ff9c1af5b7ddddb4179327092b8d06554c99ec187a4bb2ba368ba9e38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522742, "uuid": "51bf7723-47f6-493c-90ae-75369e3b381b", "value": "T1E4748D10B7A1C035F5B212F849BA9369B93F7AA16B7490CF13D526EE86746E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522742, "uuid": "1feea6be-3ee7-477c-868d-a5a5ed0cc510", "value": "4649591756a77695954d3f167e28cc87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522742, "uuid": "192684e1-fb1b-4fb8-b939-dc70709a0a8e", "value": "6144:2lTbIu4B96zuF5GVM5/xfe7Yrc+dZX6FzbzfS3:2Bb8BCu3Be7Yrc+dZX6JfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635522742, "uuid": "992f8088-f892-4889-8dc5-94ba5a712bab", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635522742, "uuid": "4cb988d2-9aa8-4235-991a-e64ad4078695", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522742, "uuid": "c1459adc-1d73-47c0-a282-8344c86cee56", "value": "2ba5d1028f7babca366060bde97bf482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2111b1d-38a4-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635504136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504136, "uuid": "50a6ac63-9f2f-4ab0-adea-2e84cedafeb9", "comment": "Malware payload (RaccoonStealer)", "value": "9ca638f14151199cc1844cf345642818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504136, "uuid": "9ff988ab-e416-4083-89d4-c3bb18f9224a", "comment": "Malware payload (RaccoonStealer)", "value": "562207163defcad653f4332b78ae7b6a9ff9c06b5be005e7f7da30420e788c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504136, "uuid": "aa41a49e-9d33-4895-a9bc-6adee1b460be", "comment": "Malware payload (RaccoonStealer)", "value": "36a0452c492215f48240506dfc1b49d270450ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504136, "uuid": "52b03186-ad9f-4a80-a858-578c3f1ba85b", "comment": "Malware payload (RaccoonStealer)", "value": "3081df8fcf060a26dab94b56bfb0aca8d6d269851d4eeb5e610a690b33cef5f8024d2d7f470a74097f96aac6b544a4df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504136, "uuid": "b2a10a2b-749b-4ae5-af61-4c8ac490818b", "value": "T182748D00A7A1C034F5B612F859B69369B93F7EB1AB7490CF12D916EE4674AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504136, "uuid": "4f4f3753-7d32-4653-a37e-09f2e927e3fb", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504136, "uuid": "f02903de-9356-454a-9ce9-ce5dd5669047", "value": "6144:1BsSuJv1v9Jy0wb8FPlsPOhVp943k/iOwu:PduJv1Ty0wb8FPlsPOzt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635504136, "uuid": "fb6322db-a571-4bab-901d-be3cce7b24f8", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635504136, "uuid": "52c35d03-7adf-46e5-bbf9-dc513d0b2b36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504136, "uuid": "74bf5f44-ca2a-41dd-9e6d-44ef3664a340", "value": "9ca638f14151199cc1844cf345642818.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7604d255-3898-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635498800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498800, "uuid": "e973c624-3019-40ae-9863-3143b0e13ff7", "comment": "Malware payload (AsyncRAT)", "value": "8adb35800f43e4f023e9e50b5a5e7eb0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498800, "uuid": "3b790bd1-804b-405c-bb28-4a54195cfcba", "comment": "Malware payload (AsyncRAT)", "value": "5639c11ec67442443212c1b9771cf3462670e03f1116d0caca38dae306491de4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498800, "uuid": "99875ca2-6388-47c9-95f3-06bf2667ee3a", "comment": "Malware payload (AsyncRAT)", "value": "81abe91633dab20e61e69902428a0909e9a25f09", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498800, "uuid": "fb2ccb7b-ed0e-48e9-91a1-20029ba9c905", "comment": "Malware payload (AsyncRAT)", "value": "f11e6512d893867ceaf3a6a050678a60654f59c00317c6a61ad2a6564e2c318fe54c37d614e2862737e0c014c7cfa469", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498800, "uuid": "17de5cf3-2798-4b0a-8738-a4e043d23418", "value": "T1A744D045A339DB6BE4BC47BC40A3166853F6A8327362F7514FD534DA1D23B824E02EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498800, "uuid": "08e542c7-a81e-4684-854c-7f0a82c6cb45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498800, "uuid": "bfa3e284-dca1-4575-b82c-1822fb6222b3", "value": "6144:elfZxQwz614b47d6f4Gz4K6fCFWZ1B8vT3YDReqxQ4ZxEshiPjaKzd3GH+7lxTTB:elfZxb+B6YDRemQ4XEs8PjaK3Ge7lxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635498800, "uuid": "2c76d1b4-8e0c-44ba-9160-942965b9ce0f", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635498800, "uuid": "ad4d5738-24fc-4d4d-a358-59910a42896d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498800, "uuid": "ae0bd914-b735-42c8-9b13-f387217893ca", "value": "Confirmation Transfer Copy MT103-Ref-088091030101_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a46b5f1-38e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635533194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533194, "uuid": "1c945644-6157-42d1-a7ae-76e47e5d8e10", "comment": "Malware payload", "value": "db1d3c5b6338a28bbeb58ebd0f1c7c20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533194, "uuid": "feca9a88-5cb2-4196-89ad-146a76c40fae", "comment": "Malware payload", "value": "56460eec11202898d1a94b212db5d5521d443b96d014773faddb4180375e296e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533194, "uuid": "4bb59e89-a511-4a5e-bf16-1cf91b6a0f50", "comment": "Malware payload", "value": "3a072ca6c293ddcd57a00fc28c9ef32a445ed46e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533194, "uuid": "a2ab48f8-245e-4eee-b593-9dc1b740cd0f", "comment": "Malware payload", "value": "04f9a14e1e15d492f28157e95220433d73e7e23db420547112aac58667d65702a007d440788539ec23f5c94a5cd00357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533194, "uuid": "0c7d61a2-660c-4e24-9bbc-fb56fb010420", "value": "T1BAF53377320A07FBC5D94C311942337BF8538FB35697523FBA4B5AA880D66180A49BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533194, "uuid": "feaa2923-37e3-4337-b516-1b70efb5a6c0", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533194, "uuid": "5fe12fe2-3fef-4f98-9bf0-b85cb50d32c2", "value": "98304:kdOw9FEiD/tGxtBvclrlmSd+wyqV2FHJDjxEp/UZD:EOw9FEiALV0lmy+nqV2bhU/qD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533194, "uuid": "1488af92-4ea4-49ec-a8bd-7405869f7115", "value": 3490816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533194, "uuid": "abd17094-46df-4dd0-9509-2427122e0380", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533194, "uuid": "07f8239c-8352-4fcc-b404-fd276d231eec", "value": "db1d3c5b6338a28bbeb58ebd0f1c7c20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b654898-38a0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635502272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502272, "uuid": "7d9d7d01-2eb1-4ea2-9584-b5dff964d63d", "comment": "Malware payload", "value": "8cc91a2964a17e398960697d32e676c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502272, "uuid": "fcc2aba5-91eb-45f0-80c1-1ad87cde2da0", "comment": "Malware payload", "value": "566e73f0ab49c8a03f7c8f84cf3af6858b5ea83eec80d57f9a9dba69b7e96109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502272, "uuid": "7784ba4e-21fa-4a0d-ae20-545c7d44011c", "comment": "Malware payload", "value": "85494238c8831d303e92584e3e95d9ec91c3fd13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502272, "uuid": "d4e48a73-d887-4fdc-8fb1-3a1489c4bef3", "comment": "Malware payload", "value": "99814e5450c921a42fe4753cd021b89042a4960139b35f9bb0ccf44a0cec93652413496affbf20aa9c184c86c73988d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502272, "uuid": "ca81133c-2f2d-46d6-b54f-375ed9fb15bd", "value": "T1CD441212A7C190A2F25207717E3AE276C1FBDE080A37F7CB97480F6674252DB695648B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502272, "uuid": "daec5775-df5a-46e1-a90c-d1fa082d093a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502272, "uuid": "c39d3d63-2f61-4021-9f44-e0001d245c5d", "value": "6144:zBlL/yzTdk7LAGD9hAOhnhHSJtdRZqkg/PiZpUIv:lIXeLby4kg/PkpUIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635502272, "uuid": "dbffb511-7f3b-4972-829c-6376ea814647", "value": 273338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635502272, "uuid": "cb378ba6-71df-4efa-ba22-c853190eed12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502272, "uuid": "71778230-ee2e-4773-a5b2-8a64f4e9689e", "value": "RFQ# 012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412db543-38d0-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1635522763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522763, "uuid": "060fb8eb-ee7e-42a1-b498-1a1cf1a95e30", "comment": "Malware payload (NetWire)", "value": "21c97621d2f2374fa75d71282c566203", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522763, "uuid": "4dc7ad43-db74-4eab-95e2-b8470c1aaed6", "comment": "Malware payload (NetWire)", "value": "574b348f67921ce34f660afe2ff75d0538bd5ea203739a77479dba7f026f0476", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522763, "uuid": "e43b2a95-a5ab-4a96-882e-325eb755204d", "comment": "Malware payload (NetWire)", "value": "96c38ca646682bc8520059402c3b3fc976e7481b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522763, "uuid": "6d330414-220d-495f-af81-821873ab7f4d", "comment": "Malware payload (NetWire)", "value": "3cddab958fe8a6d7c9f64576a584b6d960099ae5e6cc8402c74118ee09f4cc3769ae26228732e518261aad4913520a4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522763, "uuid": "b3728b3b-d1d0-4522-9db7-b2825f1b9074", "value": "T141F31719FA8794F6FE4B1C31919BF33F0B757A01C130CE92EF541E86EA23C26150AA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522763, "uuid": "991592f6-ecc9-4ca8-b7e2-b9073efd9400", "value": "4563c74acbd357d386b177e402b96ce4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522763, "uuid": "15370be4-adf0-4a4c-8eaa-790a167380fc", "value": "3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvefYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/MzQqqDvFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635522763, "uuid": "e42179cb-528e-453f-9fd4-57c7a48768da", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635522763, "uuid": "e02ad38f-3ceb-46b8-904c-22963852fe72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522763, "uuid": "c46848f5-8e33-49e7-8872-62e54403b1f7", "value": "21c97621d2f2374fa75d71282c566203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a84be6-38a5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635504202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504202, "uuid": "ea8b75ba-a4da-489b-9f2f-907ef824de0a", "comment": "Malware payload", "value": "d1467f50022d8c25d69d80fceb9d2f32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504202, "uuid": "5403fe26-093b-42c8-b81e-11ae8ec46b50", "comment": "Malware payload", "value": "578712ce5c4301ae924ae943567a192f352376f2c03edf348d362a3dcf23949c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504202, "uuid": "03dec0db-803c-48db-8172-e3b638209c22", "comment": "Malware payload", "value": "dc26b64d08b751c5c5f29102bc57e71155bb271c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504202, "uuid": "19dfe118-047c-4a54-b144-51523e76a649", "comment": "Malware payload", "value": "de785fd0f0fcb3cd1ed78ddf2282cad7c7f46f791c8f92b5093fba10b313c05689707d82a0dc8fd92a470788521735d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504202, "uuid": "c68984c0-ef47-44b6-9178-f94f7e4eac22", "value": "T10B4623734654204AD1E5CC3AC523BFE972F6136B8A81F8BC62E86CC239539F1D617A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504202, "uuid": "6823fc0e-fbc0-48e0-ad60-f43fb68c407a", "value": "4fbc37a01c682e76f135ea1cbb670d70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504202, "uuid": "183f6ec4-3ca2-49d7-b354-bf3484619afe", "value": "98304:/itG8zJTB7V/+4FkXwStCejqIS9VONPKHvY6hlKCfGRAUW8Jr0A6SVUtT/+VBgjO:/+GIB7V/rFkXwACwqj9Vaig6rKwGRfWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635504202, "uuid": "374d1c3b-aaba-4a5e-a0d0-69487b156bed", "value": 5730304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635504202, "uuid": "c83ee755-e46e-44c4-8431-c54cecca2115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504202, "uuid": "28fdcd78-6a98-4671-8733-6c57dd7d369c", "value": "d1467f50022d8c25d69d80fceb9d2f32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ddf85e-388f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635494740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494740, "uuid": "e22c95ed-4423-4d45-9d9c-a6bd7a15fe12", "comment": "Malware payload", "value": "c9d8f6b863cf269cc0d1ac8ac810b0b0", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494740, "uuid": "e08845c8-983d-433a-aee2-9c8cec4c98c1", "comment": "Malware payload", "value": "5823cb05aaaf03a93a7d4a03c4207163701e79bf872d716525d8e8d2c15acc2b", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494740, "uuid": "618a8ad5-8031-4808-9733-481ad6750099", "comment": "Malware payload", "value": "4ef9b0fb96dc429586c8e2e29be2ead7a6a3434f", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494740, "uuid": "30687838-4940-4541-bfdc-eae974e154ad", "comment": "Malware payload", "value": "5ec7e9f2a961941da524904d44568d1d21794dab7a0666afda57696023c94e062d5d57c73dacbf5d6ea2004ba5ab3316", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494740, "uuid": "98135af2-ee7a-4291-a33d-c5756f6611df", "value": "T1DD84CFEAA46043C3D51B1DF0EB47DEADECC9CE17B4829EE9844AB50923F95801E953C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494740, "uuid": "ed528764-cd94-45a3-bc11-aac36aba594d", "value": "6144:jga0fSd+x4z9BfpPznL5Md7AhPSZTHTodDcYrBCUJ9lPo24NwHNz9:Wfx4RtRL5MgOToctWjoHNwV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494740, "uuid": "47e45f59-99fb-4052-a2cb-67e0abd12135", "value": 378440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494740, "uuid": "65adda5b-873e-408d-b63e-121521bceec1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494740, "uuid": "150b13d9-b073-4ea6-be01-3d1455712e88", "value": "008.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fcc4c5-387b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635486459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486459, "uuid": "7400f58a-a534-4248-ae0e-623ec25f4f72", "comment": "Malware payload (RaccoonStealer)", "value": "9ebb94f344b3131f18f3a585a1eabba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486459, "uuid": "3f316b40-fd50-451c-a407-17ef5f5789ec", "comment": "Malware payload (RaccoonStealer)", "value": "58cac1dad224e9c26dd2017c25b184c7e688ae127310ba2f10b1fd2e1b6c3fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486459, "uuid": "ba33b1dc-9fe7-4778-ae4a-7fa818f38c08", "comment": "Malware payload (RaccoonStealer)", "value": "42569c5f000cf8cc94a8e68fc67144fd817f8715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486459, "uuid": "1e2ecf0e-82f2-4a77-b44e-59795952e32d", "comment": "Malware payload (RaccoonStealer)", "value": "55c1b49dda179ff89afd9289bd0588e479b50383942df331105923e887907a87129cc7bb4b002a2ad1323ef2c5e5a2b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486459, "uuid": "152bf959-8d4a-4799-98d6-7a0ca121b9c8", "value": "T1FD748C10A6A1C035F1B212F849BAA369B93F7AB16B7490CF13D516ED4B74AE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486459, "uuid": "54dbf56e-b9c0-45df-b8cf-633b16bd8899", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486459, "uuid": "f865ea42-dd4c-45f7-b5fb-0194bc83be63", "value": "6144:umJT/1EPSK7mSAxYgkElOb7hCjYeEzuJRAxzGsh6HC315:u4TcS3vWDEO7IjYeEzgRAxpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635486459, "uuid": "1863878b-a534-4949-8e41-0476681e3c2a", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635486459, "uuid": "6517768e-04d5-4e3a-b838-ed4767bab69e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486459, "uuid": "4e9a1c7b-3858-407b-8a52-93eb0b3d92cc", "value": "9ebb94f344b3131f18f3a585a1eabba4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f3340e-3913-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635551460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635551460, "uuid": "fe8566a4-7ffb-47db-8a9b-d0673a81a852", "comment": "Malware payload (RaccoonStealer)", "value": "bad6ced11d4eeaddb052cf09101d7f2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635551460, "uuid": "49cb206b-99d0-45cc-a0a0-0406d8862914", "comment": "Malware payload (RaccoonStealer)", "value": "5951ad0c4ceb22f67645e5fc7e45aeef476cc7f092c82f53a0ea10912eaa82a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635551460, "uuid": "e6a5be10-7646-430a-8033-27bdbc2c9801", "comment": "Malware payload (RaccoonStealer)", "value": "07a202c4f4cd2f2e28d9e42d6af7dc5e6d41da9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635551460, "uuid": "1adaa565-0002-4bd0-a6ad-275a389cce84", "comment": "Malware payload (RaccoonStealer)", "value": "dad55269fa72014910e8666e2045d1ad3cc5192e8280608e18d4f45792cbbc4662dfc9992f21d50ff5c686712d2e3253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635551460, "uuid": "7a2da1cf-26f2-4970-ae42-11e2202d39a0", "value": "T109A4013073BDC036C8A74A749578C6A51A3A7D22557145823B553A2E6E70FCC8BFB32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635551460, "uuid": "f12813c8-6e90-4392-880d-a238331363e8", "value": "c698dff9877941757d23fcd110965bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635551460, "uuid": "c3cf41ce-cd56-4884-9798-bc26dc137277", "value": "12288:BX3FS9xk3oeTy4siU109Zt5w8BWrpHZ+eS7tFIunn:4xAT4iUu9r5w4WrmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635551460, "uuid": "91dacf0d-eb62-45b4-bc66-e77bdb5af94a", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635551460, "uuid": "e159917c-4c55-4dd7-983e-a654d158fa59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635551460, "uuid": "079eba34-18b3-4644-8279-f850dbabccc1", "value": "bad6ced11d4eeaddb052cf09101d7f2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0af3fc-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635485442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485442, "uuid": "ed568dbc-a94d-4cde-bf37-44f8480b4753", "comment": "Malware payload (Smoke Loader)", "value": "dc0d13a11537c91ee0436e1cdaaef2ed", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485442, "uuid": "f86aef11-1928-4189-8312-8f75c7680209", "comment": "Malware payload (Smoke Loader)", "value": "5a981120d186267256661c1e7a8f473be7eb285d09b0e77efb0223ea5eee2889", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485442, "uuid": "dfb923ef-3de5-42ab-a72a-f1b85bfe8ffd", "comment": "Malware payload (Smoke Loader)", "value": "e4b4736bfaf87f7460d3664b92e03bfba7312c62", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485442, "uuid": "57e74233-95a6-4abf-8694-7c0cf5ecf24d", "comment": "Malware payload (Smoke Loader)", "value": "5eb896529d136a0b7d7b70060ca3ae10b7180f2e131a3dc2bd0af4efdb7ff91af1ec8a13fe91f334e0ae32c345853812", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485442, "uuid": "bff4464e-0ea4-47fc-8455-3e0c07d684c0", "value": "T1C2748D10B6A1C435F6F212F859B69369B93F79B26B7490CF12D516EE4A74AE0EC31303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485442, "uuid": "4eb45164-52d8-40c3-822f-87bed0e0ad32", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485442, "uuid": "7f700035-0536-4de1-813a-dc522b4fe408", "value": "6144:vxUb00E/kklj2yS0q851Be9Cbvze+grFm6aA5SQ:vWs5R7SB9CbvzpgraAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485442, "uuid": "22685470-3c88-4130-8dc1-9f3f9c26c342", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485442, "uuid": "bc31d4f0-4d0f-465a-93bd-9147ced86d3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485442, "uuid": "2656f486-f1d3-4f8f-93a0-c6044444ab98", "value": "dc0d13a11537c91ee0436e1cdaaef2ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9bbfd9-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635484957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484957, "uuid": "da607d8c-bbab-401c-b85c-4b06c30c6cef", "comment": "Malware payload (RaccoonStealer)", "value": "1f85ad8ddb5cb60bf62d8dc1b38d0cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484957, "uuid": "393472b1-ac3e-4acc-ad03-a7f202aeed51", "comment": "Malware payload (RaccoonStealer)", "value": "5af0731c44d5185c6525978688ebde8107c54ad9c2d81195dc0ae19787cc9772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484957, "uuid": "6054bcb5-80a5-4253-af61-025d399f1060", "comment": "Malware payload (RaccoonStealer)", "value": "45ccb06c5afd3e83512f59c1438f95f9f2c38f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484957, "uuid": "ca661995-7f90-41cc-92af-a36a4d3bb627", "comment": "Malware payload (RaccoonStealer)", "value": "74b467b885f6f41ef9949cc0c3ee6c21802dead443ad1c501325b72ec6af897a4769eb4649a5e27ba9ececee96a829cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484957, "uuid": "c0465c8a-4b1c-45ba-8d24-0ae06504d3eb", "value": "T1F6D4E000B6A1C035F1F612F8597A9268A93F7DB1673894DF22D526FE4678AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484957, "uuid": "f1835ed9-752c-4bc8-b534-9299e2494431", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484957, "uuid": "8e1d2033-007a-4aea-bdca-d137c2254625", "value": "12288:hwt/RTIFcBC75GqgJXEbSUZXDS1SGux4kys:+t/REgJXle2s9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484957, "uuid": "0fe4c978-905d-4653-8861-49fffd4f7b12", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484957, "uuid": "8b1abd73-eb05-469c-a193-9ce16fd40e3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484957, "uuid": "47d1d80d-0511-41aa-85f9-4ace8bcf8e47", "value": "1f85ad8ddb5cb60bf62d8dc1b38d0cd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9e7b90-38f5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635538942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538942, "uuid": "93a05487-51fc-45e7-8d3e-118dbd147c47", "comment": "Malware payload (AgentTesla)", "value": "4fb53a998576ee5df9b00d134cf0bf38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538942, "uuid": "8934e5fb-31a5-414c-84c5-788778749062", "comment": "Malware payload (AgentTesla)", "value": "5cb468847e95ee35c27329cb44019251398e535857e8e3ed3ffb7029891735e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538942, "uuid": "8385ecfd-105c-4bf3-bd08-8d02b49f67cb", "comment": "Malware payload (AgentTesla)", "value": "1090833a3c24de1b9feb8a92af7ff27cc3488127", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538942, "uuid": "3e7308bf-87f9-4782-b258-001a437b58f9", "comment": "Malware payload (AgentTesla)", "value": "161ff65bfde8c5d34d5445a08e73fa5a41928bb0418bfe608c02f7df01a8816b3de50053cca74078f5ad56667079a373", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538942, "uuid": "a1831f6f-98ce-40ee-994a-39e814ed59f3", "value": "T15CD4BC10275785D0C9F653784A5A8365C7267FE1F9E3AF2E350372EAEA722C072813D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538942, "uuid": "845a30cb-2adf-47fc-84f1-69e805086818", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538942, "uuid": "3dfb4ef9-1109-4e75-b5b1-a3d78dcba96e", "value": "12288:Pk/FUw5lIhY4lDhJzoPHRFAs92VQ4QYXnkJXkKQ:8+QlIhYarzSHDAu2VvQakJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635538942, "uuid": "42d4de6b-fc1d-4d93-a553-0e5732c79cf1", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635538942, "uuid": "c42833e9-3241-49e8-95a7-0c254dd6bbdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538942, "uuid": "b56b2b08-5ae8-4a64-9c70-9e0fa9f98b78", "value": "aVyo3GawOIow7S6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b332395f-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635526820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526820, "uuid": "75f90e39-5336-4cd7-a081-e8b7b0bede74", "comment": "Malware payload (Mirai)", "value": "48d2f19436bda0a5a89bbdb4a6ed4d81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526820, "uuid": "0d44e078-7cb3-451c-a1e4-b73362a6462e", "comment": "Malware payload (Mirai)", "value": "5cc72aeebcc2628149755fb6e40aaa3c443af9c6c8fb816f4ea0e3d54925d2a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526820, "uuid": "ac335880-0b74-4e71-a102-a891ce6d15ce", "comment": "Malware payload (Mirai)", "value": "36c2925fce2ca7742c2ea573ac6255f9bb4e6b14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526820, "uuid": "a8f7ee6e-ce03-4a68-963a-5196be8965ef", "comment": "Malware payload (Mirai)", "value": "60354a347fb128f3a5754bc88d4dbbf6703355b7a761f7d67f6dddf2075931704b93fdbaf62039aeab5e4799a0b0ac0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526820, "uuid": "780e0a19-f7f3-4833-8de9-81eb02e8a510", "value": "T1D8731892B8829A27C6D013BBF66E158D372567E8D2DE3213DD216F2437CA41F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526820, "uuid": "2705ded4-9561-48a9-ad9a-88ec3d7247b5", "value": "1536:0VBFaWFELVQ1c0SD5OViTHvvTCM09iahW0oPViM5TT7E35Wr4:0VBAWC5VPvR09thr9M23k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526820, "uuid": "12c02094-6557-4729-b46e-16a80fbae9b9", "value": 79536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526820, "uuid": "7702fa91-89cb-4813-b4b5-1ae632a2fc17", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526820, "uuid": "7e8e48ae-0c33-4e0e-a13e-3e48e74202fa", "value": "48d2f19436bda0a5a89bbdb4a6ed4d81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77ec54f-3907-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635546665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635546665, "uuid": "a6ac10a2-392d-49f0-a3f1-52520f383e4f", "comment": "Malware payload (RaccoonStealer)", "value": "6ab3261b67776cd3d211357aa26bcf05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635546665, "uuid": "06c36a29-2d18-43eb-bd46-cf7212db2b12", "comment": "Malware payload (RaccoonStealer)", "value": "5d5314ec5e467c3875f072915f95a4f1c143b1b7996e60d4c81c5ede11e604bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635546665, "uuid": "807e593f-b83f-458f-8f63-bec6cb35b591", "comment": "Malware payload (RaccoonStealer)", "value": "2194fc7111222a30338373d8b48ab2cf11dbe575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635546665, "uuid": "b1360bf3-408c-4913-b664-f6dfe91f43a6", "comment": "Malware payload (RaccoonStealer)", "value": "0a45b91967553907b19ea9a314eaec5139a1798deab111d38a189bec36b5106805478ec43cd09e5e78d98ba0af63d228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635546665, "uuid": "4d18e399-34c2-475c-96a9-9af2114abb00", "value": "T1E5748C10A6A1C034F4B212F849BA93A9B93F7EB19B3450CB53D516EE8774AE1EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635546665, "uuid": "fc43d00b-67cb-45bc-98d5-5b94b6625a8b", "value": "518d84bc9a231f5bb2827b0550b9f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635546665, "uuid": "24f37ac3-a06c-4f46-b53e-633280d18d58", "value": "6144:mgWXcBcmAmCwClBCOk2mFSMaYskAHmon:mdXcynwCMOk2mFSwskAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635546665, "uuid": "a0810951-fc7e-44a7-99f6-84306d09ebcb", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635546665, "uuid": "c0ce5773-ec48-466c-9c6c-150828fc2d2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635546665, "uuid": "c1dca499-2069-4a5d-a7eb-aa8b3f961109", "value": "6ab3261b67776cd3d211357aa26bcf05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ff4d12-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484285, "uuid": "4b937bd4-6e65-40f8-b766-a32fd84e0e78", "comment": "Malware payload", "value": "c8adbc1aa9e02d1f8b33d62981c8fc69", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484285, "uuid": "21361996-7680-463b-88db-8bde0c0f5fcc", "comment": "Malware payload", "value": "5d8fec8e7bd95cc292862370d6954ff2a4d2847848ee8590927808d02bd930f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484285, "uuid": "6bff3f98-c6cf-433d-a7e1-04a26e661a8a", "comment": "Malware payload", "value": "6cefa649899c8a4f5d434aab6cdb0fd0dcf3850c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484285, "uuid": "5f2e2a26-8b60-4f41-a5a7-9ee2eabb7229", "comment": "Malware payload", "value": "4feab6a8e05af5a28a17c9fafea42581520c53aed9797e7537006675409a823e4e5c5743c34acdb2ab1e671e2e3ea042", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484285, "uuid": "153bfb34-956b-4e73-8cca-e58036c2647e", "value": "T13D05271474C57CFBDA63C1C8F71E0646E178DBF9B25C9D266680A8046A8AD33CD2993F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484285, "uuid": "f5b8f0c9-2e71-4f9a-84f1-c6b5a69464a5", "value": "3072:b4lNRsRXBCCKNPYDdTq0oD9KUfOSB8PRXxfjHSgxEU670yb4+4y/B7CHj4WrmyR1:b4l5XB7Y9c1aQ+3dY6o3M2gYtWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484285, "uuid": "ed096a3c-c2f8-460d-b203-4b77c82dff48", "value": 832020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484285, "uuid": "d401b930-2d57-454d-8bce-847617f4f8c1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484285, "uuid": "01a319cb-c6ed-4968-af4e-f2e2de77d426", "value": "1395548_10_28_2021_0345.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7452b2f4-38cf-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635522420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522420, "uuid": "59922e4d-2162-4a5c-a834-9664af4fd9e5", "comment": "Malware payload (RaccoonStealer)", "value": "9d7c2b83bca822f8deced3d2cb8d30ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522420, "uuid": "97efc880-2ae2-4015-9e3a-5facb416d634", "comment": "Malware payload (RaccoonStealer)", "value": "5eaeb210121bcd5be88ca42022bb31a29d7a59b5dfde80ea57088f17f23dbafe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522420, "uuid": "cc8bf0f3-50f6-46b5-9e18-cab6878ab13a", "comment": "Malware payload (RaccoonStealer)", "value": "809027af7571350c0ebc437ac1203f9610e725fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522420, "uuid": "b5c7d2ef-1a95-4e00-9a20-802d569ef45c", "comment": "Malware payload (RaccoonStealer)", "value": "ad43848f90791e974541dd4495731722a3543ae3022d69e45a5a5a934e7c0fa034d4aa617aebe428fc0c9ce81d32bd30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522420, "uuid": "d5db3f78-40f9-415c-9568-6abe1393ca33", "value": "T1ADD4E010A6A1C030F5B752F85A7657A9B53F7AA1A77880CF13D926EA4774AE0FC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522420, "uuid": "7f9c05c2-1f19-4a84-9a10-3fdd7e690ecd", "value": "4649591756a77695954d3f167e28cc87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522420, "uuid": "27cb0341-485f-4f9d-ad3b-d8211ff116af", "value": "12288:ysOg+qA2pXxalbE8SBfMsissMRbR7X3ug5KfxaQbS:jOg+qZBAw8Su+s2b1HUx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635522420, "uuid": "171d8e65-c4c6-45fb-a559-7e1a381f93d6", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635522420, "uuid": "beccc90b-6dca-4b7e-b85f-053c9e6ec818", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522420, "uuid": "739695f7-6b09-430c-9410-dd3ec98385d9", "value": "9d7c2b83bca822f8deced3d2cb8d30ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19f4f3e-3864-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635476540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635476540, "uuid": "c4d281f1-811c-4259-93a5-a88a59178cc7", "comment": "Malware payload (RaccoonStealer)", "value": "6695ddd2891c24fc85a47ad37bd57f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635476540, "uuid": "c0616889-0ec5-4abe-9f40-66cebcd6be0e", "comment": "Malware payload (RaccoonStealer)", "value": "5edb1348236c7fa03dae6c9e2d3c9e4241c2eaa2a8721e5c4b78abc9b66075f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635476540, "uuid": "e32c42f2-5fc8-4995-a99a-6b3028ba84ea", "comment": "Malware payload (RaccoonStealer)", "value": "648c4f0115f50e4186e44fade356f635dc995362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635476540, "uuid": "d2943304-2b9b-4754-9105-82c2b4b9b93c", "comment": "Malware payload (RaccoonStealer)", "value": "a4217319e824947454b9df9b42fbfb68b2ac9e85f5259deeacdf97c536f92ec5945b356316b5ef4ab41ed5e25a06a33f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635476540, "uuid": "d9386f68-9c19-4d8b-a9d9-1d6a9fb943c5", "value": "T1FE23F171D85B0B28C72A8733162774D72700DB6D8C480955DAEAB0B95CA2A27FEEC1F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635476540, "uuid": "b02c2777-8b29-46e1-8f09-36524d8e1234", "value": "1d88d597200c0081784c27940d743ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635476540, "uuid": "ca4cf1c1-c89a-4f12-8e0f-b763cbca15e3", "value": "768:uVs46V9PAgK8pA9uhE9ton8g/kt0pptv+KgOEWEwnkasXKiaTnbcuyD7Ux:uioLuANE7pDv+JOEWNnkJaiaTnouy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635476540, "uuid": "9cdfa65c-4c3c-47f8-b5f9-3350af37e91d", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635476540, "uuid": "751e91e7-01d3-4ddb-93a0-a7476aa421b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635476540, "uuid": "9d94aa6b-72dc-484e-bc1c-eaa245606a53", "value": "5EDB1348236C7FA03DAE6C9E2D3C9E4241C2EAA2A8721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d779ad86-388e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635494669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494669, "uuid": "28c3543e-daf5-413a-af78-24ffc66d739b", "comment": "Malware payload (Loki)", "value": "31a04404c79c36cfcc7eec0b003d5528", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494669, "uuid": "fa235882-1e62-497f-a4fd-08f2b42db411", "comment": "Malware payload (Loki)", "value": "5f22fad60e9f73d5185a6c2b75b6b9eef33269712aeb916d0e1ff791c4c95ef8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494669, "uuid": "7fce11b6-072f-4f3e-8ca1-e409f4960d00", "comment": "Malware payload (Loki)", "value": "77961b57e26000c594e30fb7a118c08a16784352", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494669, "uuid": "c78cd538-672d-4c9f-b759-7a09bf2fad91", "comment": "Malware payload (Loki)", "value": "2195662041ff175cc161bb6b919434e4650851fd34652a7465aa0707bf3650e771916cced5258ba69df5f39330f7f5b7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494669, "uuid": "ba9ba609-7108-45b9-8aca-be9b30ab6eea", "value": "T1AFA4F179BE53BFC5CDDB49F8660BC2D49846ED00AD8645693C31BE8B287390D0A8B5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494669, "uuid": "ff9391b0-3307-4557-b2cf-9eb8d9564504", "value": "6144:jUWl89u+de+ekIJqEi3mky6qWuJKk/pv3DAdP6XuG7syVz1BrlYBESdqdCflXzrZ:QYkUyFVuJV/pvTIP6npFqES4dCFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494669, "uuid": "35eba434-e12a-44ce-b525-47f0c79bb4a2", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494669, "uuid": "a72e9696-604e-40bd-a5ad-60b3b3b4c0fe", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494669, "uuid": "dc480f64-6454-449a-ac96-bc1460fb92c8", "value": "NEW ORDER 001 P000000000005.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca70930-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635495026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495026, "uuid": "e7af2b0d-2ff6-47eb-93c0-236a6ad7cfb9", "comment": "Malware payload (Formbook)", "value": "9857958c5e4c03adaf4e2590511e4035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495026, "uuid": "7627f761-d198-4807-a125-31fdf21966f4", "comment": "Malware payload (Formbook)", "value": "5fa1ff89c81ecaec98e5995fbfe4df5caaa1da2f514d2deefff5ea91938d579f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495026, "uuid": "fcdd6f95-79b4-44d3-a706-83c8ddea0c2f", "comment": "Malware payload (Formbook)", "value": "146fe7978dd623907b1722690e4af4787121502c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495026, "uuid": "08e42a4a-7827-4607-acda-586eb02d6d91", "comment": "Malware payload (Formbook)", "value": "3fb2f322063cf4bcb708bed37b5f3049ca5e1606012434bcdc675364f3087a287067af1c2d3ac0e7e10a6182c2c13edd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495026, "uuid": "3a4b8f57-d983-4605-9db4-fc32fd2da98e", "value": "T1DDB4BE3DBE156A73D3768236D4EA0006F2ACA58B33329E4A15D7234C654BB9339573CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495026, "uuid": "37fe1953-4436-41e9-b503-335e7a4cc364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495026, "uuid": "82070e77-fec8-4665-ab57-16bced10f9d4", "value": "12288:tnXJjNP3bUzyXtX5WhDQsdTUvRvITsdqdawB:hJ2mWhrivRTYdaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635495026, "uuid": "8eab3ed1-7d17-439a-a360-8f8c0cff09b6", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635495026, "uuid": "0db6f469-3e00-4956-9d4f-e82e24e6bcd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495026, "uuid": "4157cb88-9581-4813-b8b3-c2800d1e7baf", "value": "9857958c5e4c03adaf4e2590511e4035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f46ff72-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635494977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494977, "uuid": "22df5cc0-a546-4d9c-a80f-4919410686f1", "comment": "Malware payload (Smoke Loader)", "value": "c3398f7ccfac8059d0a50e92f1e3536e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494977, "uuid": "cb128be2-30f5-4bac-821f-c6552937a41f", "comment": "Malware payload (Smoke Loader)", "value": "605e57c5643a2292002481fee5fe3b7ba0243fc8e3ed6d423c814554cf6b4bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494977, "uuid": "b9e8f6eb-f33f-41a4-8cb2-821d36aa75ba", "comment": "Malware payload (Smoke Loader)", "value": "3f12b8da818fd00d671efc4e94011758f6a960cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494977, "uuid": "17bc7661-2887-4a7e-ab19-ab0c58fa138c", "comment": "Malware payload (Smoke Loader)", "value": "45897f55703dfd1b8a363afbc027ed64f174842b55d44d8d2298fc9ad91ec6b518a8702360505ac6cf7ce4e9ccb03f54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494977, "uuid": "b8d66f77-43fe-41c5-a9eb-2a2eb2c96b25", "value": "T17E749C10A6A2C035F1F222F859B6A369B93F79B1AB7490CF12D516EE47746E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494977, "uuid": "f922c88a-d51c-4e53-96b2-afa0921310ab", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494977, "uuid": "f2cc5e64-7726-4421-afb8-11c520416280", "value": "6144:GoJgGOsYR5AWzsD72CwysE3TiRcBAeWukVjP0rJ:GOgqY8WzsD7PwysE3GRcBV+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494977, "uuid": "dc052f15-a9e3-4264-afd0-132b78788c08", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494977, "uuid": "dd64dc8a-bc3e-45fd-b41b-8a5fcb65f39f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494977, "uuid": "648a193b-907f-4234-b7fd-48452b56d3f7", "value": "c3398f7ccfac8059d0a50e92f1e3536e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcc2915-38e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635532774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532774, "uuid": "86ef9496-3e0d-4d5e-87c4-726c61ab5739", "comment": "Malware payload (Formbook)", "value": "ab88797a02acd0499d33fcaa807f46cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532774, "uuid": "ab52aac1-3638-41c8-a0dd-4361a3719eab", "comment": "Malware payload (Formbook)", "value": "60b7ee7c678553708c9ef357f9922acea8736a66ba9109eed68a7b2680bc8c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532774, "uuid": "9e4b6a04-981b-4e0b-83ae-fa1af729e4f5", "comment": "Malware payload (Formbook)", "value": "04ca9bc69e500239d677d46d2e53a9ef5fc69f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532774, "uuid": "43439b56-ce2c-4e78-a6b4-0db04f7cd9f7", "comment": "Malware payload (Formbook)", "value": "8e0a2eeb9f2c76edb5f2dcb3196451dd0a3d3f998e7e8890900f128286958bb51d4eeb3f2c3ec347db294b707a7d352e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532774, "uuid": "22eebc32-9dc4-4fad-be3d-4116715c456d", "value": "T1D725AE13F3D1583FD033A6355C13A3985625FF41292DAC82BAFC0D8C9DB9B5179A09AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532774, "uuid": "47fe0116-a255-4784-9263-4a7b43f284ce", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532774, "uuid": "4646580e-93ee-4723-af4d-b63ac9f4c8fb", "value": "12288:qXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4J/6NuLpjqayC94M0LdEegD:q4uBfTG2pM9o6NN+swhY48MjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532774, "uuid": "4a6a7618-ec67-4803-a991-6289cd6a58e9", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532774, "uuid": "e07add7c-b8e3-468f-bba1-ef4e79c2f9a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532774, "uuid": "fd85837d-35ed-4728-b2c6-a5062a786a91", "value": "ab88797a02acd0499d33fcaa807f46cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c67c8a-387f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635488225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488225, "uuid": "1cf0651a-cc68-41cf-a555-62f81e34db6a", "comment": "Malware payload (AgentTesla)", "value": "68ae1a350dbb4fa3d5529b4b760513ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488225, "uuid": "7fbf897e-fc3d-4eaa-a9c3-1986db1f5a63", "comment": "Malware payload (AgentTesla)", "value": "60c4f484872f772291dd1d04f281da623809f64e85cd80df4e79ba26bb494fda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488225, "uuid": "811a6e63-6337-4a80-8660-19c72dbb6980", "comment": "Malware payload (AgentTesla)", "value": "a99473f1ecae702d1e92e1515acc69c739fc8f56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488225, "uuid": "a789d88a-2c40-4b4d-92c0-b974b5ac4748", "comment": "Malware payload (AgentTesla)", "value": "31d7cb7bd700c109811dbf4e7fe30035aec8d6710e1be48f86f594dcc7863cac12234262b32a9bd7a7f0a4ff12d89fdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488225, "uuid": "da108f14-d8c9-4e8b-adc4-26173592fe51", "value": "T164154A33FA449A97EA6D0B77F582701B0D276EABFBD8C1D128BA3D9951B194C4BC050C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488225, "uuid": "f6d25d51-2175-43ec-92bb-cbad0b804349", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488225, "uuid": "feca26be-2ad4-4dad-9726-81903ff82c16", "value": "12288:JU3Q3cqJFTPl2yi7HvaItrMNbyVWqF9zr/aA0D2NY6Tw:JU3QsqZ2yiemANbyVWqWAXNpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635488225, "uuid": "75a5f13c-2443-431d-a601-bac90dcade0e", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635488225, "uuid": "2d90e670-1a6f-44a5-80dc-29728fd35646", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488225, "uuid": "028d4d71-a9ca-4d99-8ccd-03a52c63bd13", "value": "RFQ291021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195ebffd-3883-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489625, "uuid": "c7bef5bb-1bdb-440d-afad-ed65e2e58a6d", "comment": "Malware payload (Mirai)", "value": "afee8a8aeb1b88d85ec5be9d7aa5a6e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489625, "uuid": "75d97176-c0da-4aa3-8f55-1a33bdd52107", "comment": "Malware payload (Mirai)", "value": "60cae4bf522239374fdbe8ef1b62aaeb8691e0002330cc9ae13bf3bbd2ee46be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489625, "uuid": "af8dc9d3-e2b9-476f-a22b-1f566659a6cb", "comment": "Malware payload (Mirai)", "value": "ccbe9c98e224b72a78a3d816556bd4423337a1c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489625, "uuid": "625b4eab-ab19-4584-9a61-cc851481dc8a", "comment": "Malware payload (Mirai)", "value": "0b0dd6733622309ff1249c578eec9d957eafb248bb0bc1c752ef9b2627d28e7b7fc03749b433ee5503bd391063bf9af5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489625, "uuid": "daddc903-6a74-4996-9421-f68f45bc9ade", "value": "T177A2D01426CDED72D170843AE23CC347AEDB47B652FE323A1E080A9DE49590AD3BE545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489625, "uuid": "8b5a4b0a-da00-49aa-abb5-6fdc8fdf85d6", "value": "384:Yzmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbKhymdGUop5hXX:YKoh/DxCvhdR4IjWVFbSus3UozJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489625, "uuid": "77bf7af9-151a-4444-a525-79123742d3b6", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489625, "uuid": "8d2d6784-7c81-4f07-85c5-58710d349c81", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489625, "uuid": "6c927a87-4c0c-40a4-8573-da76be59093b", "value": "afee8a8aeb1b88d85ec5be9d7aa5a6e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4b4057-38fb-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635541551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541551, "uuid": "27677a94-75b8-4276-aa39-34107fd86dbc", "comment": "Malware payload (RaccoonStealer)", "value": "6119fa67f25a4fb13b3c2cd17d7c6e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541551, "uuid": "4505e008-78e9-4fd8-9cee-8ab318c65d08", "comment": "Malware payload (RaccoonStealer)", "value": "6102a4bde8d14f7e5de7b73a8aea5c4880e298928a11a3a60c22c97dffcae473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541551, "uuid": "eb3f138e-905a-4ec1-880f-94d6c3048355", "comment": "Malware payload (RaccoonStealer)", "value": "85b0d5fdb7bbcb2ae1e5417189d536cd260718b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541551, "uuid": "5df60e07-afcc-44e0-9a13-5c231bbcb501", "comment": "Malware payload (RaccoonStealer)", "value": "8c878ce368d248dcaa3878fa7777e12f672c8df2f5e62baa318a1fb3bdd8e45bd0e6d26359d82fa8f2dfc0749b9bdc25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541551, "uuid": "dc1452fb-2f47-40e0-94d8-00e9251462f7", "value": "T12DD4E000A6A2C034F4B612F849BA9368753E7EB1A77841CF17DA16EE5774AE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541551, "uuid": "e4766a04-fb1b-4a56-8a67-c79e4924d4b5", "value": "518d84bc9a231f5bb2827b0550b9f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541551, "uuid": "b60b3b9e-fe7b-490b-9276-4ffb92637795", "value": "12288:jJhDk+IdasZVUjgFql7TNaxtK4K/zeSEAkIVe:ttkRokTF67TUKH0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635541551, "uuid": "7680d035-136d-4c94-bd09-9bcfbd013cea", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635541551, "uuid": "62e77627-3a29-4379-a833-b0b61f75a2e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541551, "uuid": "f5a152c2-decf-4228-a4a2-1cc8f48d1817", "value": "6119fa67f25a4fb13b3c2cd17d7c6e6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fa249c-3884-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635490371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490371, "uuid": "5df96739-1420-471d-8a3c-577253e2c54b", "comment": "Malware payload (RaccoonStealer)", "value": "019f8513d424dd88bea75acc80454977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490371, "uuid": "c649c4fc-ff28-42ec-a03f-f8a87c6db46b", "comment": "Malware payload (RaccoonStealer)", "value": "61032cb0c046266ca7b4e1c7bec46361c439d6a3cee475162662be4d2b57e8c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490371, "uuid": "a864bd2a-e9aa-4aff-850e-c635465ad02c", "comment": "Malware payload (RaccoonStealer)", "value": "3c37a736e7140190656e40680cce23a3eb993ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490371, "uuid": "2a78abc2-ab78-4963-91dd-8cdc8fbe759d", "comment": "Malware payload (RaccoonStealer)", "value": "ec72d383aee2bfc236057d39cba4d97aa76353702ff662ce78ff852aed69d88448bc846cdb1113f2581e489d86a66e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490371, "uuid": "928bafc5-c276-444d-af5f-83cb52429cdf", "value": "T14FD4E010B2A1C030F1F652F84ABA9268B53F79A1A774A5CF13D116EE4778AE0ED31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490371, "uuid": "87e9e158-a7af-418b-bf69-28125ba39778", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490371, "uuid": "5fb431ed-499e-401d-960e-ba8731b6e7e7", "value": "12288:HO/3T0ctWysLVodXSDC5hqi9f4xnZwhCdhdGohv7oQcuRuAswh5yXv:uftWfmCDC5hqXxZQ3Ifb/sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635490371, "uuid": "eaaadc46-af4c-4c33-b6bb-f068e5bff334", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635490371, "uuid": "010e2a30-1708-4367-94ee-8dcb6eb85180", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490371, "uuid": "8fa134a7-6739-4af1-bb58-2a9e66780381", "value": "019f8513d424dd88bea75acc80454977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c6c0c7-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635485402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485402, "uuid": "a7d86d45-c042-4c52-bc86-981d691744b1", "comment": "Malware payload (Smoke Loader)", "value": "208fa00548bfc2063540d1a43721a360", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485402, "uuid": "6310b5c4-cb4a-432e-8e3b-17fb17ce2ffe", "comment": "Malware payload (Smoke Loader)", "value": "63738b485e6498ad32e78e014e87b30100f00ee66ed70219bbdd2c2ddc9b469a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485402, "uuid": "c33220c7-8488-4846-9257-88bba576473d", "comment": "Malware payload (Smoke Loader)", "value": "c8e1e972e74a28bb8f1b1d7ed316fd5e56d33336", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485402, "uuid": "78cb8ccd-aa05-4e7e-94bb-6fe605fdf9fc", "comment": "Malware payload (Smoke Loader)", "value": "71400e8a71e750e080b3ad934f2ee0311104df7a8dd6774d29bde81c01b1ec02d1445412fdbbf70bd1b5b86b06f4df05", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485402, "uuid": "a5419a54-ac2e-40a5-99f2-b79a04e27049", "value": "T109548D10A6A1C034F5F322F44AB992A9F53F7AA1AB3494CF13D51AEE46746E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485402, "uuid": "55541b57-da0a-48de-8441-0e59a41439a6", "value": "389a11aacbf687c9e251b78d996c02d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485402, "uuid": "ae91becf-516e-4df0-87de-beb75166e8e3", "value": "6144:b7NgBviIhA45Rpg7lm4CooAvr7jNHfFAiQdE3dNjQ:bpLxISJTCBAvr79GiQ2N1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485402, "uuid": "7f7c6ecf-8d9b-4753-bfa2-8138c3ae678f", "value": 293630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485402, "uuid": "1b4e41f5-816a-4fdd-a6b7-2006c4821c61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485402, "uuid": "788d765f-3643-49e8-90e2-0c719b847ad3", "value": "208fa00548bfc2063540d1a43721a360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751672d0-3882-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489350, "uuid": "561ec385-f4d4-469a-b1e0-b55cdf9361b5", "comment": "Malware payload (Mirai)", "value": "261a1b483592e460ba815ee26ebb3451", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489350, "uuid": "f1b54ec8-02ed-407c-b4d8-c09c0e8b62b8", "comment": "Malware payload (Mirai)", "value": "63be6cd8417379a42b7d45401f39680c778dc3bbfef38c645e1e14e6f9ade15e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489350, "uuid": "4a4e5a3b-4b0e-457f-af9a-6c2bc9810e71", "comment": "Malware payload (Mirai)", "value": "1d14d43de6699aa63b5ad063f4e868726f4f2b6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489350, "uuid": "88870520-e746-4dae-95c4-c9925bf9051e", "comment": "Malware payload (Mirai)", "value": "f64e6f68c0b13896da04024c1d7ca399f8012f32556bc519bb7ec0db37f906fc3fa8e1363a8630fc01bd5377ac2bdad6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489350, "uuid": "bc496ef2-626a-432b-9aa9-2cabbc367fef", "value": "T19EC2E1DFB8963985CD1C5CBC219D5AD116A9A2C7234B9F0837103DC8A5B645FF8AC4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489350, "uuid": "ba3ce364-aacb-48a9-9820-e34121212904", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBhLW1:oCrJgHiOJrfwmQrctJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489350, "uuid": "dc132a71-ce99-4525-b86b-55eb8fc99228", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489350, "uuid": "427ba2e2-1a76-42e7-ad85-cc27795d980f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489350, "uuid": "f813e98a-21e9-4897-afe0-5e5c871b48ce", "value": "261a1b483592e460ba815ee26ebb3451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cd3716-3853-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635469358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469358, "uuid": "44770d49-b819-45e7-a2de-e1cd1845fb27", "comment": "Malware payload (RaccoonStealer)", "value": "d5d01917cfa8215476c43cb5dfaeae15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469358, "uuid": "014ef7a2-d15d-4c33-893f-bf3f19f2db05", "comment": "Malware payload (RaccoonStealer)", "value": "63e51949e556d4e3ce9f6d72c8a7b53e2a75b5f5926658ed65ac1a92b786f727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469358, "uuid": "a256477d-24be-4143-bff3-bbd0e5dcc14c", "comment": "Malware payload (RaccoonStealer)", "value": "b0e88aef463a947703d87960d7033628d8c17011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469358, "uuid": "afe29ce0-f759-45f1-9474-5662d128a0e7", "comment": "Malware payload (RaccoonStealer)", "value": "01bf57d4d0ac89e4c2db9edd7e7547d4afcfd6635228a74b9593a1b6da2685af52a65b5edc9c4a5bc2310d3a5648b22a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469358, "uuid": "2dc71b97-5dc9-43b2-88f1-35deb45e2b50", "value": "T143D4D010A7A1C035F5B212F859BA9268A53E3EF16B7491CF22D527EE4675AE0FC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469358, "uuid": "5d57e132-8d94-427e-af6b-db65b7c33a56", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469358, "uuid": "7cf9a152-a886-41f8-bce9-a890d54304b5", "value": "12288:hgBWNddGlW+w0XGh70/IUFVixERZ7UgHNtOtzPObvRivxGZZYEYLp:OBWNsdzO4QUFVjRZlttOtSIpWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635469358, "uuid": "81449dd0-8157-4d3e-abb1-2ec7e56754ed", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635469358, "uuid": "af4899f3-f5ed-479f-9f1b-4f48efb41a6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469358, "uuid": "82fef038-8574-4590-a48f-5072d7b105c3", "value": "d5d01917cfa8215476c43cb5dfaeae15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37df4295-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635484093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484093, "uuid": "dd34f878-50ee-4402-8a89-dcc9f2b5f320", "comment": "Malware payload (RemcosRAT)", "value": "27a9e4f59f0735c1cd5b6fec688fe6f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484093, "uuid": "9ef418bc-2781-45b7-a5cb-6a0c3d96721b", "comment": "Malware payload (RemcosRAT)", "value": "64e7a4dbad57f1c217a17ad6214d29230ac8ba813d001fdaa35f17fd83f62cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484093, "uuid": "9b2f6170-6f20-42e5-8379-8e89a194d10a", "comment": "Malware payload (RemcosRAT)", "value": "86de7e9b35afb3726a925b1a1b7bd00c81c2f6a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484093, "uuid": "83795483-317d-426b-98ab-cd08053db53b", "comment": "Malware payload (RemcosRAT)", "value": "d021aa40751944d17a06e5e2a62e79a84c7872e8af2e13226c92c3f4d5b10e1163c47d4707be671d730e08b886cc5a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484093, "uuid": "5a4c1789-eb41-4e7d-920a-646de0114e81", "value": "T1DAF4E62C7B914A72FF4EC23669010A24BB6B0F536E80AAF11FDF19C6979F4771C44989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484093, "uuid": "79768b81-6dea-49fa-b825-e82e8b371031", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484093, "uuid": "fd359c24-5482-455e-b260-3a9629138b67", "value": "12288:2olPlJt7LAGjrBSoMpGU0qStuVVzudkDNzqqYRn7UUa5xc3ADQ:Jt7LAGJSkqSkVVzuuFynO5YADQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484093, "uuid": "aaf5393c-0c6e-4031-823d-f312ccc329e1", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484093, "uuid": "ab2bb570-03fc-4730-8e8e-d3ffd044bef5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484093, "uuid": "65922a94-6990-4ab3-8ccd-6f2bceadd62f", "value": "TNT\u00a0Receipt_AWB\u00a0no#87993766478,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7325552-3877-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635484736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484736, "uuid": "4cfc922d-7624-4be6-ba70-29f0b7bbfb8f", "comment": "Malware payload (RaccoonStealer)", "value": "6baf8e82b31cf3774e2983ede02842c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484736, "uuid": "6fa70dfa-7f5e-4de4-a344-869f37fd2b75", "comment": "Malware payload (RaccoonStealer)", "value": "6540db4c80c867fd643233e553267254b7d7b4f8bece4a32bd99d4c2f128b023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484736, "uuid": "78629501-d65b-4349-a602-ada3ca8a518a", "comment": "Malware payload (RaccoonStealer)", "value": "1c650b87c4f7c38ecc81e54a2816677ed8867db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484736, "uuid": "7793eea0-a7ba-4dc5-8948-d7660f374913", "comment": "Malware payload (RaccoonStealer)", "value": "02a6f6bdfd18f767ed51fede9a552c342b524f15fb0e3a98bed2d19522d2dc699c083cf71876d9d73d580d14b025eb4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484736, "uuid": "adbe6169-b3c7-4d04-899c-d4cba14c603d", "value": "T113A401F1A2A8C3F1D0536930BC218AA01B2FBD1DD424408B7774666D1F7EACC6AE675D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484736, "uuid": "9d9ca0ec-de7b-48f2-b539-708abebbd294", "value": "5ec7965957c5433534918911424a4e5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484736, "uuid": "939b3646-cb93-4849-8b86-77e63e9ab922", "value": "12288:zfr9XoZ+lXJD4Ntequ3BwjuclCiLWOdMl8ucAkbRunnn7:XaZ8J8WquwKc3ucAkb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484736, "uuid": "17340275-ed7e-44a3-81b9-ef85f739235c", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484736, "uuid": "1a814e9e-f9c7-4110-ab21-e4f83f6ac66c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484736, "uuid": "3f4d2f81-9dfe-4882-b6f7-baf9760c4cd2", "value": "6baf8e82b31cf3774e2983ede02842c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8728b5-3884-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635490196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490196, "uuid": "e6d52fbb-2788-4bb1-9c4c-d888f2ab9d58", "comment": "Malware payload (AgentTesla)", "value": "c782f4bae4ffbc3e1b55ad6be2329fb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490196, "uuid": "5f4224b1-cd33-4a24-b99f-94cdbfdb2032", "comment": "Malware payload (AgentTesla)", "value": "6585456e6cfabbcad1faf5112a8d90753240796090ec70377c8134ae8f10a6d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490196, "uuid": "6b4a7edf-9f14-499b-813c-89fe8f2fbc42", "comment": "Malware payload (AgentTesla)", "value": "01530ae639f643364cb1476a9945019054e60130", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490196, "uuid": "9b8dd11a-42ad-4c2f-b453-66f552cbc434", "comment": "Malware payload (AgentTesla)", "value": "697d2bba717e3e92e795e0508461b997e55aa4c61546cc745fdaadb22bd5b7b29618852ef6208c0db310e3e28c85e688", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490196, "uuid": "1bc930c3-9cff-4a20-8dc0-0f3fbff3062d", "value": "T16694F1466368CB7FD5BC43B984A746204BF5A8133622FB964FC678DB18737C14E41AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490196, "uuid": "4b592e68-6227-40ad-8ade-5f4f90781505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490196, "uuid": "9e4f42d6-04dc-4d19-8c6f-5a501158e33c", "value": "12288:VMSA/Dq3r/I4cLmRQuZaJDE2VBPzTaMjLlTRzqfP+qf+:VMSA/yMHLVVEAZzTbRRzsvf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635490196, "uuid": "d1add09f-43e1-4961-b2f6-79d0c38335fa", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635490196, "uuid": "a0f1adc7-ecaf-4bd3-8acd-b140fb39bf7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490196, "uuid": "8464e0a5-f9c4-4bbe-b0c0-a6703366c7e2", "value": "TRANSFER SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf70194e-3881-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489072, "uuid": "b39f8725-1ff5-4376-b4cf-08050df8c9ff", "comment": "Malware payload (Mirai)", "value": "2f7ce4fdab3edd7aed014bd5a124c718", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489072, "uuid": "c6fa14c3-eb8e-4772-8986-da11c091a715", "comment": "Malware payload (Mirai)", "value": "6597350ca45adfe532bd93ffde9c92d98f2ed1ecedd4d7d73c6dd147b0b613a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489072, "uuid": "424a722a-5e65-4351-b292-6ec6673a6a20", "comment": "Malware payload (Mirai)", "value": "0b1e76fac74052db6e7a342cdba0f90622100093", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489072, "uuid": "cc349818-939a-46fe-b47b-ce3bd0d76ef1", "comment": "Malware payload (Mirai)", "value": "845ff64c973ec6522c053080be58df3f0be52ffff2efaba3fbafd0fce383c2a77b7d682641f2a852c1031ed6bbf04fd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489072, "uuid": "b97eb387-17f7-4158-b2c9-31d038c583bd", "value": "T128038427F5F30B93EA4964F1F19B2624BAAD82C675FC841BFC520DD87E1095B3092AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489072, "uuid": "54d22752-3e27-4683-92a0-f796fc82fe1e", "value": "384:scwxATYTY/41v0pvRFU+preqdBrF6wleRlJT0nJ2JMjP5:scwxAEM9RO+l8t4Nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489072, "uuid": "4cbce226-5637-4140-9d37-da0094d2abd6", "value": 38344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489072, "uuid": "5c3aa10c-246e-4a1d-af0d-2063b8d0a10e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489072, "uuid": "51777082-9805-4910-b840-aaecc9dff6bc", "value": "2f7ce4fdab3edd7aed014bd5a124c718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3330c21-38ac-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635507466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507466, "uuid": "a89a4902-1703-4ff5-b6e5-3d69bf8c3be2", "comment": "Malware payload (RedLineStealer)", "value": "777eba963e3d5e081d1eb7a697b5c2ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507466, "uuid": "e0670f7f-4f8e-4d2d-9a65-7066a61f6661", "comment": "Malware payload (RedLineStealer)", "value": "669f274f18e59c1600104f77e4622c96b5eb3cc0add18625103346ce9177ea9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507466, "uuid": "f9e3d27a-319e-4bdc-8ebb-4ed13c277571", "comment": "Malware payload (RedLineStealer)", "value": "d8300d8ee7f50196b496937b5dfe9ec98fa656cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635507466, "uuid": "b3ca65a5-b862-487a-ab55-f65d23ff1643", "comment": "Malware payload (RedLineStealer)", "value": "ef1313dcd966448653c82c0ac685b1f2284c336eca3b00d4ef0c0e497d2d499604762142d2e2d9158c02c581e59d478e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507466, "uuid": "442c59a9-e58e-4f29-bb0a-71b3f16bb600", "value": "T18F748C10A6A1C034F4B612F849B69369B93F7EB1AB7491CF13E526EE46746E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507466, "uuid": "05f87227-d306-469e-9b6b-eba81935e0ce", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507466, "uuid": "acf574f7-35f8-4df3-85fe-855b7ad87ef3", "value": "6144:EB4SjuGLxDTYDl5vSOTWrqz8jGgyy/MB27J:URjzL9aySWrqz8jGgyyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635507466, "uuid": "5e4dde1f-3c72-4adb-930c-342a37b5c356", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635507466, "uuid": "87a78e5c-0bd9-4dd1-b031-7cbc6f70919f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635507466, "uuid": "b6b42866-52b6-4c6f-94c9-41b173718c9f", "value": "777eba963e3d5e081d1eb7a697b5c2ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00e3c75-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485261, "uuid": "f51e0901-1b21-4017-a698-571a7d540024", "comment": "Malware payload (RaccoonStealer)", "value": "7894809cab465979568d1ee133bad481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485261, "uuid": "98c7b128-d855-449d-832b-819dc273e350", "comment": "Malware payload (RaccoonStealer)", "value": "66c4274b0a8ffa59ff6ec223d48c16d1345da2a18dfd2886706162f9cd2b0f7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485261, "uuid": "829a7ce3-3d10-4f22-84b3-a0cd569d7f11", "comment": "Malware payload (RaccoonStealer)", "value": "78f0ae4962fe5eb2f48cbf1a184176eb7fd43d23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485261, "uuid": "bc41c0b1-2620-4817-a080-e347d3fc87b3", "comment": "Malware payload (RaccoonStealer)", "value": "e7c7ccc2a35a46b58862ed6da29e67b754ac1293503cfe8dda803bc0f83e111c4c968097a189730305f3b5108d2682f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485261, "uuid": "9ac5d570-b9ba-47d6-94c4-2f7105526e3e", "value": "T100D4E010A7A0C034F5F662F84976A268B53F7EB1673494CF22D526EA4B34AE4EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485261, "uuid": "dd8e2799-331a-4387-b74d-dada2ca55429", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485261, "uuid": "8eaba30c-78d4-46ff-9e10-5f3dbf2ca3fd", "value": "12288:JEzXvAAn9oEuOo0zpPjD0jyId3IGyYzIktR:yzXt9oTOT02K49k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485261, "uuid": "5c03af11-0cc1-4d43-8b17-b10b232f9984", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485261, "uuid": "a72bcda2-b29c-4921-bfe1-49e74deb7b0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485261, "uuid": "84f96c0d-4c60-475a-85b4-987b1191be31", "value": "7894809cab465979568d1ee133bad481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8664cf-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635485363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485363, "uuid": "41181099-07db-4f12-9c54-0e1a604bf019", "comment": "Malware payload (Formbook)", "value": "d2416ffd6622325de15094f298d46498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485363, "uuid": "795d8c3a-6339-4029-aad0-67da4e667799", "comment": "Malware payload (Formbook)", "value": "66ebc2bbaf8ea07be988cce296542d9e1d7d24fbfe4523894bfd5a8c4474502e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485363, "uuid": "5c74ba58-6f74-44a2-a291-44022003a87c", "comment": "Malware payload (Formbook)", "value": "5a732449aded6f18071dc053ba23031effd9ce1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485363, "uuid": "2be41f97-0f19-4179-9409-c317d5f7c490", "comment": "Malware payload (Formbook)", "value": "96be83ad412a18bdad8918ef501f08258654209a9d5b193284a0acaea34bf3bb773fe1e04022f78140128736ef0561c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485363, "uuid": "ee04eb29-d1ff-4fda-a8f0-34023e5b1863", "value": "T18794E001B3E9575AD6BD93F8247711401BB6786BB131CB0E4E8630DE6AB2F814E51FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485363, "uuid": "7e60051b-6441-4593-a4a8-1a903bd23154", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485363, "uuid": "e7ba83ae-2ffe-4956-86b4-143bddaa5161", "value": "6144:ieQvDpuyQGco0XgOz1VmPD9UM+uzGNgrAo0QgS1ShMCI9LPpT9CTw:iPQ00wEeRF+uz2/o0uCa59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485363, "uuid": "c8eeae8a-9d62-4647-9e59-9d9efc43e27d", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485363, "uuid": "71978a8c-0160-471b-b68b-44149a011cca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485363, "uuid": "11274d03-a079-4f5b-ab44-2de1bb57c349", "value": "shipping docs 07853 draft CI+PL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9230bf20-38b4-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1635510873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510873, "uuid": "b2a047c4-d07a-4d46-ac95-e774c36afb3d", "comment": "Malware payload (a310Logger)", "value": "ffe72c0b077d5f676be820489ecec81a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510873, "uuid": "2eed5400-6188-48d0-b21f-941279495118", "comment": "Malware payload (a310Logger)", "value": "675b0dff6f40d1838f3e386abdb322f9491069f7b57a9fc1dd33fde9805d923b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510873, "uuid": "2660556b-4ced-4b1b-926a-e3d74524d844", "comment": "Malware payload (a310Logger)", "value": "cde15eab3928df21425863da28c42dd34b708f4e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510873, "uuid": "9bc6dac0-7ec0-4093-a011-2d58de8df080", "comment": "Malware payload (a310Logger)", "value": "b227367b165a74fbc8f28cf2e7f5a89de38c8cf298578d14921e84570dd3d0d6170dc155bdf8d162bdb54ed9d8e6cd49", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510873, "uuid": "128dc428-7ed6-42dc-b984-e74eba8a6729", "value": "T1BDC4010063798B6EE1BC07FD8093122947F59D637322FB610ED539DB2D23B825E15AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510873, "uuid": "3d207086-f904-4fcb-bd11-ee3e3dd4d9a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510873, "uuid": "8d26e75a-0b9d-46a1-ade8-2ee394de083a", "value": "12288:rlfZxT0BHMR96zQWCceAwkcTYLBli1pDUbG+HIIdH1bnc74e8cKUXpCo:rlfZxTV7cXjcTYLeUZdHFnLZVUXpCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635510873, "uuid": "f20cfff9-6fec-4753-8212-8e2472f87897", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635510873, "uuid": "1b95d2e2-cb95-4545-a1af-18a72694e7ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510873, "uuid": "fd3d13ab-ca21-4bd5-a4ee-b51ff1186f5a", "value": "6628819927788177272-DEKONT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d714206-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635484102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484102, "uuid": "25fe7f89-8b5d-4253-90c5-8bfd7c339aff", "comment": "Malware payload (Formbook)", "value": "08d3bd2830b9e748f5ea88ceadff2fed", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484102, "uuid": "77ea76b0-ae44-4069-bbad-6ffd34566a79", "comment": "Malware payload (Formbook)", "value": "677a6802cf75520248735347b919108448d91434aef53654cb6a3d6ab71830c6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484102, "uuid": "8901a1f1-0ef0-4cf3-815e-bfcf52f46678", "comment": "Malware payload (Formbook)", "value": "c241672de3bead4d8c2e4ceb1b53eb815b49b950", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484102, "uuid": "d2a3829d-9d10-4a17-a18c-0d30b8ee3cb8", "comment": "Malware payload (Formbook)", "value": "c4a23766177f4b4ce28cee0b1c0e6d36eb9ee15218a6c20f790eb65c38055e2d198db80707b1474f9bc03482d1725f89", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484102, "uuid": "f8d198ba-af95-47a2-b472-6be8acba26b3", "value": "T134A4E001A3EAA927D67D4F72047301501F71B8A6BD26E38F5D8831DE297EBC50A41F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484102, "uuid": "96fba5d5-e279-4f88-9521-c2ca27021eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484102, "uuid": "673eb223-73b9-45fe-a4c4-4c3db32d9de8", "value": "12288:AsFTvDJ2VyfQyH8mbx5EXwf9oafHafF8BF:AQDJ8krt5EgfC/SX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484102, "uuid": "be197841-ffb7-4f7e-987f-1f837ca6ef82", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484102, "uuid": "0099566a-dc41-408d-a926-02fe9a9bdfca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484102, "uuid": "b2f2994d-015d-491a-8524-e7dbfa18806b", "value": "DHL airwaybill # 984940550137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88799845-38ca-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635520306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520306, "uuid": "702e1a41-6caf-4d40-a103-bc2c4dc0ad35", "comment": "Malware payload (RaccoonStealer)", "value": "8522eb5b113a6fd5bbb6812afce9ecfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520306, "uuid": "0c501698-5c6b-474c-947d-a89c6a84696e", "comment": "Malware payload (RaccoonStealer)", "value": "67811b8b62a8783edc59e66c290bca8ea50a958ee828558c97ea820fcc6fca34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520306, "uuid": "a1b5d07c-9b26-4919-a761-403e573c4798", "comment": "Malware payload (RaccoonStealer)", "value": "4e487137b5ea242395b946d1ebe2503d2bf1fdc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520306, "uuid": "9e5391e7-b51e-4754-b460-10e5086720d6", "comment": "Malware payload (RaccoonStealer)", "value": "26fb126e20973864a1866ebe8c6b132eee77eccdc8e95ebe94f7a5c990760ab8d8fe1479ce86beb16858a25162c88d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520306, "uuid": "d35084d2-d728-436a-ab17-fcfd60b0c9b4", "value": "T160D4D000A6A1C035F0F612F85D7AA2A9653F7EB16B3490CF23D526EE4674AE0ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520306, "uuid": "37b46758-cd98-4f99-a3a8-37e4cf8319f2", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520306, "uuid": "1f0930bd-c053-46c5-8778-b96a315e02e9", "value": "12288:Ph3tsw0X/ooQ8QWZMoxUYia41JGaujZUgzCKwxfv36nB:53yw0wy3xUYiyaujZXuL3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635520306, "uuid": "558ae209-f6eb-47bd-a421-9e1bc0920941", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635520306, "uuid": "02dc95c4-fcfb-44d3-a428-d4cba99e5cc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520306, "uuid": "bfb09278-dce2-479d-9bf4-12d53e7adf66", "value": "8522eb5b113a6fd5bbb6812afce9ecfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64faf6f3-3895-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635497483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497483, "uuid": "aabfa8a7-43c5-4a5b-88a6-7ac4655cb01d", "comment": "Malware payload (RedLineStealer)", "value": "4485f72031dc19ed262a13bce0fdae18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497483, "uuid": "bd242f69-2a93-4544-803d-24600df008c6", "comment": "Malware payload (RedLineStealer)", "value": "69cd6e56d5e35f34a560a73c54a11d39b1e32e8a33c518e58cfe820ebc2f7921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497483, "uuid": "6c1e3f78-352c-4835-8da4-9f8a24162431", "comment": "Malware payload (RedLineStealer)", "value": "2406ea5ebfdc28bb3df449261b8cc7ff9fad29bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497483, "uuid": "c405fd46-d1bc-44d7-8bf9-25793d05c03c", "comment": "Malware payload (RedLineStealer)", "value": "92685fcaecb950b5030808dd8aa6466e59705e08cf6b7c01b6ccd7800d37df24f1afd507fe2d57d914b3cd428a3d854c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497483, "uuid": "603edca9-a8b9-471b-b74e-f8d352d42aa5", "value": "T12F949E00FB90C035F6B316F489BA9369B52E7AE15B1451CB63E42AEE57356E0EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497483, "uuid": "7a6c8b6b-2085-484f-b1dd-98a4d4db8bbd", "value": "42a85e96dd3802acf3c449e9535a10b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497483, "uuid": "f64c66c8-1b54-49cd-b544-591869a9247e", "value": "12288:C0OIobrZ9SNY+lvXdaiI3OVFKhWdsvv4/h:CHIMrZ4NYiRrKVvv4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635497483, "uuid": "54a5ea51-ef36-4a17-b5b9-77bfd42fb36b", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635497483, "uuid": "2019fd96-6a4d-4b7c-bd1a-4c762d43fecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497483, "uuid": "545bbbea-3af8-4586-9f66-51c29d1a0b6f", "value": "4485f72031dc19ed262a13bce0fdae18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed203c20-38f5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635538943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538943, "uuid": "8f9b6f6d-73c6-4bf4-b097-3ce74f31ab95", "comment": "Malware payload", "value": "c41d9625ccd175647ffa10484ab2556d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538943, "uuid": "0460fe4e-b8c7-4e78-819f-e07a606899df", "comment": "Malware payload", "value": "6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538943, "uuid": "dbf37ba3-32fa-48ce-b117-efe4a23265b6", "comment": "Malware payload", "value": "77d7614156607b68265b122fb35a1d408625cb96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538943, "uuid": "f69cabfd-db47-4559-9064-1e31e631dff6", "comment": "Malware payload", "value": "315484841aa16f9bc7a7b54b025f32d29a4aacb13ccd3c9190aca99a92e648c0b2ae9a22f03ffd72f0ef5b3875884302", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538943, "uuid": "06416ae1-39a1-4fe7-b9be-a464bf5d28b6", "value": "T138B52843BCA065EEC4BBD3358D9182A2BA3078891734B3D71B6197B52B33BE45E76341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538943, "uuid": "5d668369-7c01-4b57-b3e8-f0376b1a9ba1", "value": "49152:kOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1:k1Dw+b3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635538943, "uuid": "26ba498b-1f1f-4874-bf92-baa839f7bf6b", "value": 2359296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635538943, "uuid": "51a8f6b4-faf7-4c21-bb6c-ca31db106548", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538943, "uuid": "091b051c-feca-4000-b5e5-ca2322d8f0cb", "value": "Filecoder.Hive_linux.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdfad86-38d3-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1635524023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524023, "uuid": "0652b482-9ae1-4521-9eff-99cf83232f22", "comment": "Malware payload (NetWire)", "value": "f3304cc314d7e62b283f262f01a6bcdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524023, "uuid": "952e5ecb-e9fa-414b-bdfc-9a638c7023c2", "comment": "Malware payload (NetWire)", "value": "6b4401690cb0a07ee98ff3c5fc351b20c6e0a4ba7474c6ad858e5dc69a60b36f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524023, "uuid": "cba50da0-8515-493e-9ea0-5c121f45dc49", "comment": "Malware payload (NetWire)", "value": "714acf076bf6de8d1326e5f882d36bad8f012ed5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524023, "uuid": "e23513d4-2469-4395-ae09-1a2fdd9fd153", "comment": "Malware payload (NetWire)", "value": "4eec5e5f544df6e7001e89accd46ee464ba5741af2942075acfc06f812068350a54fa939c674caa324b4f2acddd58f7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524023, "uuid": "688fa9a6-f9b2-48f8-a937-c28dcce8deec", "value": "T117F31719FA87A4F6FE0B1D31919BF33F0B757A01C130CE92EF541E85EA23C26151AA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524023, "uuid": "bc84151d-a1b8-489f-81d9-2e3ca7c0804a", "value": "4563c74acbd357d386b177e402b96ce4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524023, "uuid": "8675edde-066a-41e7-98ce-3cd903ef7130", "value": "3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvXYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/XzQqqDvFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635524023, "uuid": "5a142d94-7e59-4201-b40a-9562c1bb09c5", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635524023, "uuid": "0fc58120-9b83-4d48-be5d-fd83fa9a9d08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524023, "uuid": "93147265-9f88-4c18-a6f6-f734a4e1d2af", "value": "f3304cc314d7e62b283f262f01a6bcdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a313f8-38e8-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635533097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533097, "uuid": "f694a588-b1f1-45c0-9dee-3a928227bcfa", "comment": "Malware payload (RaccoonStealer)", "value": "02dd211d60a3fc847e7d25bf5966ca5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533097, "uuid": "b28edd0c-891b-40a9-a288-b78f542a47de", "comment": "Malware payload (RaccoonStealer)", "value": "6bca7ca9aacdc3544f61887a7c9ac5f1f6fc53fccaa03fdf27b7c365699bba12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533097, "uuid": "171c0d85-f2c9-46cf-89a5-4b200ea796ec", "comment": "Malware payload (RaccoonStealer)", "value": "03e20b08b92644584c6edc1e398ea9ba6d45c21f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533097, "uuid": "514a97e6-e164-465b-a9f3-dcf31d526520", "comment": "Malware payload (RaccoonStealer)", "value": "a8361ecc01c36b7d0688b662e5ca9d4024c7af70c61ca6e02675ae6639bf30d4fe5cae7c2c1d695d606bc79a0fb72fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533097, "uuid": "0bb8888b-227b-4099-ab42-bf083d1a23a9", "value": "T1B2D4D000A6A1C034F4F652F849B6A3A8B93E7EB1677854CF53D516EE4638AE4EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533097, "uuid": "640a6d21-82ad-4203-9477-15d190c97c3f", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533097, "uuid": "604484ed-153a-4384-b3bd-b0fdee3230dd", "value": "12288:2Rnr9Vk9K7laTZM+i3gNgLh0+dQwJQS+Kw4RvHayy7x:mnxK9glKZM+iDh0/wS9kH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533097, "uuid": "db958b30-ed98-4c5b-a6f7-f60274ee852b", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533097, "uuid": "d4ffd333-7956-4116-9bec-a6957471a025", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533097, "uuid": "2c80af1d-e529-499c-8b1f-eb0b6815fc33", "value": "02dd211d60a3fc847e7d25bf5966ca5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39979a06-3885-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635490538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490538, "uuid": "00830b7b-f6cf-4ea3-9512-ca0e432746cc", "comment": "Malware payload (Mirai)", "value": "41d9ba1c9ab258c5a245acad3719772c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490538, "uuid": "f217b33f-b412-4acc-aed2-4294c333d649", "comment": "Malware payload (Mirai)", "value": "6be387e297e22ce1b451ae8fb9a7b7114ceb78b0b2800267002c2ef3329a2bad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490538, "uuid": "81672772-e755-492c-9cf3-12ac173b6cbb", "comment": "Malware payload (Mirai)", "value": "b613a3b8d52d599fa63b39d93150e2e9b755038c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490538, "uuid": "97b0cda3-c0ad-4fdc-a0ad-8a253b78db6a", "comment": "Malware payload (Mirai)", "value": "f8da0a87b199e7d359518c0ebcc3441ad0af6637e0e1ca77e153cce4aa6a22177e9f21bed681b05d4d57565b21d44468", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490538, "uuid": "b727311f-f149-4b56-b5fe-40f4c8db9ea0", "value": "T188432925AD792E26C0D8B57E11F78724F2F2220E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490538, "uuid": "0990df16-17ef-402d-8f41-b8231b874b1d", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDZ:eL0AxvSHfymp0xgunvCkV6vTMDau2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635490538, "uuid": "f0371c2b-41d4-48cb-a4e0-f0498cddfe9f", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635490538, "uuid": "8b6fd1d1-5b56-4155-b12a-22f0990b8755", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490538, "uuid": "cf83394f-23d5-432f-b9a7-0a0105e46eba", "value": "41d9ba1c9ab258c5a245acad3719772c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad233a5e-38e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635533252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533252, "uuid": "c1ecf935-2c26-4946-9499-21154ce5d0fc", "comment": "Malware payload", "value": "e955bd8d18d22dd108fb7d26c3a042bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533252, "uuid": "456fdedf-7043-4f86-aea8-5c576294be71", "comment": "Malware payload", "value": "6d1cfe521f8ec86635395600f0fe5d40678e789380efbce873f191b67ea015ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533252, "uuid": "950947de-f59e-4f8a-96f9-66875cfe649d", "comment": "Malware payload", "value": "3ee646b49da8b451b2adcf6211e67db2ef0a1d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533252, "uuid": "6b5c3fa9-b70f-4e2b-bcc9-b073244a52a0", "comment": "Malware payload", "value": "a60a93de0155513d7e87646100df0e40a332cd43509eaef32de8c476bc6a8c79a29936eee0a46d2cdbbd18536fed3a0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533252, "uuid": "aa015b11-58f0-40c3-9d22-edd7b45a431f", "value": "T1C4C49C01279781D5C8FA13780A698354D7217FE1F9E3AF3D794372AAEA722C076417E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533252, "uuid": "ade25188-f4b1-4306-bc66-6b4301108024", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533252, "uuid": "4ca78d14-ff70-4b5e-ab67-d1ffdbf33d60", "value": "6144:exzqUw79eqlIhfQAh+pkwUf7twVFkjgKQP5W/sngRuciYQS2LhMAmkdQ:OzqUw5lIhYnpkZ7tAj5UWFcpQSeHdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533252, "uuid": "b47f6f63-fe00-472a-a4cb-39d72ab29ab8", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533252, "uuid": "c12cba01-2b9d-4d61-9d14-213cd1baf3d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533252, "uuid": "cbac6293-c724-480d-83ff-9523eb0b0336", "value": "e955bd8d18d22dd108fb7d26c3a042bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2ca0ee-387a-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1635485820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485820, "uuid": "70ca13ff-9229-4f64-9a03-5de5d77c86c5", "comment": "Malware payload (BazaLoader)", "value": "1788ff60c96f28ec0386a838edaa48fb", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485820, "uuid": "89c0e22f-a86e-4bc0-b99c-53285c6e6419", "comment": "Malware payload (BazaLoader)", "value": "6d8fcc850b8c796be3f6244f1f681332d155486bdd326ad6be78ea7172718db4", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485820, "uuid": "4c9b5556-bc31-4204-b86c-39331ec6f53e", "comment": "Malware payload (BazaLoader)", "value": "78709487cadc1d995de9787c2735f52545d93526", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485820, "uuid": "91a78b2e-b104-42ff-9451-81357b6eb3bb", "comment": "Malware payload (BazaLoader)", "value": "ecaf42d9eddd64ba7cc64a87e153e1352f94030c553e020d29d258aed115f363b82d594f02ed1799653492c262ba687a", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485820, "uuid": "79a9e5af-c2b9-4ada-9318-66426fd04007", "value": "T117750916B3646591C0FBC17480836F52BA3078590B3667E74BC04669AF21BF8AE3DBF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485820, "uuid": "20080ea3-f34d-42f4-904c-994b3d181b14", "value": "ce543b95297c6bb89c2576e9105d106b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485820, "uuid": "5ef205ad-eb83-40a8-84e0-ff380f56b813", "value": "12288:zZt9mlqOLdL6a+BN1CYqNdJcz1e/tXP2YM2NZRBB6KY2rn65hZF0xmmTXrbrL4:f9ml2P1orJcz1CXnM8tMQn65Lyxmon8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485820, "uuid": "20b9baa4-72bf-42dc-8419-f2436ee62240", "value": 1654784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485820, "uuid": "af5d05d0-6a78-4f49-bdd9-a7b7b6e84d23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485820, "uuid": "bb4de963-e32a-4b54-9ffb-1d6c0381d516", "value": "1788ff60c96f28ec0386a838edaa48fb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717a96ca-3882-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635489344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489344, "uuid": "7a253436-4592-428b-82e3-08c16a945f46", "comment": "Malware payload (ArkeiStealer)", "value": "cc63cb7d19ca8cffa27530b760c81528", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489344, "uuid": "a0fcebb1-ace9-4e18-8dd2-b6ce6b593c37", "comment": "Malware payload (ArkeiStealer)", "value": "6e43eb9d740ae582faabd5f31fb248cc2804b4e5af2a9122f7ae2fefacdf8292", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489344, "uuid": "bec14030-7f43-4d24-b6da-1694074ea90c", "comment": "Malware payload (ArkeiStealer)", "value": "2763c9c0646cf0166c7d4a9c94907ce1d4ab9d78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489344, "uuid": "f2317c54-5aba-4f91-8ebe-0d7809d4e431", "comment": "Malware payload (ArkeiStealer)", "value": "36d72fa58dc52ef146827d82090e2b79533cd00c6027026bdec5a6f38081bb58a2210c70f8d6c52f517aa46cce091a7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489344, "uuid": "626a2b8e-185d-4eec-b85b-69b09dce49e8", "value": "T10D93FAD2A5CD449FC970D4F21AC693D345FE59E099325603323FBE582B2690FAA63F48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489344, "uuid": "82b77d97-080c-4387-99c3-113af35919d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489344, "uuid": "c47bf723-93b0-4aa0-8706-b5ee589e156a", "value": "1536:mGT6MHTcbGI17LBVpU0sh4BGaL3aumVRl:my3zDABGVu8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489344, "uuid": "740e87b2-b391-44f7-bd96-4ea53c00baed", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489344, "uuid": "d5ce995c-a1a3-4831-bd40-b9b8414740d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489344, "uuid": "e736529d-ee5a-487b-9fa7-ecc4474bc937", "value": "cc63cb7d19ca8cffa27530b760c81528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71e7fde-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635526800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526800, "uuid": "08e8dc31-b838-463e-af8a-48702337bffd", "comment": "Malware payload (Mirai)", "value": "4650bf2d9ef27838b6afd98241269841", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526800, "uuid": "e0120638-045b-4696-92f0-c3c761c20628", "comment": "Malware payload (Mirai)", "value": "6eb11b9b7a265d8a54ad1de0daa45361336033449f61341262c16aa1ba6b7336", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526800, "uuid": "77175d32-3a53-4d5b-b30c-3dc58c10abaf", "comment": "Malware payload (Mirai)", "value": "df96f495994d31b8d3d0fc6d364b8bc26242d588", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526800, "uuid": "aa42ad5e-799e-4e13-a4cb-1caf7aa847d1", "comment": "Malware payload (Mirai)", "value": "95964bd423497c0ff89bc57f0395d64f2cd01a161d2e93436e52a6d0ad0ffeedfaccbd2a5b514ee47c0452849b23ebb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526800, "uuid": "e001c34d-b782-420c-8ec7-a17b8d09c55d", "value": "T110A3B51E7E259F7CF799823947B78E21979433C62AE1D141E19CEA015EA024E381FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526800, "uuid": "da1cd95a-4114-470f-ab7f-a050b372a984", "value": "1536:oXuCluC9KSv4LhusM3lVqiiuzVLHNVVRlwfj7jacx6z+GqMdQ8a:ouCISv0A3qiiuzVbNplwfj7jacx6Kira", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526800, "uuid": "cd3623cc-eeb7-4c0d-b515-ef72bbb7b707", "value": 97816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526800, "uuid": "56301bd3-9a43-4637-b570-c3d12db68c48", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526800, "uuid": "36635053-a5d2-4704-a32e-b6ca20813347", "value": "4650bf2d9ef27838b6afd98241269841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ea0ff5-3888-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635491906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491906, "uuid": "b6c40d43-8830-45cb-8aab-81617aa738f3", "comment": "Malware payload (Loki)", "value": "aac9bf3c9c487501cd28edbd064d0709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491906, "uuid": "f8863069-14f3-4116-8ad2-35acd2f5d161", "comment": "Malware payload (Loki)", "value": "6f4be74e6b284f46d391aab956b83bf8ffdaf98cccdb8be8aa1648684b4ee678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491906, "uuid": "53d5e400-e299-400c-82b5-4400a5c6069c", "comment": "Malware payload (Loki)", "value": "4a25855089089974c225c28b823db3c1ce871d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491906, "uuid": "53452fcf-2049-4e00-8b65-aff5d741881c", "comment": "Malware payload (Loki)", "value": "f33f459ebbfd990c67f64776f0405a05e59fe173312f85966ea50489af8b26b2922da46bf50041bd367cdbd29c75ff5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491906, "uuid": "c3619ef7-68f5-4f26-8be0-c1517cd72d76", "value": "T18464121BE3A89A0AC93551357A97D86B8331FF7A4442EB3A319EB18D3F3C54519033AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491906, "uuid": "aebf483b-f47e-4903-8f68-495172e0548f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491906, "uuid": "9eab4a71-8aac-4403-88ee-b61decb4ce03", "value": "6144:iCCK4vFiA7JnMvM/cDo2rQqXhfILlZPZe4JgOO55vv37GUnyO0y0Rlgkl8:nr4vFmE/JQTgL7xe44Nvc3hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491906, "uuid": "01b1b9fb-762c-4afe-a33c-e7a5fda942e6", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491906, "uuid": "4cc59f68-69de-421b-8832-6406720d8cfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491906, "uuid": "b6d3eb96-57c6-41a3-872e-b39a074f4fde", "value": "Orden de compra (po) 2112 #.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b06462-3909-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635547281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547281, "uuid": "3e3623de-6209-47ac-b113-1ecd7a6e3528", "comment": "Malware payload (ArkeiStealer)", "value": "a5398c3287b1d7e83120aee87d769b6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547281, "uuid": "03492ea3-d881-4af8-9d00-2ec631a4d0ac", "comment": "Malware payload (ArkeiStealer)", "value": "7133ec3299ec3db49f96be5fc22d1ce537e3390f034ebce31b60c9a21003b089", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547281, "uuid": "7cce907f-9353-426e-8f6c-128442293649", "comment": "Malware payload (ArkeiStealer)", "value": "63511a1774347260faa046e4389239140a0ddee3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547281, "uuid": "35dbe18b-139a-4277-b3d3-066a5a728f0e", "comment": "Malware payload (ArkeiStealer)", "value": "6294082846e40851a06b02e4a2bddd80790de56e9614755025496706584c80f6c1e0ff5cbe36703724b116adb596831f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547281, "uuid": "0ea1ed68-9103-42e6-9eb8-942c3e8d4d7d", "value": "T176F4F110BAE1C035F4F622F80ABA9769B43F7A716B2854CF12D557E90A346E1EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547281, "uuid": "ac4c56cf-e346-49d3-a467-0e0f99cc3c82", "value": "518d84bc9a231f5bb2827b0550b9f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547281, "uuid": "928c4ba8-78f5-4060-b133-3f7191542810", "value": "12288:M+KXsFxXu7psVFMY7U0OWbDa5mdSsy84pGE7jvLwQIGox3FQWLKP0Nk7B6:/DFasdUX8Da5uSsyN0E7jjwQCR6SN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635547281, "uuid": "f7a57b80-4afb-47eb-9722-581915766d3f", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635547281, "uuid": "0459ad1c-5cb0-4b2f-a0ea-6c1492f9ed46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547281, "uuid": "63614fb4-5466-4934-9ace-e7bf701390cc", "value": "a5398c3287b1d7e83120aee87d769b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28053c6f-38af-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635508548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508548, "uuid": "90b0ab92-8ee2-4b78-b6a4-c58621c33eee", "comment": "Malware payload (Formbook)", "value": "a18f3c54efed2e42168d6748a5c04c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508548, "uuid": "24fd571d-6e75-4f68-ad94-655589766184", "comment": "Malware payload (Formbook)", "value": "724908fa2c546fad14d2a687c9f471f75548903b2d94fb903d617570cedaef7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508548, "uuid": "2a79b0b0-a76f-470c-8347-e9a5f64a2c67", "comment": "Malware payload (Formbook)", "value": "4aa01a7a9557d15ef251e1bd107ec821872549b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508548, "uuid": "41ea4dd6-1b82-442b-895d-fab7e3049d4a", "comment": "Malware payload (Formbook)", "value": "f2f374d84684175bf669f0a53c1336b07f0c277dd1133e51ed6ff4ca16f8240e22c69715c6c6c82d2876e7bed3d291ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508548, "uuid": "db09bc45-63e7-4447-8766-143157b2df18", "value": "T1CE84F154673C9F6FE0BC07B88053156857F29C633361FBA54ED678EA2933B814D04AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508548, "uuid": "8a867b90-aa68-4c14-b856-293d89b2c5e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508548, "uuid": "3eadc6f1-83c5-40b0-b870-c523f0e0f709", "value": "6144:clfZxvLf614b47d6f4Gz4K6DCFWZ1B+hfnvrrcqQQJSZmYPugGOHmyDqC2K9TChL:clfZxT2BuvrrcTQEzPGOGyOCXTCKscYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635508548, "uuid": "3466a42d-7d28-44da-a45c-a897f1abf664", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635508548, "uuid": "417a71f6-b557-4ef4-8e99-ed3aaf633e1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508548, "uuid": "2522dd78-2ba6-42a6-894c-469bbef43e84", "value": "T2812A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf6a726-38c0-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635515858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635515858, "uuid": "db29e308-88a1-4ba3-9372-d5ebb9076829", "comment": "Malware payload (NanoCore)", "value": "4fc18805b5686d320a0ccdab8438ed7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635515858, "uuid": "b44595ac-c9fc-4f48-a680-b1678c73a3d1", "comment": "Malware payload (NanoCore)", "value": "7257729274b6ab5c1a605900fa40b2a76f386b3dbb3c0f4ab29e85b780eaef73", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635515858, "uuid": "5514e6d8-4d0d-4dc3-a7f6-19f3e407d70b", "comment": "Malware payload (NanoCore)", "value": "afbe3e8f7448be3ace8f48f37c1524748533ed94", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635515858, "uuid": "357f4ef3-9bcf-4160-a34e-4fa1eea1ed17", "comment": "Malware payload (NanoCore)", "value": "0413ea1c343cc7f5862466ed35c0e8963308f194557def53dc4f76a8ffa862d7adc5af71767c31084c1cf21682b84b9e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635515858, "uuid": "91e49b6b-e248-4efe-ac18-b60416199005", "value": "T16FF19E2E7C88855D4F9B61E56B4DCEA53A235BBA83D6B470CEC8A504B0447C8B3DCD31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635515858, "uuid": "8749ac79-5ca8-49fd-948f-c0c2c68e6c34", "value": "192:oWAKxkz+bogcyyv9bM0MDkigxTfHZBkiADviMXObFKU5LiE:sKxm+OVbM0MQnZZAOIObFKBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635515858, "uuid": "8351e7c4-18c3-4c5c-9869-0a7d3ba7643f", "value": 7789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635515858, "uuid": "fee4c1fb-c8ee-4bc2-ab99-436efafc2850", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635515858, "uuid": "b62304b9-714d-4747-995e-2c51f0916c61", "value": "#CHOO2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7edf7f8-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635485623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485623, "uuid": "44ef3c8d-9d47-426b-a95b-08d6675cd602", "comment": "Malware payload (Smoke Loader)", "value": "fb2a6a786318dbfa1abfcdf24b55f36d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485623, "uuid": "5df79835-f062-451c-8da8-c09b301244f9", "comment": "Malware payload (Smoke Loader)", "value": "727727f29da32d4767af81b086ac291d6764dd4c74cbc5a7ddd3d83e6ff9cb88", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485623, "uuid": "44ab537b-424f-4f08-acd6-84261e363db4", "comment": "Malware payload (Smoke Loader)", "value": "8282009d44e88cfc1974660a03feef5c1109f54f", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485623, "uuid": "171927a4-469c-4138-b12d-b8270bd0acd9", "comment": "Malware payload (Smoke Loader)", "value": "5a323952103b495731259d2259e439fcf080bf878142442e455e4da80703508c895779266f778e2c7b0fb5ead8532779", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485623, "uuid": "de7e1b70-25e4-4d10-9b2d-df12705519cf", "value": "T167049DF0769CC4F1D4A33531C866CAA1462ABC71DE7099473678221E1EB4ECC5AED35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485623, "uuid": "2af5078a-0dc7-4bc5-959e-9f5f51c0020f", "value": "18875662b19ade4ddd6bba43f9abb4a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485623, "uuid": "8cbeff81-7e5c-4b10-a1f8-1c00dd5bfdf5", "value": "3072:GCjq8W/DQvEi0p07RuiDrS4YXzI/pyG63tWrxpzbgqrukVggjcGkNIVqI:rj+/DQvEzG9pVYkhyG63tuzbgwuA7ITB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485623, "uuid": "22f664d0-9ecb-47fc-ad56-c3a80bde00ec", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485623, "uuid": "adebf0e0-2c93-484f-b52d-d868a689ffac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485623, "uuid": "f994a7f8-2c45-41d3-acbf-547eb1326ae8", "value": "fb2a6a786318dbfa1abfcdf24b55f36d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753d467d-38c2-11ec-843c-42010a9c0014", "comment": "Malware payload (BillGates)", "timestamp": 1635516838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516838, "uuid": "6585d15b-98fa-4162-b7fd-82a9d2a71c50", "comment": "Malware payload (BillGates)", "value": "993effe8c508b8db63f3b8c99061a43b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516838, "uuid": "bfb673b4-0c32-4e0c-bd15-2031a99edc03", "comment": "Malware payload (BillGates)", "value": "72894f70269d12430eca6e3c89fa739d3e89851fe53cf4185b68cb0b7b10a385", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516838, "uuid": "d892326b-d456-485b-860f-2ffde6b7959c", "comment": "Malware payload (BillGates)", "value": "8ca2332487a59e2690f34d6ad5b397e52ce8b711", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516838, "uuid": "dd0f9ba1-5567-4081-8fa1-2cab455214d6", "comment": "Malware payload (BillGates)", "value": "39d728e27bc54da5be19ba6fa17cb14838399d07ef95d0358602e430fac254585313811a979c635b433c16d22aab46c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516838, "uuid": "78ab922d-03b0-4a13-ac7d-6cced8c41e69", "value": "T1B9456B12FBD0CCB1D84616B5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516838, "uuid": "ddafa177-0ff1-4149-8e4b-f1fc46bfd4ff", "value": "24576:e845rGHu6gVJKG75oFpA0VWIX4a2y1q2rJp0:745vRVJKGtSA0VWIoZu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635516838, "uuid": "7b51dbdd-e7f2-48f7-9d56-29c224014c31", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635516838, "uuid": "0d218cbc-4a34-4c29-93a8-01491fd5b9ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516838, "uuid": "2b94d38e-5f79-442f-9b8d-9a2e553c1b7e", "value": "993effe8c508b8db63f3b8c99061a43b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883e3faa-38ba-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635513434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513434, "uuid": "23071f3c-a157-4f60-9d97-48a47115ec77", "comment": "Malware payload (AgentTesla)", "value": "3f1b58eb259ef845fea130a2de124202", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513434, "uuid": "65686ea7-89c0-4f1e-a50f-b3e88bc7f9c1", "comment": "Malware payload (AgentTesla)", "value": "72f05770bd4d04d1a9eb6e083a8ffac5b3ad89a16919b27f7fdeeebf25e7d75a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513434, "uuid": "c8b78f8f-2ff5-47fb-8a24-6b3adcb7d061", "comment": "Malware payload (AgentTesla)", "value": "a38a87987980050f23520fbfcc514b29751a0dec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513434, "uuid": "eb8e14ae-92b6-4200-8440-ba82c1df7a9e", "comment": "Malware payload (AgentTesla)", "value": "74de8ed623bcb2ec55c0220819214742befc5e055fa81c712a2e605bee3eb862462e14426bec11ef62750d08bcc4181a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513434, "uuid": "08d4eb32-d1e4-4637-bd2c-4c3eda2e416e", "value": "T197B4E00163E6AA16D77D0FB6087711205FB1B9573D62D74B5E8830EE697AFC00A40FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513434, "uuid": "0da594e8-01ec-40ae-93ca-f37b51a0a731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513434, "uuid": "5f5770d9-ea85-4a26-a262-02e7184fce57", "value": "12288:RSyAR0S/EQtFJ3Z3vDO2hUA/W2sFpBJzU2RIk8Ay:RSAEHjp3g/2anY2RInv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635513434, "uuid": "5c9267b1-5f50-434b-b5ef-eafafd023366", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635513434, "uuid": "45f6d8aa-0db6-4188-9a71-336a11f3df97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513434, "uuid": "66dd76e1-54a0-4ce1-8540-432ad8b326c7", "value": "Order 7637 Vessel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326a257e-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635485372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485372, "uuid": "08b01e3d-2b53-4154-bf6a-c834add4dc2e", "comment": "Malware payload (TrickBot)", "value": "157c7f70ff6dc342506d9dd269c10950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485372, "uuid": "fdd87603-e51c-428b-9d38-68e0aee1264f", "comment": "Malware payload (TrickBot)", "value": "734f8fbef8f83ac79bb0fa464a091889c6cb044b4e2a3471138ff766785e2361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485372, "uuid": "675257dd-ff0a-46f7-895b-540393a81a75", "comment": "Malware payload (TrickBot)", "value": "2fafec7f6d5da682e3d9f945edd258f080cd2797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485372, "uuid": "a75614c1-f76b-4e3d-ab3a-be7c3f6cd166", "comment": "Malware payload (TrickBot)", "value": "b10dec241e586f3e2c07169ffc2ec841db43e7ccc42cec5724a60c9b4a356cfecd464d3d2284de67c553114142e0a454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485372, "uuid": "9afc9a05-b90f-4d7f-aed2-9605423ba5e3", "value": "T152E4EFA17B95C1B7E6B201750FF63B3596FBE9600F207BC323844B5C5A328D14A3A766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485372, "uuid": "fce62f0d-5c54-477a-a366-20488b9c0c4c", "value": "7ffe85aa6061465054775c61556ce3a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485372, "uuid": "87f19dd1-179a-4247-a4eb-e89aa1ced206", "value": "12288:0bJ2lCSCeOVkk+8x2fU3JXeqZNEo9v3cOvhkMDfdil/Cxofh/Q:vCeOVv+8xtHEqcMyEfdqCxofh/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485372, "uuid": "bf51dbf2-261e-443f-9a93-767e67aba165", "value": 692267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485372, "uuid": "db495dd2-b9f7-43ad-aaa4-1187f56433fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485372, "uuid": "37f04b0d-34bd-4aca-bc21-d7b4c3cda101", "value": "157c7f70ff6dc342506d9dd269c10950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9842f665-38f6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635539230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539230, "uuid": "acbb1169-52db-423c-8bdf-28047a0d4e07", "comment": "Malware payload", "value": "ba810a8879b6ba2cccd49e28789fb059", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539230, "uuid": "301c51d3-c362-4c8c-a7d8-6e833ec35a16", "comment": "Malware payload", "value": "7370c09d07b4695aa11e299a9c17007e9267e1578ce2753259c02a8cf27b18b6", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539230, "uuid": "2bd81bc6-890c-4bb8-9d18-1cfcc9a8ef34", "comment": "Malware payload", "value": "b79b45695eb3b61410c1ddf27b2aa4b75aeeffe5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539230, "uuid": "e21ab9b9-4cde-43f6-8a40-ce08bb61e925", "comment": "Malware payload", "value": "ebf601fafb539305a24d49debb3a46dc4042dd98ff5ac0617a77de12c926361615bc129b25df1567da204a4113f9210d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539230, "uuid": "598da0bf-1544-46e9-9f25-4bae1aed461b", "value": "T147A40A3F6422015BFAEA8C34DDD8B3A6D6932A394E3BD8F25DB0D17268381649C57353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539230, "uuid": "0b596107-03d5-4010-8a17-5907c8f82065", "value": "1d30df1e5b7623c4b3e7485c04815cbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539230, "uuid": "3b9d7b83-ccdd-4f24-aa1b-0afc5dc5d4c4", "value": "6144:n063Fqg7uKUITd3Mo/SO+6+yoprzfXW82E1:n06P7uKDd3M0R+6+bhzfXW82E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635539230, "uuid": "80afaf53-6c84-4db8-8e3d-be6aa1f8b9fe", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635539230, "uuid": "902510ee-4f32-4482-9d77-ca3b2e838f43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539230, "uuid": "2843e873-cc50-4767-92d6-a83c36941c11", "value": "oldmystat2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e233bc74-384c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635466340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635466340, "uuid": "84a53e35-c9e8-4c9d-a1dd-4dfe9cd692af", "comment": "Malware payload (RaccoonStealer)", "value": "8dae44fe1bacb0601cdf02ae6898173a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635466340, "uuid": "eb55a34c-5c6f-46f0-905b-2befa512feee", "comment": "Malware payload (RaccoonStealer)", "value": "74816f56b7e8ada613ca8151c4d904e0e603019502382493d70138d7c6cda410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635466340, "uuid": "74b72b7e-e1a8-48e0-8683-5405d10fc2c6", "comment": "Malware payload (RaccoonStealer)", "value": "fe910149be006c7b6b692ca23d277cb357e3811b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635466340, "uuid": "caef6669-4e39-4186-b1e0-9aefd0a6052a", "comment": "Malware payload (RaccoonStealer)", "value": "84f0de4bcf8b4c88f730df2b5f11d83c0838d08679c4f10a6c86f5bdae7df96e45e2f415d12f95e77c0fc32aca989a82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635466340, "uuid": "002fa58a-59fa-4de4-9a63-4574ae4ba44f", "value": "T1AAA401FC6AB8D032D0E371304CA2CA715A29BC61E970948737B51A4E2DB1FCD49D636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635466340, "uuid": "127be001-c4a3-4992-b96b-710499487ab3", "value": "18875662b19ade4ddd6bba43f9abb4a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635466340, "uuid": "8f15cd27-5b94-4fc8-ab48-0cd19b64823e", "value": "12288:y2+RlFWTNdEdkSHWqHHKee/3/mYaQa+unnF7:IoTN6dkcHCP/mYj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635466340, "uuid": "260ba328-7d50-40ec-abfd-5c7ca519df98", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635466340, "uuid": "8f863006-185b-45da-8897-36a7300c6c88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635466340, "uuid": "01dadecf-6854-4151-b89f-6b4d084ab852", "value": "8dae44fe1bacb0601cdf02ae6898173a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f892178-3881-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635488804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488804, "uuid": "bc99fa33-173d-4ee4-8f2e-26fd1a9ba89b", "comment": "Malware payload (Mirai)", "value": "d5f7312f62ca02ad0873bdd213dd71be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488804, "uuid": "325279ff-00d4-471a-a40b-9ca28a1a958f", "comment": "Malware payload (Mirai)", "value": "752b21a8ab77df1640dade907ad8268990665e0b00a3909b1bf19a23ef8c0770", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488804, "uuid": "20b9ff5c-93fb-48ad-8ea7-05e7cc95d514", "comment": "Malware payload (Mirai)", "value": "d157216923829b73f69c4db6cf6d6bf80edd4962", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488804, "uuid": "847f2f6b-7afa-4644-9d2f-8c4d75f68662", "comment": "Malware payload (Mirai)", "value": "372dcd34d19779f965227f0e94a5f4e23b15c8dadf62daf775aa98a86c53a40a201bf32a0fb94e96735af918ea350349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488804, "uuid": "8d5d8d5c-6441-4f35-9959-2344d383125a", "value": "T1D8E23F52A0B78BE3FE1E31F0F1697B60FA6DD0A531BD9423CF6051A4B841C07B6869D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488804, "uuid": "02776f44-372d-41f0-931b-848c0955ca57", "value": "384:fXxT87+xyCCy/hGAzz9H/wm1h9+Ezq7H8OOhPWMq:/xT87+M0Xfwm0EzqD8OkOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635488804, "uuid": "c113f535-f752-429e-bb51-c6aa7ec62010", "value": 34032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635488804, "uuid": "72d709fe-2fad-46b3-8a47-7b450174c0e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488804, "uuid": "ae67127b-91d7-4265-840d-8c8e06d7ab15", "value": "d5f7312f62ca02ad0873bdd213dd71be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c491ec-387a-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635485886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485886, "uuid": "9e384a4d-9286-4862-87d7-7380f439a5d8", "comment": "Malware payload (Smoke Loader)", "value": "93ccc8fe4a66aca193fbaaf89f7f5ac0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485886, "uuid": "fdba15bb-437b-4eab-bb83-1cbbe661f722", "comment": "Malware payload (Smoke Loader)", "value": "75fac9f347e7490c982648933dcbd2ac988c8f8b551c5faa82a9c3646a747712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485886, "uuid": "eb185419-8fe6-4185-9b19-f87c99c1956f", "comment": "Malware payload (Smoke Loader)", "value": "ba91330f658816bd7bd0904149e9de4bb8d048db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485886, "uuid": "ef83b1ba-cd45-4002-ac4b-26e5ae2611dd", "comment": "Malware payload (Smoke Loader)", "value": "bc938beb8f140a8bff17bfcb9c4f2f5051a4994913dea8eecf15c4c27b510a36d5aa7dad57acbdd11fc64440456e2d71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485886, "uuid": "e2b8fbb1-66a0-4eee-8b81-2f53dc30ae2c", "value": "T198149EF032EDD071D0A33A3944258AA16E3ABC63D960954B3374239E1F76ECC99E535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485886, "uuid": "d4382a3f-064c-48fc-92ef-b833d70f8789", "value": "2b117a88efd5ad3db577a4f98b26ff8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485886, "uuid": "67de06d4-9904-408e-85aa-29bf0ca111c4", "value": "3072:W2lEcbqgFKWhO++Rj9xn4sV8oOsssPTTx6WrxpzbgqruXhspVggjcGkNIVqIS:zlogFKWhp+1Xvpx6uzbgwu6L7ITsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485886, "uuid": "5a623e37-ac33-4009-9510-27fbf53b6d04", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485886, "uuid": "e7c9e2fe-f383-4aa9-bacb-d8c84f8a6ae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485886, "uuid": "8f69f330-12f9-48a6-913a-faa9335f47c2", "value": "93ccc8fe4a66aca193fbaaf89f7f5ac0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2dbfe57-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635530363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530363, "uuid": "ad7523a7-f277-460e-b4c0-c2b8ae2ddad4", "comment": "Malware payload (Mirai)", "value": "b8a41ee39e5b697f20c347c25b86d310", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530363, "uuid": "6759bc14-6f13-4c12-8815-443001153fad", "comment": "Malware payload (Mirai)", "value": "76ecce3554afe22304c6d91c1ce827c521c74b9dd12023bf120073a146a4ee88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530363, "uuid": "0829317b-9c1a-4167-b333-7b0da570caf1", "comment": "Malware payload (Mirai)", "value": "0eb7833ab11889e72818e45f7bcd3685c0a03113", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530363, "uuid": "0d815368-3674-4d3e-b469-ef54170f284b", "comment": "Malware payload (Mirai)", "value": "e66f3bf636127f8f9daea29683cd8e5a57d7ac506f4e4bbadc24224f71a1911aba1b809c2b57549fc91d9b499c7c4216", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530363, "uuid": "d24e49df-0d63-4620-8b37-07b6cb52b4fc", "value": "T1EE736CC5E8015D7CF98BEABE84264B09ED2167005B930F2BA6ABFCD37DB31549D42D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530363, "uuid": "a9966539-cb00-4686-965f-9223c74e049c", "value": "1536:b4RcHufF8LMx8twK/P4Uo8wm1zFz9TrRGfPIWJOut8y8M8rm:bHuNMMitwKZzFS3xP8dI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530363, "uuid": "5ac2334d-60c9-4d41-8a82-00be456ccb1a", "value": 79320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530363, "uuid": "86bde939-9863-46c9-91e8-dba39dd4bef4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530363, "uuid": "72326f27-f27a-41be-b295-6f5f25469e10", "value": "b8a41ee39e5b697f20c347c25b86d310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a6be35-38bf-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635515582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635515582, "uuid": "cfd62eaf-8fd0-4ab6-ae4c-4361e8ac5604", "comment": "Malware payload (Vjw0rm)", "value": "fac61c5e8f3026c1a1b63c21423a2701", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635515582, "uuid": "5188a00e-d697-49b8-ad92-5fff55c584da", "comment": "Malware payload (Vjw0rm)", "value": "77307f92ac36d5dce119e092099842fedd2f37432b578914af22b7ad7c1ccf94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635515582, "uuid": "7501f19c-7825-4717-ba7c-3260dcda7c28", "comment": "Malware payload (Vjw0rm)", "value": "c14c72c7e99a1b8166d009a89c8f6b1111a8da2a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635515582, "uuid": "98e3e98e-f909-486f-a188-01f3c786bd74", "comment": "Malware payload (Vjw0rm)", "value": "d9325ca108948e01789c9331b5db174942fd1bc0057f03f17d89bbce01d2c59a8a4205b386506aa28943e3d8849bfca2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635515582, "uuid": "3eb814e9-c76a-4ffd-8678-77857b9bcbd2", "value": "T1A882C12B634E39F22FC3A4E59E6D5F86511329013605FAC60587A17E7DC1C3A7F6109A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635515582, "uuid": "4f92d1eb-28fe-45c6-b4b8-bb3f1e7cd054", "value": "384:bv4FxNXwil3u4W430GvACEOyMU+qxl249TmO0XNWj7WKSKmFlKl:L4F/l3Q2ZEOG+hKTmOrfWlKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635515582, "uuid": "696100df-7cd2-4dc5-a5cb-417071045675", "value": 18218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635515582, "uuid": "0df5dada-2484-4f97-8d7c-51565caea4f4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635515582, "uuid": "bbb47870-6d05-401e-9b4a-cecfcd9448d1", "value": "#CHOO1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f78e933-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1635484133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484133, "uuid": "c9f3dab6-012c-49f3-9b75-81e7a40a9717", "comment": "Malware payload (STRRAT)", "value": "42a070b16c237002f30bbfadf2b13c63", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484133, "uuid": "c15d0b2f-79b3-46c5-a65a-19a025dfa590", "comment": "Malware payload (STRRAT)", "value": "773bcb60bf648c733c1b737b38a55b2dd952f14e6099967a30306c94efba65bb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484133, "uuid": "6974ad81-47e5-4e47-b764-48b4ecaedf71", "comment": "Malware payload (STRRAT)", "value": "b95cf7fa6d96d91311f6f92489ec1f390a2b21b7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484133, "uuid": "22997158-675f-4d77-a9fc-3b471ed8211b", "comment": "Malware payload (STRRAT)", "value": "f2d8615d4119c247fa0430a9eb9a10bd7ada2cb0e5f3718bb3a571c921eb0fe3f61a48077da8fb6f4dcf38c4163613f0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484133, "uuid": "f9919a70-0269-45d6-a95a-0649f244d336", "value": "T168B3E02FBAD6D2E9D51F48331985D1B6E20E51A5E801A22F26FD1CC94CB5C190F43ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484133, "uuid": "13fb6f52-3251-4b92-a816-0eadedae6907", "value": "3072:IY1zBhZZbAZ9YUWk1Aij4EiNB/Uw4b5iTzaSMdIO:TtRAZ93qijBGJUwiqy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484133, "uuid": "b4b613cd-9e3e-4448-a476-86fb873b6c48", "value": 110033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484133, "uuid": "845ecf07-b8be-43e1-84a0-2c8a00414928", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484133, "uuid": "f8e22c18-e0fe-4009-8878-f38d3a663a53", "value": "Invoice.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7104234b-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1635485477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485477, "uuid": "a4524c71-1dab-44cd-adba-d14ef8398ba3", "comment": "Malware payload (Stop)", "value": "714f288c2228bc74eb770c7174fb15a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485477, "uuid": "35015186-8d4a-4ff1-a5b2-f468efe25eb8", "comment": "Malware payload (Stop)", "value": "77a9b2214093e9cbeae4d3b1b4ea8ab3cb3dd84453b6cddfe1089e0c4bb56251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485477, "uuid": "938745e7-25c0-465b-9519-350a1488d61b", "comment": "Malware payload (Stop)", "value": "cedd161a95f766bb77d7241cfc095bed6f2ad306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485477, "uuid": "2656a131-3237-42d8-9c35-a70fb92b87c1", "comment": "Malware payload (Stop)", "value": "0c09ab030039cb30a9fb35783df2ec36e47f97c2542d3d2967f222e725f1c83fce891f37b499851061f88107f3092de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485477, "uuid": "adb72990-d757-4084-b093-4e5b8cb92f03", "value": "T183F412F27269C631C45376729C7A8AA18A7FBD21E930964633B42E1D0934ECE51F522F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485477, "uuid": "90c695cc-5cc9-441c-9fa9-1e3961355787", "value": "18875662b19ade4ddd6bba43f9abb4a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485477, "uuid": "b140e0f3-e09a-4ff9-85a0-d5b4a05ae63b", "value": "12288:NMnNVMteGft5czplHsbpo41rujcg4+4+I1QtOMltQnysIDHYunnF7:NkMtee5cwbhkcg4+jt3tQys8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485477, "uuid": "efa7e8f8-fe70-4408-b04c-5984c0c61ef9", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485477, "uuid": "f7f5ed10-5f54-48f4-a29b-43a2fd2e47cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485477, "uuid": "003fc721-ef26-4048-a8a2-289d26e2dbe5", "value": "714f288c2228bc74eb770c7174fb15a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3d45e1-386f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635481010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481010, "uuid": "a852bf73-817c-4eb3-9893-83407845b6f4", "comment": "Malware payload (AgentTesla)", "value": "0d7e2c6558caae154b97083f7084fdd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481010, "uuid": "48175b5e-e375-4837-9799-651a85881ad9", "comment": "Malware payload (AgentTesla)", "value": "77e86bd05be86eaa0ef36995216ac74f7589e531bf99e5d2c94df9e17f360b22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481010, "uuid": "e387b3b7-c424-4d8a-bdd8-51d7ef146ac8", "comment": "Malware payload (AgentTesla)", "value": "9b9f8f5b8af8b1de218e52a1a28faf4786247936", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481010, "uuid": "e879c8b1-a0dd-4911-8680-ed8b7eb4f4ee", "comment": "Malware payload (AgentTesla)", "value": "11fd7048931324cbd02dca49ac617e860da17697924efdc278fd825175991b5e5c65c094e87b2ba8f84fb642cbeca1fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481010, "uuid": "96c2305a-b9a2-4fdb-a137-7d5575c01746", "value": "T19CB4E000B3E69A5AD37E4FB608B310400BB17967BD22D74F1DC820DA697AFC90951F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481010, "uuid": "fbc16e04-2f92-4bfb-885d-338ed76fbde0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481010, "uuid": "3aea771f-0c97-4679-8859-608230525528", "value": "12288:IxkOfsVQoNddqZ4kmUvWcKUPqLO7ZxzaNas++TdAA8:INQ21mUucKmq6ve++TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635481010, "uuid": "b9ce27e5-2c8f-426e-92ea-928580e0f930", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635481010, "uuid": "42b788be-22d9-4981-86c6-57db680d54ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481010, "uuid": "80abecee-896c-4d67-9dde-451c0413328d", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d0bd4b-3897-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635498417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498417, "uuid": "641944be-e3a7-4d18-a7c0-c5c33439d3ac", "comment": "Malware payload (RaccoonStealer)", "value": "171e41cc0f54e05af30cc933072ccd70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498417, "uuid": "b5555b64-e776-46b8-b567-9ab626d2d023", "comment": "Malware payload (RaccoonStealer)", "value": "783b8f27837c52c2a25673e9302ee716046e65dcc6f2ad3478e81e0ec745d841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498417, "uuid": "a10b7bc7-0eb6-493b-9335-ef77832934ef", "comment": "Malware payload (RaccoonStealer)", "value": "5fc29060a687b8a0c14de578ac0b2a045d95feec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498417, "uuid": "ab9c0d9d-3978-4505-b986-3f06032e10f6", "comment": "Malware payload (RaccoonStealer)", "value": "45f0db08d74bc5b6b945afa31fbc8c415a94b4ce2e9848258b4440e81befc523e22578a0b786212d2283ec212e7fb3d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498417, "uuid": "bbdaa9d4-f9ee-4dc9-be5a-ec94f1cd4f88", "value": "T12AD4D000B6B1C030F1F652F859B69269B93F3AA1677890CF52D526EE4B74AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498417, "uuid": "99cbd6e8-4e66-479f-89c2-3339db8206b8", "value": "8554f137e95e1371295faad9355adee2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498417, "uuid": "572f6d52-9357-4f00-b019-f886c273a6f1", "value": "12288:BxthCWba+ncjxCbpLlvmu8WIw4+NG7awp7nxtF92N4r5oOhG:zffbaf+vfIXawH3y4NE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635498417, "uuid": "ae5c1006-8b75-43d4-b028-e3bc14ae1c82", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635498417, "uuid": "b677b46c-c6ae-4451-9a87-7a29ae30eabb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498417, "uuid": "38bdc439-80b5-4ed8-b8bc-bf33a703940d", "value": "171e41cc0f54e05af30cc933072ccd70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af29d744-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1635526384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526384, "uuid": "b28dcbeb-64e3-4187-a814-cc8691521045", "comment": "Malware payload (Neshta)", "value": "c5b4e04376f591216414fd74ac502754", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526384, "uuid": "e2e55189-8dc9-48e3-91bd-9f5b4169700f", "comment": "Malware payload (Neshta)", "value": "78fcce5df6a344aba1293482c3db070a4f313af25b4c7cb3e9eb6eca45c9a7c3", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526384, "uuid": "c8c433a5-b2e7-4e65-9590-927c49c9dba9", "comment": "Malware payload (Neshta)", "value": "994118f839ea429d14061544e481c58354eb91ff", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526384, "uuid": "aa6e1725-e265-477f-b389-c0458d4cb2d6", "comment": "Malware payload (Neshta)", "value": "3092ce82289df1bfeee4a22065354f93087bd0a1b2a21e3be8cc6f4cf65ea431911fb8f5ec3eccaaff3253e41599980c", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526384, "uuid": "a6574e61-b189-41d1-bc52-540868a4e2d7", "value": "T14B84D0375B007DB9DB194E7522DE258DE320FD228B844110CF9A7A49AEF7998D1C983F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526384, "uuid": "04254995-a42b-4d59-aa86-af8b7098cc8e", "value": "12288:jMJs5qw0x9AozpBmEMy8hgwu3q8R4jV2S:AJsMgmL7v6gv3N4jES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526384, "uuid": "3cb88fd0-d4d8-4645-bf46-5455ceaa8f39", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526384, "uuid": "0aaa56ea-6e8d-41f2-9ba1-3f3ea1408ca8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526384, "uuid": "65271446-b2ec-48d2-8fb6-b84f78540393", "value": "new oder sheet 0015.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30993ee-3905-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635545771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635545771, "uuid": "28d733fe-02c3-4b7a-bb52-03ee7613ccb5", "comment": "Malware payload (RedLineStealer)", "value": "1edcc0192389a3bbc0a3723194cef43e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635545771, "uuid": "ebcdd56f-c084-472a-982a-9f38d4a03c67", "comment": "Malware payload (RedLineStealer)", "value": "791eaeee5c52bdb505f648794ce04d0c2cef9cd9df9bd7b661e64e12e59a3b8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635545771, "uuid": "eade828a-4848-4721-9ca6-7f971e20430e", "comment": "Malware payload (RedLineStealer)", "value": "2b10e056c16e4afb50adf633c3d80adc13fa30ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635545771, "uuid": "b974d666-c126-49cd-9ff7-57809d50d08b", "comment": "Malware payload (RedLineStealer)", "value": "7ed8cfbd1e2c6af033ff3c4cc25c8fe346090a4f4cda1d89ab897a8c0b4e9e95fd692ec3c3d336bc406d0b84f0357f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635545771, "uuid": "3ce904a1-ed46-46bf-9585-f6912c706a4d", "value": "T1E0A3295837C8DA19E3FE4F746CB0525843F0E0936912EB5F0DC554E90E67F81AA62AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635545771, "uuid": "6b0f7f36-e098-402f-a7ac-6776072d6b29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635545771, "uuid": "bd0bc97a-44bb-4eed-a2c0-8fe9e3ce2ff5", "value": "3072:tgU6sGbLjlp5q01MOqN3xgdk7OOHP1wIJvbxV:rWbLjlp5q01wgrapH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635545771, "uuid": "dd6aa0e3-afec-470f-b7db-62f3fa8a5fe9", "value": 106736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635545771, "uuid": "9c2c028a-1efe-449d-9766-e2d498a5ddd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635545771, "uuid": "0578f6fa-fdac-4238-9e23-3e9f3c361b12", "value": "1edcc0192389a3bbc0a3723194cef43e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c14e346-3881-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635488798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488798, "uuid": "08b5948c-3c4e-469a-a268-7b6ee2b24610", "comment": "Malware payload (SnakeKeylogger)", "value": "ff8d08be90a98bf46f8f359ee4cb35f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488798, "uuid": "e1bac695-9fe1-4e82-99d7-66224d3ea902", "comment": "Malware payload (SnakeKeylogger)", "value": "7935dd664fbce6faede690e777f87dd6c48076a0e29f32604ce0096e7462688e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488798, "uuid": "9a9724f9-8328-4d4a-800d-3a380b15626b", "comment": "Malware payload (SnakeKeylogger)", "value": "15f9914eef09dbdc49833ec53420059e7d017fd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488798, "uuid": "94883dee-8dca-4ce1-9565-0b64039afaa0", "comment": "Malware payload (SnakeKeylogger)", "value": "c58040b79307b2e91f1afc988571292b1c9322189994b9547450ff131c72dd7309a60ce4bc742a626b221bbaa81cacf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488798, "uuid": "2edb4462-a924-4b51-82a9-c1316178be88", "value": "T148E4C71C7B816B72EE4EC572A8050535BB230F0B2A50AAF65F9F25CA978F0771D598C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488798, "uuid": "6093b6a3-85eb-4808-9f2b-1ab11f0761e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488798, "uuid": "6b86db5a-2b8e-41bf-b6b2-0b16d76e4172", "value": "12288:9XEZct43PkSwjakKE7nRUJmczwHJeJ7zzwHJe:UCESj9qJmywpeJDwpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635488798, "uuid": "be27a302-7659-48ae-9abd-20dfb90f56e2", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635488798, "uuid": "2adf045d-1557-4714-8998-ff51181f6036", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488798, "uuid": "aceee132-52f9-4603-8e2e-afd7970f7438", "value": "ff8d08be90a98bf46f8f359ee4cb35f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d3ca65-3895-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635497562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497562, "uuid": "a65b6dc1-e651-4cb0-8c92-41a90dcb0bd9", "comment": "Malware payload (RaccoonStealer)", "value": "b142d5ad33a2a55279143631a4908e3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497562, "uuid": "e7d4a379-78a7-4159-b633-79ee55044ce3", "comment": "Malware payload (RaccoonStealer)", "value": "7936aa81c06e22acc6373e2ad3bef1b05ad7dab3f9f371248f2a368f26166708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497562, "uuid": "f8c70d99-00e2-4c6f-bdbf-91f6cb055c57", "comment": "Malware payload (RaccoonStealer)", "value": "4a5d999c5b005cc998d03a2681fe0c9a101f54fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635497562, "uuid": "dfce53d1-6dd6-4942-abe0-64cc30294b86", "comment": "Malware payload (RaccoonStealer)", "value": "37d10162a79653b8154efc99c6a7f97f1bf727009bf591941725aea8f6a775eb73d3ab58dc7409f31694a763ef352387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497562, "uuid": "316b043f-76e5-4c0f-b9e5-caeeee185c17", "value": "T1A1C4E000A7F0C035F5B727F54AB99368A93E7AA16B3894CF53D516EA86346E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497562, "uuid": "c8a8a675-74aa-4bc5-8f53-161e667b15e5", "value": "225e0ad40cbe89f68a30c3a6a7705729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497562, "uuid": "7a3d801f-1b7d-419a-8c41-47fdfb92bc6b", "value": "12288:qqpNhD5ulkBEqavVwvhp+IIIUkng7PI4OGFF77kc5zO/wobrN:qqpNR5ThaNmhp+I75nkRVTUQKoyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635497562, "uuid": "e84fc3f0-c2b7-4879-a5c1-be4cffffe20e", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635497562, "uuid": "200d0807-948e-4a21-af52-6828666413c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635497562, "uuid": "34da44f5-5146-4d75-ba89-7b8114d36f29", "value": "b142d5ad33a2a55279143631a4908e3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564aaa5f-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635530100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530100, "uuid": "42d85a52-06ec-46b9-97cb-4a286f2d758e", "comment": "Malware payload (Vjw0rm)", "value": "920fb56899441bbd9c7c10e9ebe9858b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530100, "uuid": "95887049-fd08-4f1b-b214-237731de91a5", "comment": "Malware payload (Vjw0rm)", "value": "79c98bb639315beb968a2c78a7f33eb329bf211a44d0ac9573888bdc78423504", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530100, "uuid": "f4806828-7a52-4f8b-a427-23bbcc5272bb", "comment": "Malware payload (Vjw0rm)", "value": "b717433df29525b9ed9e27d2ea02cc01fa7a592f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530100, "uuid": "6fc4169b-ba13-4e59-b946-11b86d4d4f77", "comment": "Malware payload (Vjw0rm)", "value": "b2f49db1b406053d147929770a1796924f61c5c65c9f9ec133571650f8cec7e7d078e0dbea276cb6f362cbb2548c528c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530100, "uuid": "001384d9-64ae-415b-9c12-f71ce6315f42", "value": "T1D8838F019E431CC6F5B5D6A2209800E4DE17A6F4CF6AE4DADE4249CE0EEF24767C7E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530100, "uuid": "d77ab496-8e41-41df-a7ab-a7a92cb9a308", "value": "384:APnPI1gYzbBg55m/TguL67X/g/W/W/w//a/t3J/QSqm6wUgn:vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530100, "uuid": "f36d8c75-869f-4cb0-a7a9-6ab590b775f2", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530100, "uuid": "c3fbc3ea-e059-452f-82c2-c8d6a6c725e5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530100, "uuid": "5b588aba-506b-4e95-8dbf-0a0f6c5905d4", "value": "Crisanto_Payment_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b86019-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635485423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485423, "uuid": "905ecd23-8260-48bb-8d74-871dfa5ce40d", "comment": "Malware payload (Dridex)", "value": "a109721c417e6463613b5d1e565159ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485423, "uuid": "7ea94378-e01f-4b1e-ab72-0e10c9c8323c", "comment": "Malware payload (Dridex)", "value": "7aa632dde06561365561744d403cf27d24a18b3fab6624d86ba795cc486b8e9d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485423, "uuid": "7f2f920b-2d28-4b70-9d12-c9bf294d3ffa", "comment": "Malware payload (Dridex)", "value": "7e0c35d1ac1d59cef2cb912b5376719f6e811368", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485423, "uuid": "dfec6957-ec28-485d-b4d3-ca10c4fe9bf2", "comment": "Malware payload (Dridex)", "value": "3b7be746e0a87e055f4b13251b756f857780f335659ead2d06a147fd63dc5de0e3d4a5798e981e3ec9eab5f2de943e82", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485423, "uuid": "cf56cea0-a76f-49fc-9072-729782e82744", "value": "T1D1356C0237B24038F5B306F955FE61E45D7DBAE1672984C7A2C036ED452AEE1AC34B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485423, "uuid": "cb0da1f1-9c4a-467a-ac51-29a979a0e76a", "value": "da6b61b1044c1468d1deb0c4944ee99d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485423, "uuid": "a416b71e-db01-474d-ae9c-df146b6bd51a", "value": "24576:s2c6WRTUUt+HxHGRivPX04OhWqVD6wKhGm31m:pW5tQHlvv0f5B6Vhv31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485423, "uuid": "59cb22bf-fdba-4eb4-9dad-665cd0bcb38d", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485423, "uuid": "17cc3d24-5448-465d-a372-d210f5e5d8e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485423, "uuid": "cd3b55e1-4b5a-4a15-8634-37d81b240cad", "value": "a109721c417e6463613b5d1e565159ec.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56be569-3875-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635483874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483874, "uuid": "09467fa3-89e5-459c-868f-b2bd1f8f54ad", "comment": "Malware payload (AsyncRAT)", "value": "2bed843afe618ae0ed98fa560175b530", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483874, "uuid": "ae6f6faf-df4c-43ae-9781-c1727153f0ec", "comment": "Malware payload (AsyncRAT)", "value": "7acec77c9aa3755b37646405e79e8bbba83b8338822b3412c461bc4ff2b7ddb0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483874, "uuid": "a65fde5b-c1a8-46be-b583-179e0966de23", "comment": "Malware payload (AsyncRAT)", "value": "e3aeb9ba9e5ebf7319cbdb9ede0c8397ea8f6e40", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483874, "uuid": "1f2808ed-3df7-4f20-a1be-20c8eab7f558", "comment": "Malware payload (AsyncRAT)", "value": "c0c7efeb7844457a611f4605a16c002e647cd1aa66f77ea5f9b78af3f8fa55f7e080e4a560310d0d1f288ebab4cc55e6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483874, "uuid": "5f6134f4-7836-4c84-bbb3-6151fa8f5af0", "value": "T1D774D0EF26D486A3E1EB20B22B55F8F694515C115207BB6E36333C8E35781E6DF90E21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483874, "uuid": "b9772a1a-eb74-431e-b445-17c671091ec1", "value": "6144:AXV38KpbNdzLLIvGcrFi1gr6opjccnOFPgzv9sS0Jg4EIdsJBXU+2wHsRjr4eo:6V3LTLIrrMA6opYc8PgzviS5MOBk1Nr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483874, "uuid": "ae3a3f3d-7cc1-4d6b-b5e7-1474f3d55b6c", "value": 366104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483874, "uuid": "15c80db9-5eb7-4ecf-b3ab-43dbbe4a0ff6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483874, "uuid": "6cb4df34-2a05-4af8-854f-6299c00dff1d", "value": "Annonce.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0677b9c2-38ae-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635508062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508062, "uuid": "b05bafea-0150-45bf-878a-5c75e5955f07", "comment": "Malware payload (RaccoonStealer)", "value": "2702a6dea2b3bd34f9143c49c00f0971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508062, "uuid": "e6a5d124-03fd-45d2-bac5-a25ab09f0153", "comment": "Malware payload (RaccoonStealer)", "value": "7aeb5171e90e813e9f494faf648e9f971fded6700d435972a43389b3ba701d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508062, "uuid": "ebf84335-289a-4a48-8df4-5ede7f5e4f3c", "comment": "Malware payload (RaccoonStealer)", "value": "564bccd804f1149a8ed18b62a016f223f7bc376e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508062, "uuid": "2190ac69-c9b5-498f-b389-f7753ad6ea31", "comment": "Malware payload (RaccoonStealer)", "value": "792579b73e604afead2b68864debc386ae6f709df9e4ac507feccb4a0cb30dafb99b0b6bbbe2a6de7ff7a72a6ca68a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508062, "uuid": "1782ac60-fe84-443e-ba51-8d8a47ca3352", "value": "T1B4D4E110A6A1C030F5F652F849BAA269B53F3EA1577494CF23D827EA4774AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508062, "uuid": "3f9dce71-a159-4286-a849-0a320571af7c", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508062, "uuid": "99d13a73-5d00-4877-b9a5-323d4bc6ef71", "value": "12288:Qa3cPWCDJMMAO3H9fLrWvIXmfgJKrbWgwU0JyF1:H3cPW6KSVWvIXm4wfoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635508062, "uuid": "a59448c7-28b2-4dac-9925-3755cf8c2302", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635508062, "uuid": "6f77d108-aa07-4fad-ba39-a252e5006ffe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508062, "uuid": "c8fe22fd-dabe-4b5d-8923-797347fcd399", "value": "2702a6dea2b3bd34f9143c49c00f0971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c23f92-38b8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635512653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512653, "uuid": "8558a5b4-e861-46fa-bdf5-faff41b4fa8e", "comment": "Malware payload (Formbook)", "value": "209022637f55d36fa877e8c4931d2f03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512653, "uuid": "2a566082-400b-411b-bfe1-53fd80c15502", "comment": "Malware payload (Formbook)", "value": "7ba579db4b2485e75dbeff653199f592e4067706225975038ad011b73562c3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512653, "uuid": "036342f4-c74e-4281-92c9-db10e0464752", "comment": "Malware payload (Formbook)", "value": "b77ae6847ac5c4ca53af477f321183c36675543c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512653, "uuid": "5e290838-e58a-418e-b795-ad6b54d6ebdb", "comment": "Malware payload (Formbook)", "value": "f55ba038fa0067e540a6d061ef9c4f93659be128f6441dedf7a54b53d3de52b61540dfddf429e42c181254dd671add46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512653, "uuid": "fcf7610f-acb0-4495-96a9-c66a15b67997", "value": "T1FAB4E00077F56A27C77A4F7A087310201BB1B867BE61E30B1E8520DE1ABEB951A50F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512653, "uuid": "a064d5fa-28fa-4384-b823-58b4ea8edc6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512653, "uuid": "e896618e-2bfe-4aca-8394-ebbc0f764d11", "value": "12288:eP05uHdK9lMQ3BIwhe99IsG3/gqfbXhQUzFX:ec5uGXh2usK9bRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635512653, "uuid": "9598351c-fe4e-479b-bfbe-99ac88579133", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635512653, "uuid": "582922d9-b2d2-44b9-9f93-48656323f19b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512653, "uuid": "9ac0eee6-e183-4a47-bc8b-1a102a78a6b7", "value": "Payment TT S lip no 8393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43514ac-38f7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635539707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539707, "uuid": "377a7044-d6d6-4800-8c7c-0f3defc4e00c", "comment": "Malware payload", "value": "a70399b6351b0d64c8290232f5ddeda7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539707, "uuid": "4db86635-b44e-4ffc-afc0-4e3726c8008e", "comment": "Malware payload", "value": "7c4f346c68ca7768f9b0254ffd92141bb67090aa8acbefe171825c5407ac0129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539707, "uuid": "bf82318b-43e4-4820-a256-85068a33dfa5", "comment": "Malware payload", "value": "19a9663800ae6a0e51c311af382219df7fb59310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539707, "uuid": "8ce8187c-0ec7-4578-a37b-5b17cbe81def", "comment": "Malware payload", "value": "29d72959ed11a134150762851f4a323254ff6bcb0346ce2a50d7c7812d5afb05faf05883548f3ac5193ded4872b8078e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539707, "uuid": "221b5ca5-38f3-4796-88dd-6b3b5332122a", "value": "T1EC91C32167E84336E5B34BB9ACB393015278FB119D52530D24E4A31BAD1B7119E23B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539707, "uuid": "9d74c9be-640b-4dc7-b63d-a30bd775d51f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539707, "uuid": "0190e333-a9a6-46cc-b2c3-0bdfcf1cf7b4", "value": "48:6C7UiBuzrVyJkLBJ0btH/hRHex+VmPZ9pbFmWOQlPU6FWSfbNtm:tuzrAKMb+imrphm6dUCzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635539707, "uuid": "e3dd4025-a5ad-4b93-a72f-e2a9b428f14d", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635539707, "uuid": "7b1de4c9-141b-4c43-97a0-606dfb3efc35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539707, "uuid": "b151fcaf-7903-4557-ab6a-7acb634758fc", "value": "7c4f346c68ca7768f9b0254ffd92141bb67090aa8acbefe171825c5407ac0129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c75a295-3853-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635469042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469042, "uuid": "4828cbcd-0680-4509-829c-2435ad5d7fba", "comment": "Malware payload (RaccoonStealer)", "value": "b2b135f238e2b3f684a2e79bbfe22235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469042, "uuid": "c7d6347c-2f37-4eb9-b433-0bf86e8b5e98", "comment": "Malware payload (RaccoonStealer)", "value": "7ccbf3b294594e8217e4ca62fae730624db9a300e388f3215570154cd00617dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469042, "uuid": "76f5b717-1105-4a8c-9b7d-a33203546659", "comment": "Malware payload (RaccoonStealer)", "value": "5f359e1d64d46220759a2c1a9056b8ed2f0ce239", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469042, "uuid": "951ad31d-c929-42d3-b358-42bbaa5a4667", "comment": "Malware payload (RaccoonStealer)", "value": "a5f5784294254bb38cf2219ef8d06b3466891e864aaebcb945a0a4d7d277c5e015d48455ba2cd14b166fe3bb875d547d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469042, "uuid": "dddfb5e2-8363-468d-97a3-9f8cf7e441e3", "value": "T1C5749C10A7A1C035F5F212F849B69269B93F7AB26B7490CF12D526EE47786E0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469042, "uuid": "0930ba89-724a-4373-b22f-afcb7fa29fbc", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469042, "uuid": "a1dce0a0-848a-4275-bc7d-64571750458b", "value": "6144:YNUG9z1am27jmg4BKWv7pUgblzH8iKUoSi:YiGt1D2/mNBKWv7egb+ili", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635469042, "uuid": "b3cf07e1-b8d7-4a92-b1d6-a1479942e522", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635469042, "uuid": "15d321f0-f72b-451c-8320-5d0264d3fa3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469042, "uuid": "b57157da-bbed-4d57-86cb-002c9e7be658", "value": "b2b135f238e2b3f684a2e79bbfe22235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c80161-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635485588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485588, "uuid": "77a3846d-5dbc-4763-949e-7088240983e2", "comment": "Malware payload (AveMariaRAT)", "value": "1e6ff720b6b67584dfc3202721deea4f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485588, "uuid": "644b098a-e6d0-40be-8d61-1d3c2b35fd62", "comment": "Malware payload (AveMariaRAT)", "value": "7cfc8c8da463280efb072111a2070ccc1753d807a835513743307eb6426d6cc6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485588, "uuid": "5d02f8e2-14f6-455c-a0a5-509d7242317a", "comment": "Malware payload (AveMariaRAT)", "value": "d59fa697d9bfb713303f9c13bcbd434b0a500041", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485588, "uuid": "c681f26e-7647-4cb5-a303-7118829ea46b", "comment": "Malware payload (AveMariaRAT)", "value": "9580df289e11a15de846fbed2d924e08196c27fea9cb74e7f244683b62d66c12353d9bb92b232b91ebad4ab9ff97a1c7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485588, "uuid": "b1ba0f2b-c0da-4a91-ba6b-e97c3b0e23ed", "value": "T1E824AEF122A9C472D5633A304C698EE15E3F7C22DA60518732746B9E1F72ECC96E931D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485588, "uuid": "36b43bf7-32f5-4be1-aebc-0a33e56a0cf7", "value": "0907a935ef90d39af9a616560320cd24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485588, "uuid": "b3ce70d4-cd15-4d7c-83cc-edbe761a14eb", "value": "6144:fska3UdXX5C8OU+KZGBuzbgwu6L7ITsq:kFUdXX5/ONPBunnn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485588, "uuid": "663dc36d-35fd-4ead-84e8-428d4c35e983", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485588, "uuid": "37d0dd4f-0081-40db-a55f-8d3ff6f1a880", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485588, "uuid": "86112813-2afc-4ccb-82ba-44eb936651cc", "value": "1e6ff720b6b67584dfc3202721deea4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b7ee07-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635494775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494775, "uuid": "723b082d-6d03-49d2-8150-6e43d32dc71b", "comment": "Malware payload (RemcosRAT)", "value": "780b597d2b6ed10ddf06560239777a8f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494775, "uuid": "3b04e462-8cfb-4729-ab3d-d722dea76649", "comment": "Malware payload (RemcosRAT)", "value": "7dba35b377cad91017112d639eb803269ee4b56dec7d0bfbfdab908ff711ff9b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494775, "uuid": "67c56e28-cbce-4ed4-92c8-34c3234f7ca6", "comment": "Malware payload (RemcosRAT)", "value": "715b65cf9acae13fa3d03ab67ee7e8b41b4ef3cc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494775, "uuid": "626926f1-0428-492e-88c7-14458cbd271c", "comment": "Malware payload (RemcosRAT)", "value": "0ef85f4ad17301ffaf84f272a59ef8746d3b4d30f927cc067841cca73265fe5b720b5396e0a1519c1606a5395fa6fb52", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494775, "uuid": "b59111b0-8c51-47b7-8049-120a6c91fbe8", "value": "T14625CF1373B05A37C433AE7C4EA796C86411ABB52905EC8A3AF92D8C6DB45403C79BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494775, "uuid": "27547fb4-2670-4e17-8bc1-b5426a2bac06", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494775, "uuid": "553d921a-276b-49c5-b46b-21ca3d784d99", "value": "12288:qXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4J66NuLpjqayC94M0LdEegD:q4uBfTG2pM9o6NN+swhY4dMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494775, "uuid": "5a0d92cd-a49f-4edf-b3be-a22a2deb9a49", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494775, "uuid": "b09d40a5-002f-4987-9ff3-2e672fe642a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494775, "uuid": "c35de5cb-4c73-4fe5-84c9-73ad7df46726", "value": "Dhl waybill Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d09dde6-38e2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635530514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530514, "uuid": "ba795755-7e3d-4d19-a1f7-70d051ea76fa", "comment": "Malware payload (RaccoonStealer)", "value": "0efd1c9d005446aef5fee4eb512f5887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530514, "uuid": "b8fdcca3-8f63-428e-985d-2006e4343b99", "comment": "Malware payload (RaccoonStealer)", "value": "7eb03078f08f097b0eebc611ac1b3f6f443fac5abdfb8879175193aedf24d37b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530514, "uuid": "efe101f8-d97b-4d21-a3c0-384d729193e1", "comment": "Malware payload (RaccoonStealer)", "value": "4c816aabaf80d2abb5cf3587f1c8ed77ad008569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530514, "uuid": "b7748a87-d53a-469f-98d9-3cbc8120b5bf", "comment": "Malware payload (RaccoonStealer)", "value": "cbe51da1e8478b8bf290d6d92276f83ee7cf1487f0a48b6136473ad673da9e440087d2d4219a50369cd28e1c873a98de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530514, "uuid": "8f1ed316-bd83-4463-b899-993030b4f3bb", "value": "T1C6D4D000A6A1C035F4B712F8497A9368BA3F7EB1673894CF12D51AEA4674AE0FD31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530514, "uuid": "4ecd7ca8-6815-4dd0-8b79-3540be61a49f", "value": "5243e0b7a8cb0f582099146f832c26e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530514, "uuid": "021eab6e-a143-4db8-9c03-eaf658bb6360", "value": "12288:d4iSiev79SzT1pDrtSmIuz0ct8XZH3h5VZZJD0OSWDkYW8:iD9SzT1pMmF9tKlhh/JD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530514, "uuid": "66a97509-d663-4fc8-8d8a-9790cf05eaed", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530514, "uuid": "815f31c6-b45f-4ce9-a7e0-03b1a8b54610", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530514, "uuid": "3fa292ee-addc-4f4a-9182-07d1ea05f1e1", "value": "0efd1c9d005446aef5fee4eb512f5887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f69fd5-38f9-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635540669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540669, "uuid": "1ae281f7-1be1-4f9b-af69-b42d7311f5a1", "comment": "Malware payload (NanoCore)", "value": "4fec50eeda315ce5b64bdb43074e19b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540669, "uuid": "65198a38-0a69-4864-8be6-6ad39ad4ce19", "comment": "Malware payload (NanoCore)", "value": "7f71a764ef838bdb62ecc2a708d5a69ba363fa318220872c5a423bf347134d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540669, "uuid": "a58f4bae-a66d-46db-8f1d-2839c44de5ca", "comment": "Malware payload (NanoCore)", "value": "379f8ffd436e7ef218f6d708513c5b081f620fc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540669, "uuid": "2ac61299-6ad8-4aa2-8933-1f190aa0cf9b", "comment": "Malware payload (NanoCore)", "value": "d5fa8367a12d98b59884ef009ca37e6a7cd6268a4f9f36614295458850a80a35774ad4172860c4b465fd09d210fe54ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540669, "uuid": "93a10e1b-4688-4d13-aed0-7748bccf45b2", "value": "T1D1941226A65FA741F4E46E365FF7AA28CCF1B01DB1862A06B043375E4F6B17061F3258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540669, "uuid": "68de32b9-1bc3-4377-b9f4-5f0a61a8ba47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540669, "uuid": "642a148f-9d0c-4b1f-abd9-60e2ef48c85f", "value": "12288:gJpA9OTbPvGiE3SNnOmvgDKsj4pOqIsOeu3CBH+:kpBHHGiEgOLDKLp0teu3CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635540669, "uuid": "bc1a8f52-77f1-40fc-bdf5-a7acd95d7e4c", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635540669, "uuid": "e9dd7164-a34d-49fb-a5d5-a5338087596d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540669, "uuid": "8bdba157-7da8-421d-8f6a-53fcc54eaf67", "value": "obi nanu crypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae87a888-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635526812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526812, "uuid": "f9ff77ce-a2aa-4cda-a47d-8c2d5c57c033", "comment": "Malware payload (Mirai)", "value": "c875ae5c58ce85ca46f611cc4fed0989", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526812, "uuid": "2024aa10-8cde-4054-a47e-d7f8ec123ff3", "comment": "Malware payload (Mirai)", "value": "7fbb7d80a6482e2547521de998cb255fc5b74dfb2d3ef81c6b72eef84808b7a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526812, "uuid": "d12e8f55-7563-4a0f-a413-24e2aad83cb9", "comment": "Malware payload (Mirai)", "value": "1ddd3c878ce4f81063a081e2141cc3aec17ed1b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526812, "uuid": "05864eda-1411-4f31-a4b5-2176cb26977c", "comment": "Malware payload (Mirai)", "value": "4c2a7cbc0ba2727e2582adceda07e2646aee1a25722a12083b554169fc3d5ae33c17b381443f8be787adf1b2a668de77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526812, "uuid": "b166a0ea-8267-45c3-be8c-926c1f652651", "value": "T10543D695B883892AC5D813BBBA6E11CD332477E9E1CF7223D8105B647BCA51F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526812, "uuid": "dedd9850-3614-4131-9911-69f28b7ada4a", "value": "1536:hTLsjbi29a1OAY6art5Zn1+rAx1j87g7CIyi1tr2vvnn:tybi296Op6251aADI7gWfijr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526812, "uuid": "cac79db2-8243-4516-8fb0-a6255b92d194", "value": 55312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526812, "uuid": "71fbc62d-35f3-4906-984d-a03a916671fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526812, "uuid": "dbfbf97b-7a08-43fb-b79b-79b246a87432", "value": "c875ae5c58ce85ca46f611cc4fed0989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145995d8-38b9-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635512810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512810, "uuid": "4a1c0443-6562-4743-ab21-1d4f2b343629", "comment": "Malware payload (RaccoonStealer)", "value": "c7a83bf691e40b1fc2917c59e1835ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512810, "uuid": "298f4111-e6ef-4308-8ab9-555131da38e8", "comment": "Malware payload (RaccoonStealer)", "value": "80f84b8875a68aa2b9ba982f4cd898881021be7e9a1b8df76cd8ccb46af98357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512810, "uuid": "918832d2-e575-4a84-9044-ac6bc8ba7792", "comment": "Malware payload (RaccoonStealer)", "value": "54936d18c6eb2b4f4208bb9dc92e201837e9f467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512810, "uuid": "9394d597-d011-4e77-924e-f2c0a55446ee", "comment": "Malware payload (RaccoonStealer)", "value": "f1ef63c1a63388de2228f5b0a40393d007cb1b540ffaacf7867f67bc02e3cca5e231078a167fc30022c0e0f26b694450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512810, "uuid": "7c4f1925-5b4e-4c6f-8fc8-6c7bf0ee04b4", "value": "T177D4E000B6A1C034F0F212F859769668B93E7AB1677494CF62D91AEE47B4AE0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512810, "uuid": "280f6747-7d49-40ef-a59b-f82b2385796e", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512810, "uuid": "96774caa-40c5-4044-8e5d-2cd3bf61fc3d", "value": "12288:mMoexmCgzyea8nrfYNp86ET1XvqgN/ITmJe:PoCmtL3P6ERfoT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635512810, "uuid": "4eec163c-d96a-4c1b-acf0-70d7c4569ec7", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635512810, "uuid": "6b0dc29e-93df-47ea-8bdd-d40a94cd3ae6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512810, "uuid": "3a9c0cd2-5205-4031-9e25-926c6ffc8897", "value": "c7a83bf691e40b1fc2917c59e1835ccd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfea93b7-38f0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635536720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536720, "uuid": "dbacc7cb-999c-4287-afbf-670178030922", "comment": "Malware payload", "value": "a6da5876227222d11ce25ae3b0266fb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536720, "uuid": "5442c142-b5dc-41a4-936e-7ef22b4ccb10", "comment": "Malware payload", "value": "8208898cce55f4072e8455754190b1ffbec5a8bce300b8060a7ffbc8b12d8f7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536720, "uuid": "92f26290-5f05-4984-ab9c-69cd089054c5", "comment": "Malware payload", "value": "6ef8c4eca5d82eda2c5923967ff4b72736a6b495", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536720, "uuid": "1e953d46-7d55-4a60-aab9-8556dd07ad82", "comment": "Malware payload", "value": "75a231ae88c07091ad4457927d8d9ca510950f21a3f19dfa000741a3f2c45b80ee172c945277e75328c739e106b73b05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536720, "uuid": "4d9a22b0-9d70-4151-b5bd-f90a48f465eb", "value": "T17663A477416154B6C5891331F4B50F0B36B8D6381A80B698F04FA2EEEC1D69E9EF83B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536720, "uuid": "3868348d-5dcc-4a8f-b56e-0c848ca35d94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536720, "uuid": "e1dccac3-cfdf-481d-8b5c-ebd73bc29ea5", "value": "768:jFbG6d30VtFwmLTXxz+Yb1k42vWwT4/c5XkW2f+M4zelwdwYa+VxxgDVTdWEySBg:jFb3eDXFk4O8/l4ewdC+v8yQeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635536720, "uuid": "e4f49ff8-4ce4-46c9-af5c-c17cc7600e79", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635536720, "uuid": "59a820bd-98a3-4cfe-85dd-cba946e5fa9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536720, "uuid": "b619bac2-97df-4539-bbcc-ad16e25438a3", "value": "a6da5876227222d11ce25ae3b0266fb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353cfca4-38e5-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635531763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531763, "uuid": "5f3793a9-585c-449f-bd83-cab576e2bfdc", "comment": "Malware payload (RedLineStealer)", "value": "3b947ed5aabdd775b1afc31a5c4d39a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531763, "uuid": "f4128938-08ef-45f1-9d0d-6855463db74b", "comment": "Malware payload (RedLineStealer)", "value": "8245ad87eea6a1f19f658adef8a30b9a512760d866b7075bbf205d7a54296234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531763, "uuid": "84db0680-cf85-4438-8409-c63f60e253e0", "comment": "Malware payload (RedLineStealer)", "value": "552aa072522f22a003cadd3bcad5e4eb981a5cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531763, "uuid": "439bff6b-d0ac-4957-ab50-8853cbaa8cdb", "comment": "Malware payload (RedLineStealer)", "value": "42320f98074ccbbeca190085f0188c6229cf602d53a43b0e5768f16fbda59cf2c15ecc5e213d3ee599b1f0c20b6fe8d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531763, "uuid": "b7e712c5-2100-49b9-a4ed-b32386d546f3", "value": "T144748D10A7A1C035F4B212F889BA9369B53F7EA1AB3490CF13D516EA4774AE1EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531763, "uuid": "1d713fc0-6986-45f3-bcca-29217162d105", "value": "5243e0b7a8cb0f582099146f832c26e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531763, "uuid": "b39b2060-b674-4b96-afdb-2ac381a90a27", "value": "6144:O0kWD+3Pz81AwPC4BVZ2LGuSoGZkk4mAzaV/:JZD+/CO4ULGuShkk4m1V/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635531763, "uuid": "b5157506-37f3-40c2-9118-eac86f97b851", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635531763, "uuid": "b75defeb-d8e6-4721-aa47-e6388e28de62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531763, "uuid": "f60a5800-06c7-4a26-a15e-78b83f150fbc", "value": "3b947ed5aabdd775b1afc31a5c4d39a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc96f42-38e0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635529680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529680, "uuid": "3ac751fb-b231-4cf9-86e3-c309a1a69021", "comment": "Malware payload (Mirai)", "value": "7cced08b50b54e753aefeaaf0b5880eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529680, "uuid": "a47ac7de-3986-4441-9bba-2fab26fc861e", "comment": "Malware payload (Mirai)", "value": "825b8c5c59a6ccc0ef581d03720d2ba10a55d93aed72be84bb9d3d45056c31c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529680, "uuid": "cc20b1cc-e578-49ac-bbbc-0e95f5ff22b6", "comment": "Malware payload (Mirai)", "value": "b4368e6ff48a18b2e1ded39616bff40f04fd959b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529680, "uuid": "829077f4-ffb8-47a5-8b1e-7e3c86580a20", "comment": "Malware payload (Mirai)", "value": "cd93b3dda437ee641ecdeae75a2dc822a40dbc36279d17ca8f342118e0314a13b36c400c7610806b070c2dbd68dce242", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529680, "uuid": "f34e8bae-c698-4034-a1c7-c5011c1291a5", "value": "T13EC34C46EB408A03C4D51775BADF424A3323E755E3DB33069918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529680, "uuid": "ad052bad-6870-4cbd-a5da-65c40fd39f38", "value": "3072:7Pe4R72PFYKav6ucJAs1R1OD+0+BM/9bJz:7P/72PFYzv6ucJA0R6+0sM/9Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635529680, "uuid": "06360f8f-d7a0-4153-9056-a7e8020ad81e", "value": 125778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635529680, "uuid": "d7de19cb-cbfb-49af-be59-15cbe8b52bb8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529680, "uuid": "4e605e87-44de-475c-a138-a97a6555ab05", "value": "7cced08b50b54e753aefeaaf0b5880eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c62a11-38f9-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635540352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540352, "uuid": "c74387c5-52c1-47c1-9850-6e5820e4a645", "comment": "Malware payload (NanoCore)", "value": "7c013d9f8c3a9daea7663621e6a84204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540352, "uuid": "525aa006-13dd-493c-b41e-91799d1ff5a5", "comment": "Malware payload (NanoCore)", "value": "830db64baae973c5adcb128a82233050d34d4d4d5c1d37dcec698e2e5eb73359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540352, "uuid": "6019ed47-a1b6-4c06-b963-afd580a63ac0", "comment": "Malware payload (NanoCore)", "value": "71263e931cf423d975da144993e1eed3af5b709b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540352, "uuid": "f807d35b-d296-42e5-916a-72034c62948f", "comment": "Malware payload (NanoCore)", "value": "c136919006e5ef7f419eab43c91469acfc1ff7c86fbb13aaa1382293219507991c62c30f8606d35eca1764f5e07bfcd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540352, "uuid": "ed24aabb-6f01-4254-86a7-0edddf07752b", "value": "T13794122B4B46508EDB8CA2F9DEA38DAC8771BC7D581C755A81CCFA1ACEF5780C187542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540352, "uuid": "d46a4db8-b014-40d5-9ff8-fb6252066e3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540352, "uuid": "21c4e17f-8ef7-4ef5-8d49-a76f9f8fff34", "value": "12288:Lh7cq2jgxGspx8aY3wIFnTsIskS1+pSaI5sCLgKE+:LhZ2QmAI5T1skSUvugKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635540352, "uuid": "1e48a92d-24ef-487f-9145-174b47dac5ee", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635540352, "uuid": "6d65effd-f6b1-4eda-ba9f-e4c40330f7dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540352, "uuid": "77bfca3f-1fb9-476f-ac23-ef690593c582", "value": "KATnano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a4c66b-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635494800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494800, "uuid": "86182c52-6a0c-46a9-a0cc-82e564be780d", "comment": "Malware payload (AgentTesla)", "value": "227cd681c32b33fcffaa848a6c8ded1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494800, "uuid": "85c63baf-2987-4465-bf7a-b91e2b9f9dfc", "comment": "Malware payload (AgentTesla)", "value": "83349469149f13b2d777f92f2bf3205d506331d6c743aecfcd62d497e5efe902", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494800, "uuid": "bc78eb68-734a-4678-8899-aebcaf60fa5f", "comment": "Malware payload (AgentTesla)", "value": "5405d46e7aa4244f4ae73d4852ac8b0f58df643f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494800, "uuid": "5d7d2a39-4a01-450b-99f8-5bd5765bdfc0", "comment": "Malware payload (AgentTesla)", "value": "c7e02d5d27965f60edfbb090c5d8e43adfaee3862d1188c8331d8b2069e63db1bd8eb04ba61aa8edc3f704bc298ad943", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494800, "uuid": "0e4eaa7b-da49-41bf-be3b-c80f8ff332e1", "value": "T139A4F1896379CBABE5BC47B844A3062413F6BC627261F7958ED234DB1D13BC14E01E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494800, "uuid": "b5fcb510-b705-4f21-8686-68dd5e1c032b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494800, "uuid": "11113b3b-ccce-439e-853f-bc735e73b274", "value": "12288:ylfZxTuBKXiiBFQVpiaU3RGFfY0Idg40j/RuhzdBbSG1:ylfZxTelmRGFfY04SJQdxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494800, "uuid": "34c19537-0420-4aa7-8a89-d2348bd2b78f", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494800, "uuid": "3f9b257d-0359-4ad4-874f-7ce73cd087a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494800, "uuid": "7652b226-ccda-4586-b231-7361f6098b8d", "value": "DHL-INV&AWB_SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ede362d-38e0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635529685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529685, "uuid": "32874344-84e0-4874-8519-641f86e363e9", "comment": "Malware payload (Mirai)", "value": "215108f002509be1a5368acff73c4d7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529685, "uuid": "a8d9299f-0974-46b6-8d5a-76adbd96de7a", "comment": "Malware payload (Mirai)", "value": "836051645a409b0fa6863404a4f474647d80c772b39094c9c3a01882056c22c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529685, "uuid": "dec5f123-b842-40a4-9749-ff91719cd66a", "comment": "Malware payload (Mirai)", "value": "b48156d5d8b1acded263af9abea114078e5f1a62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529685, "uuid": "e6acf1e2-9671-408d-82ce-53fde46bd213", "comment": "Malware payload (Mirai)", "value": "9d001c4ab94ecc9faca3eb1adbecde733d65dae94a10ecacf0f5c61498929c7c209a0c033caefe2edc85716042b4d173", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529685, "uuid": "8e0e304f-75ef-4cc7-acc1-7979d82d1875", "value": "T11C63975D2E219FACFFA8863447B35E20924C33E626E1C945E15DEA011EB034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529685, "uuid": "331d15b9-faed-4915-bf90-6aefb9e4618d", "value": "1536:p8Rs3DOpSxUzpP+vntvnCEvnNo8gINMHLaaFIxIvVhcMWo:aK3DUSqZ8caaFIxWVhcpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635529685, "uuid": "d0c309de-bb22-4c12-852e-dc9d0f9deff8", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635529685, "uuid": "838f6813-67fb-47e9-9578-f9abd63b21e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529685, "uuid": "083b49d7-36e2-4fa8-8564-3b876c572218", "value": "215108f002509be1a5368acff73c4d7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c86ac0-3871-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1635481971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481971, "uuid": "5e07ce16-dac5-45f7-81e2-0ea5611bf16a", "comment": "Malware payload (CobaltStrike)", "value": "5dfe5aee3f22321fe7efbb310a79a235", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481971, "uuid": "1acc2ca1-e214-44cc-bf5c-af27c688c10b", "comment": "Malware payload (CobaltStrike)", "value": "83653a93fc7d8cba1b6d9bcc7650a10b1b7f0c10ab2b1c112f9d1b7d37333051", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481971, "uuid": "9da79029-8cab-4169-9621-d6295e655c22", "comment": "Malware payload (CobaltStrike)", "value": "8dfbe8fade096e83d2b43dc902cfdea491737ba2", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481971, "uuid": "1d69f587-d9df-4187-a149-8485514e56d0", "comment": "Malware payload (CobaltStrike)", "value": "1183adb2f84baacbf6b11fe4e81f80932494f5f5cdcb02e0d72a525d993f41d3e78477e952ff9e60e73a1687d6cc9fdb", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481971, "uuid": "a1ec20a6-1c47-451a-bdd7-2f5132c0107d", "value": "T16A54AE898A116FADF5B44C3B460462F0E53DA459D9CFDD91EB8CC22BA4BFACE350405E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481971, "uuid": "aaf4a31d-05d3-4d79-9338-e413101614a5", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481971, "uuid": "d6ba9898-3624-4c42-a5e2-09c9f8b37863", "value": "6144:6CAZKYdFL8YrBZp4U4RriT4RxcqwjHzr5vkx1OQ:OZFD/NuFiTkx9wjHzr5BQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635481971, "uuid": "7b9742cc-2abe-4a94-9f71-317ffa1c6bbc", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635481971, "uuid": "4d12756b-ec29-463a-b7eb-04fd3387846a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481971, "uuid": "c06b9e80-a4c4-487f-8f72-48cb7c434eec", "value": "83653a93fc7d8cba1b6d9bcc7650a10b1b7f0c10ab2b1c112f9d1b7d37333051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11fb088-38e9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635533796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533796, "uuid": "98ecf0b0-352c-49d9-ba5a-27b3708bd59b", "comment": "Malware payload", "value": "8d97ea0aeb6dbb5bfe61a2a45809dd90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533796, "uuid": "d10aabca-8c82-4195-9809-d78da34fcce4", "comment": "Malware payload", "value": "8397681fb127b7050397870b95f23d310f2e62ee5c2e3a7410d2daeec99e9e06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533796, "uuid": "9f559419-bc48-46bc-93c3-3a57302b810a", "comment": "Malware payload", "value": "c2abdfefadc76b9f78b500f5b3aba9321a5d42e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533796, "uuid": "71d9059e-9052-4357-8da1-5a2c27d98654", "comment": "Malware payload", "value": "3e9a6cecd118f704704c46e059910ee7ada0f5ff72ee019de41c79cc3ff3b349d5dd1c1f0fd17ee76b0fd8884b440d3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533796, "uuid": "f80a5a49-91bc-4f1c-bd81-a646b319d192", "value": "T1F1342329B9C24AF7F01715316E32BB72A3BB91203670B54B87640FF72E915C7B94825B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533796, "uuid": "f9aa7e88-c402-4b5b-8c87-512cd254457b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533796, "uuid": "62d8a637-c21f-488f-8451-f6aec38765f9", "value": "6144:wBlL/cwJvLdNnaLNu0ELLFUH50QsVMxi6KjwBsG14ugTqi77B:Ce0RNv0iZ80Qhxis14Jqi7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533796, "uuid": "4d7eea6f-c983-4f3e-8d77-767fe26e2a5d", "value": 240309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533796, "uuid": "d54c09b4-7cf3-4276-87a3-9764d39caddf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533796, "uuid": "a3b035d8-5a84-41db-ade4-dbe15f237c32", "value": "8d97ea0aeb6dbb5bfe61a2a45809dd90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252426d8-38c9-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635519710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519710, "uuid": "576095bb-4d32-45b8-a530-459a7ec24e67", "comment": "Malware payload (RaccoonStealer)", "value": "a9e51d671615e79cdb9cb22aa80401ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519710, "uuid": "ea67b283-242a-44fb-b761-64759dfdf796", "comment": "Malware payload (RaccoonStealer)", "value": "83d969f48d9ba67f00e732c7ddef343f9b23b3048228a266214a991d52856b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519710, "uuid": "983f4480-cef3-42bd-aa04-ce3d50a8baab", "comment": "Malware payload (RaccoonStealer)", "value": "5c98f763cf0de4b099b3c5b59c4b6afd23324f02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635519710, "uuid": "a2bb819f-f558-4f78-ae8e-542e379bdf59", "comment": "Malware payload (RaccoonStealer)", "value": "b80ae74e2c664abce8f85e99b9519cf0576fc79fa07d807e63a391da96f1827a1ad3acc64d2db1b0caa69879e721f76e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519710, "uuid": "1a0746e8-5fd5-4964-b572-c12be2740929", "value": "T171748D10A7A1C034F4F212F859B69769B93E7AA1AB7490CF12D516EE86746E0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519710, "uuid": "218961e4-ae78-4a18-a0f4-58b5daab1c7a", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519710, "uuid": "4543f8f8-f69e-4280-929f-d403d41dfbe8", "value": "6144:FeT5XzFU4bMBigvOSYXK32K/cDHgsaTuaStDUZW:FS5XzFHb/PSR32K/cDHgsaota", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635519710, "uuid": "a490ba53-ef8c-4709-8307-58824133ca7d", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635519710, "uuid": "b206d10b-1716-4eee-889d-f79eee0fbaf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635519710, "uuid": "9508e03b-a8a8-4dcd-8296-1e4cbc11aee4", "value": "a9e51d671615e79cdb9cb22aa80401ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53775641-38d0-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1635522794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522794, "uuid": "c392a44c-811c-41ca-906e-d74a193a9e81", "comment": "Malware payload (NetWire)", "value": "9a9f389d7aa1a7e0ded19e72fa02e0f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522794, "uuid": "54178d90-6448-4d06-92f0-36b2c73dcfe8", "comment": "Malware payload (NetWire)", "value": "843c5f7a818681e3df212c80515cdce0bd56c6e178412736b8a22b15ebb35435", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522794, "uuid": "7db9d49b-a300-4dc7-94e7-939ba5e0c590", "comment": "Malware payload (NetWire)", "value": "2e5d861fe576b7ba708dd754cd8e4ce880f2ea2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522794, "uuid": "63c0edde-7de8-476d-ae62-fb53c4d9f19b", "comment": "Malware payload (NetWire)", "value": "674a081dc9cf6ba232e412a7d4557af5be1eca7e037785f89b1cbf986da2980e60ea4651491ef5db57d8e56ed8282702", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522794, "uuid": "8409dd19-f861-4e10-96cd-62ea32f91ece", "value": "T14FF31718FA8794F6FE0B1D31919BF73F0B757A01C130CE92EF541E86EA23C26150AA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522794, "uuid": "55dfd754-74e5-4e4d-8796-00c3441bdeb4", "value": "4563c74acbd357d386b177e402b96ce4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522794, "uuid": "1d303665-f25a-4e1f-8d5e-222ce78ab037", "value": "3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLviYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/izQqqDvFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635522794, "uuid": "4187e69c-8902-49af-a9f9-b7d99b432a57", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635522794, "uuid": "77533f88-b2cd-46a5-acd0-b5867e2007f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522794, "uuid": "b29612c7-2b56-4dbf-8966-1edf2f127084", "value": "9a9f389d7aa1a7e0ded19e72fa02e0f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4eec4e-38e7-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635532553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532553, "uuid": "34b7266a-f009-4c61-bcb2-6e8c3b1ec73e", "comment": "Malware payload (DanaBot)", "value": "3a0895b2b492bf8da905ce273f106dff", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532553, "uuid": "091f83b3-9993-4b05-8d8f-c6da1cfcf0d1", "comment": "Malware payload (DanaBot)", "value": "84e660c32168446d208e21adc81cf55bb65734cea4da324ea6ec582324b311bb", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532553, "uuid": "ebbc8851-c98e-4a23-8840-1060fede5b50", "comment": "Malware payload (DanaBot)", "value": "600b22a4da6f2747a50865175771aeb2201a3793", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532553, "uuid": "a82c0579-143e-4c6c-a20f-c6769ee71a03", "comment": "Malware payload (DanaBot)", "value": "348602960de1dc33981a2e2b1840cf9f9f409f2035c278f9bbd7f3fada3dc6a259a1afd0b61044e14d7f26523b8986c5", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532553, "uuid": "e5f25cb3-12d0-4b3a-833a-5ca499767afa", "value": "T145C54C2033B69812F273133598F3D0E09ED8BD6299B4AD4B70C23B5F049F6D29A5975E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532553, "uuid": "ad3ca6ef-9d59-411a-bd2e-bf3ec0ed7204", "value": "962570fbbec5a88ee4b45ad011cc651b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532553, "uuid": "92fbcb82-65d9-4e61-b178-355b9ba80ae0", "value": "49152:LgZziYTi//YHt2Z/fZMdzUAOC5n+LlrxFTGWsKq:L0ziYTnN2Z/f6AAOGarxFTGzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532553, "uuid": "08880752-1c67-463c-ad39-34ad5f877c3f", "value": 2588672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532553, "uuid": "fdfd27d0-9693-47af-a0db-04afada94e4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532553, "uuid": "00d2e429-6231-4c8b-bc74-c0e5e883f237", "value": "3a0895b2b492bf8da905ce273f106dff.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d380380-3877-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484666, "uuid": "e045079e-4487-4189-8dee-4f709836db69", "comment": "Malware payload", "value": "8b3d6763be91ee26f3844b0f113e2a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484666, "uuid": "9a1c0e07-71fe-4b3f-813f-dfefc2500d5b", "comment": "Malware payload", "value": "851b9e416b22c80a435f7d11f0298272ad23a4ae49f6fbe23aafa0578c400bd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484666, "uuid": "ba31f908-2451-4773-99d0-2a46f739f997", "comment": "Malware payload", "value": "263f6160fef67c614db9869b67bcf311009ae6bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484666, "uuid": "f57319ef-fa61-49a8-8912-0a45b83146b0", "comment": "Malware payload", "value": "eac501d0a0ee511f2e81410aaa83fed888198491c71eebc5d3c1cde6722a540c5001d0f480ff2076933e64b01ed83ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484666, "uuid": "b158e2e8-8221-4aca-a3ff-8c232ad362a7", "value": "T1BA04BE22A6D40455E49BEFBC083B9FB5817DBD666D10C20F727469CF1E32B968D0271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484666, "uuid": "368ccf85-e676-467c-a111-2aa83b57f8a0", "value": "653d2db41587e1e0124e6e9c30ca0e11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484666, "uuid": "a6c3701f-5a6c-4554-b290-3602622e0108", "value": "3072:9GSrVqwQITouTpXo/OXu3FUF/pstBaDqwONnct437Bl3N2UL8n:DQwQSl4rVUF/p/uwONct43j92U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484666, "uuid": "7dfd31df-2a3c-43f7-a66b-371d9cd77b84", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484666, "uuid": "13c0c321-7031-4101-9520-96476fe10018", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484666, "uuid": "9eda204c-378f-4736-8c0f-94628d2e75f9", "value": "8b3d6763be91ee26f3844b0f113e2a27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1937cdd-38ce-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635522147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522147, "uuid": "5d3b7de3-b917-4c90-9bc1-d36855e0c187", "comment": "Malware payload", "value": "d31c7d2c2cfa9b2baced699c04a00107", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522147, "uuid": "0d381587-32dc-4861-9de4-a6808dba97ba", "comment": "Malware payload", "value": "85536d80cd215c55c6e716a82daf73c9fb700ca68cbf6a0df0ef0c1ec8ed61a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522147, "uuid": "359f3a56-4a5a-4784-86cb-45c1f125ef13", "comment": "Malware payload", "value": "17baffffb106fa95f1908fd92c8b4d330dc79e24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522147, "uuid": "e25d0300-07f0-4648-8d9b-57e9ee2e9254", "comment": "Malware payload", "value": "6aaeffc95b80d31cd44c5468cd419ea0820b774f451b6dddf056fcecd88cef65e83852937741edd83ecd209fa0cd1927", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522147, "uuid": "220e3c22-cec8-4ddc-9be3-eb28fd3e4cef", "value": "T1B5724B43F7475966EA0541BD3432F278A13BB6746F6096E3E783892906397C06C7AD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522147, "uuid": "ff6236f3-c535-4200-afdb-f17482382043", "value": "1c8c92d264ac725186aa72072469e6aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522147, "uuid": "8fbc89bf-cd19-4853-a88d-5ffa156c8c3e", "value": "384:BGqjA5YXCGpIjD85S4n5kuRfTno0NjD9p+mOe786edV:iYXCGOjDY/no+96e7odV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635522147, "uuid": "21655a2b-6392-47d7-8d6e-97de2d2405a4", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635522147, "uuid": "b6902ea0-ef07-40cc-b884-c790eb1b438f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522147, "uuid": "39f65c6e-4f66-44ac-b78d-68a04550edc3", "value": "d31c7d2c2cfa9b2baced699c04a00107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa045203-388e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635494727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494727, "uuid": "c6f571dd-5aef-48fb-9110-2594ba5727f6", "comment": "Malware payload (Loki)", "value": "fc7daf6ca0e28139a632fd9c7dcd3fe1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494727, "uuid": "da6e5e82-74a5-4249-9793-129c296adf15", "comment": "Malware payload (Loki)", "value": "86104b114c8a2df3ff733fc9729d3c27953318807281735c21033705789d5a7b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494727, "uuid": "64260c25-9bfc-4aa3-9453-898bf0ed6b5e", "comment": "Malware payload (Loki)", "value": "49b48b54c2bc7570db20c27890a2726cc55c90f5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494727, "uuid": "816822e3-68d3-43ea-8857-9426a2b56dda", "comment": "Malware payload (Loki)", "value": "a6b83f8f587f016135924be5b604fa6233c08989fa3bc7115fb6becfabdfb2b0adc653f13b7df1b6801e6876412f4f73", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494727, "uuid": "a9fd11cf-1a37-4527-bb82-49475f0fb650", "value": "T18274B097B2545A9ACD52F8BB1E29B538261FCF52C68883F781103D3A14725FC6B3943E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494727, "uuid": "d37edfd7-2bfd-4b31-8839-5b80af8005bf", "value": "6144:K35497Br8nqBxXWHNC6TDbOBeTy0WfW+9csnQ+P0OtpRc4z9OvUHoGyxi:+56uNCwOBT0W7OI0OFVO8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494727, "uuid": "0926f86e-bef9-46f9-91bd-0e356a95f930", "value": 357400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494727, "uuid": "7b6a5de4-6411-40f5-9a07-ed57de54751e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494727, "uuid": "aa385a3c-a6d3-48da-a7d3-a2f124833e36", "value": "MVSEACON KOBE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2794a91b-3883-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489649, "uuid": "8c17c974-59be-44b2-97aa-5d7c56c9f0a7", "comment": "Malware payload (Mirai)", "value": "ab985a5aa9025467417c596d55665616", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489649, "uuid": "fb03b560-2f89-44d1-986e-d17aa72320b0", "comment": "Malware payload (Mirai)", "value": "871fd4ce9a1123ea4c4846d97d5f547eb29357871bdfedc3a1de5b621189d9f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489649, "uuid": "77906f38-57dc-43bd-b867-4c0736cba0ff", "comment": "Malware payload (Mirai)", "value": "380b0e55c98f46ea5bcfe251f6e827bb9eccc168", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489649, "uuid": "3f7b2478-dad7-4b07-9382-8332fa0c231a", "comment": "Malware payload (Mirai)", "value": "77ad8d44dc9876eb6035f14abbfdee461ecf8a8d65499c83e33450f3e02cc24ba87ff717e96e37000c32fdabfb53746e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489649, "uuid": "b0787f68-ad21-4e36-bb03-946f9746c471", "value": "T118E22053B0B397EFFE0D75F9D0052542F539828526BE0523EB6138A6B4B249F6AE1DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489649, "uuid": "a4be0ac0-c7a7-422a-afe1-0a88ac155982", "value": "384:+pKH2Vg4Y3sPfMYHdJ8HASC4xv/Hsh+mUH90EV4JZBIA:mmZ38fPH8dx84mUdxV4JAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489649, "uuid": "2bf6f7ee-793a-4310-bacc-a8235bed9bb7", "value": 31984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489649, "uuid": "c9c61e53-2460-442a-a875-c4cd9a4aad51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489649, "uuid": "145ae77d-11cc-43a7-a204-a1ba789af026", "value": "ab985a5aa9025467417c596d55665616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee73b50a-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485258, "uuid": "22a0a1c5-bcf6-47e3-8323-accda7d6e788", "comment": "Malware payload (RaccoonStealer)", "value": "83449e7a0c9741b11d4428e7c3ea4f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485258, "uuid": "840af498-75db-482f-a0f7-260c2c6e61dc", "comment": "Malware payload (RaccoonStealer)", "value": "873475ed4caac36bd543b7e8ca094aff8bb7b5389f753ba1defb4eab0ac6fd3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485258, "uuid": "ef685683-36c9-481e-ad96-da8cc83031c6", "comment": "Malware payload (RaccoonStealer)", "value": "df9fea6ff6e3b455cf320d8e5eb3e05234f23f26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485258, "uuid": "99f1b81b-da0c-4b04-a76a-4207e29d646c", "comment": "Malware payload (RaccoonStealer)", "value": "82f92c855054fed39ae8009a4e7a82628e0610baccbb608711239c7ae5c4d2be7edc6c4b9f3f4c9a8b52bee17408c2ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485258, "uuid": "68a220fa-3c68-4116-9e7e-51e79dd1af54", "value": "T106D4E000BAA1C035F6F612F8497A9265A93F7DB1673890DF22D517E94A78AF0EC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485258, "uuid": "6e3d6a89-e266-41c9-bcbc-cdb6f96b36af", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485258, "uuid": "f996cc9a-e6ab-40f7-a092-af8c81d78560", "value": "12288:aGQp+M66FR5tgO24+2yPnJn0g58OQCKNbGGz3UoBxZ:pe+M66j5tIl2yPJwBBaiBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485258, "uuid": "f4c637bb-d60a-4681-b90d-cc8900eab572", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485258, "uuid": "e521278c-79d3-4d59-a9e7-341b9c493993", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485258, "uuid": "f3ce81be-9240-4d23-b5aa-6db63260aa23", "value": "83449e7a0c9741b11d4428e7c3ea4f59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de03fed-3851-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635468131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635468131, "uuid": "7cc4f069-a3b5-473f-aad9-e01e0dcffc59", "comment": "Malware payload (RaccoonStealer)", "value": "2ee75a39c4c95282d823552cee53ff1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635468131, "uuid": "e75c9807-8002-4ece-aec5-6d6325a2c907", "comment": "Malware payload (RaccoonStealer)", "value": "87405f0c17c7ccda1c89b260266217bebcc2f77cfa8bde35b90984af0f0b28a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635468131, "uuid": "8cc418b7-927c-4859-9a5c-3e6579a00049", "comment": "Malware payload (RaccoonStealer)", "value": "0dd3e825ab6a9eb84f94d43641ee597ea2cdabb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635468131, "uuid": "fb15e8d6-69ca-4db8-b91f-28ca20d26b29", "comment": "Malware payload (RaccoonStealer)", "value": "b321bb499b81fdabab67ca5a8db9acdc9c1ff75ae18e170db787b8f42f16abcf52460e817ae6b41881bbd078c5f224cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635468131, "uuid": "0c478307-0cdf-42aa-83a2-42c16d4a3298", "value": "T175A4F1F0A2A9C072C06379B04C25CAA15E3A7C63E930951B7A74771E3E70EDD5AD235E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635468131, "uuid": "987f35f7-8050-4af1-aada-ea6ea6d61e43", "value": "18875662b19ade4ddd6bba43f9abb4a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635468131, "uuid": "6c47e698-74ad-403a-8a24-d4a592476940", "value": "12288:d2+RlW4dNPwSGC39C0QhiDwKHKOslYLAowrvYGKunnF7:r28NPTHQ0Qh6womYBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635468131, "uuid": "bb51bd50-dfa7-463e-a34b-60d32c5dc7a7", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635468131, "uuid": "ef683dbd-b8a4-4b98-8b4c-c669f359aece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635468131, "uuid": "305d3f59-6929-4b05-a1be-0b1c69772f94", "value": "2ee75a39c4c95282d823552cee53ff1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c87d99-3891-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635495988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495988, "uuid": "97fa30ee-9f84-44c9-8c92-01908ab50fc9", "comment": "Malware payload (Formbook)", "value": "d23ca1a68c0067ad0bd32dda2109c7db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495988, "uuid": "8c598d98-d58b-4614-8abf-77a9f0b8ef36", "comment": "Malware payload (Formbook)", "value": "877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495988, "uuid": "772e6210-47d5-4f92-9139-b3081b52a54c", "comment": "Malware payload (Formbook)", "value": "de14528b88027332f2c406f42f23c68cf16ec11e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495988, "uuid": "b0ee6a0d-ad05-493b-903b-8c1cb40b5888", "comment": "Malware payload (Formbook)", "value": "1f8f58b4e27db4efdb32090b44d08aa7ded48b18c81373a71cbd748b9156bb91864db49335c616ff30be66c38ca07b67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495988, "uuid": "732b6a67-e8e7-43ea-ac2c-c05f55e88eb1", "value": "T1C7C413456F2847AFF36C0FB870530A1486A57E322B71EE4D8AD6369D27B27C129CC953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495988, "uuid": "0ec0d779-5e24-43f0-99bd-bff5f3578b5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495988, "uuid": "12b47471-94f1-4c11-9de6-ff58d39ec44f", "value": "12288:alfZx3WGByXhz8Qv3HCTarzAqw8E1+gPQfG8S5qwL//fE1vI:alfZxGtH3iTaQqwke8+TX6vI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635495988, "uuid": "5b2b6255-a45b-4043-a31d-5a1351f15683", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635495988, "uuid": "585489e9-02a0-481a-8d08-40b423e7120a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495988, "uuid": "0a11a1f3-8457-4125-bb4d-b5bf8a9d29d3", "value": "d23ca1a68c0067ad0bd32dda2109c7db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c149fd13-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635526414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526414, "uuid": "6820b7e1-56c3-4a8e-8e88-064f25a71968", "comment": "Malware payload (Formbook)", "value": "94d6ece4ddb9b6cc4445ca5edfbc6f87", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526414, "uuid": "84a9b4c9-e692-4b82-9c77-fa7be7f09451", "comment": "Malware payload (Formbook)", "value": "8827c12e68e528f3c87dc8caa02787af7107965b13496cdeca7198bfd5b5e30a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526414, "uuid": "1ac75758-8334-468c-907e-4a4b44d40cf5", "comment": "Malware payload (Formbook)", "value": "3211b9c652ddaaa37743b864ad30d545cee0c405", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526414, "uuid": "400ddcb3-31e3-4b9b-846b-f2e241dbab1e", "comment": "Malware payload (Formbook)", "value": "4c3b662fc72baab37ab7b2a63ebc7dc8f597ea2f28678caec1836afd5935bcbb9d119a012aa552a0e8da662d8190014f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526414, "uuid": "990bc3f4-a965-4402-a7db-98503f3d9115", "value": "T15894E1E5B9DF1B86CA0D78B1AB46AC91E2676C450A62C4E58C20F4FE507F26F433744E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526414, "uuid": "f04965e4-fbfe-4675-a240-f7fa245b8ab9", "value": "6144:zPvEoHIow1InrYsDfTsulxTiqprUPKn2RZnlCde6QB5R7sMYeJGZRf:bk/IrY440JWZnke577nYeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526414, "uuid": "f31f7f13-2c9a-43f5-95cb-b52ed5b537ca", "value": 442392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526414, "uuid": "71d9c0ce-66b4-4d80-a19b-d7fa0c6c4482", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526414, "uuid": "ea4b9f0f-087c-4791-a0dd-f1b344c9e318", "value": "SHIPPING DOCUMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b310583-387e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635487508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487508, "uuid": "0351cd49-0243-4248-9812-fe4e54a078b9", "comment": "Malware payload (AgentTesla)", "value": "2fece6cfe5d7dfae87ace2a3ba97c60c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487508, "uuid": "4229490b-b497-4b1c-9377-1a8583561a69", "comment": "Malware payload (AgentTesla)", "value": "883d06e8debb0aa746140835ae112e59d681cf5ca2fd9df604fd8f1b11da8358", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487508, "uuid": "14318581-86c9-4351-b44a-fca1e5f917a7", "comment": "Malware payload (AgentTesla)", "value": "190083c2ec533c3b7941c3277527e7197d5d93e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487508, "uuid": "33432c6d-7b28-4809-9bd5-6f5a3531c4d3", "comment": "Malware payload (AgentTesla)", "value": "9a7ff4bd808e93d5562e2d7888bcfcd076306a4cb6b3fafdc66426d118c09de3507e23cee6f047c02444f0e615d4dbab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487508, "uuid": "ef2d89fb-1af7-4c6d-a1f7-4022632a2838", "value": "T1009423CD063B42F8C3C1AFD994AB921FDA55C408DEBC5E959583A5CA170F81C781FCA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487508, "uuid": "4a367004-0f15-40c0-8a79-6bb8f4721e18", "value": "12288:FT8vTj7yvEr9Mbu/9OT38VY59Nw4bK+J1b:gTj7ywMo9OwcDwaDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635487508, "uuid": "6b2e22fe-2d7b-4813-8b75-d3b488b5a897", "value": 409165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635487508, "uuid": "a6dad2ea-bd0c-4c81-a48b-663906210457", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487508, "uuid": "10aad84b-7bc3-4bf0-8a56-46a10f83c3cc", "value": "SHIPPING ADVICE#ASIA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde66dab-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635484372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484372, "uuid": "d81e5cdd-f3e4-4f58-91cc-717b79e3c308", "comment": "Malware payload (Formbook)", "value": "2b8d5c81a2199f9479d1b6f7ea956445", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484372, "uuid": "b0d7a7a4-deb9-4bc7-a5c2-ecdaccfde0ae", "comment": "Malware payload (Formbook)", "value": "88c841869430e07bb9b80e52d61d4f013c6bd8753b06807b411a428f09669c33", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484372, "uuid": "926a264f-8093-46bf-931a-7b1a2406cc83", "comment": "Malware payload (Formbook)", "value": "6a4ee62c34987d4791ff474a0f1efc4b789e53d7", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484372, "uuid": "150a2f8f-750a-43bb-8cf1-970423aae52c", "comment": "Malware payload (Formbook)", "value": "e110ce1a3dcb9897db2fd8d7d594d506dc3d77f1747ca6c311d350edbd40f2fa75be4cc2c257bcd8225d0b4e7b1062fa", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484372, "uuid": "47a2e861-df81-4b11-8357-ce251764a236", "value": "T12084B0E1FB7148F6D8335379B4B76C262123E93AEB61105A16DDF72A4E3338205E6943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484372, "uuid": "c05ed38e-1bba-40dd-93c5-412ba8e615c2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484372, "uuid": "7ddf7740-62f3-45cb-8ede-f34243e94572", "value": "6144:VBlL/kE286EZdfvMGVRDh1oBYbeMWaf2niKr1HXE43xo4Qt/ZD1:D6E2864XMgRD9PnmR0pnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484372, "uuid": "9d17daaf-bd98-4c40-bb84-5d5aaff58a2a", "value": 372170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484372, "uuid": "444da36b-0f35-4425-9c15-58cdaad01e36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484372, "uuid": "d72b3d29-5233-476f-9b87-5e94b3b41a76", "value": "Zahlungsbeleg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c66e9a-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1635484138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484138, "uuid": "e1d06a91-88b0-4b54-8741-6243072d0c66", "comment": "Malware payload (STRRAT)", "value": "34e26bc587a78272f5bb46b85e05b2dc", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484138, "uuid": "269e3b2a-650f-4a09-8f2d-6edf3ba7b683", "comment": "Malware payload (STRRAT)", "value": "8909c047f3391d9045b1f75bda07062a846670ab78942a8b6185ab5f514ab00a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484138, "uuid": "f878d517-168f-4d39-848b-5d78bb1db137", "comment": "Malware payload (STRRAT)", "value": "e799c6bad1776842645aad78f79d42941c231eda", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484138, "uuid": "09e69286-947f-444f-b194-40ab0bb05a0c", "comment": "Malware payload (STRRAT)", "value": "e14883551dcbd6b21605604d4e1da7e1d37d934a9dfe6fd428fd09eb0d597c8e1c52b13e7ebe32d4929f6f4487e4f595", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484138, "uuid": "8765b2ce-f761-4d4e-a388-75144e4d2193", "value": "T1BEB3DF9BBD59C1F6D1CF8232D408A622F20D21D8E645F16F29FC18811DB4DBE672658F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484138, "uuid": "0d9fb417-bc6b-4282-8d2b-b25ac153a0fe", "value": "3072:pypzZaq2EPBXgJyDJ4D8tiPeRptH3+NdZxzMnBKpqKcItxB:qz0q2EFgaJ4YthztHuVxzMnBKQKcIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484138, "uuid": "3ab46360-ed33-47f9-a062-f7069ddee5b6", "value": 108817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484138, "uuid": "441d5f7e-253c-4a1c-b561-c346bba0d307", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484138, "uuid": "4f8b60a1-b877-4037-9f4a-7d73cdb32ebd", "value": "Incoming_Wire_payment_returned120 ___vaw.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a3220d-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635526388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526388, "uuid": "bd010dd0-500b-46f5-8f1c-045a424e4b90", "comment": "Malware payload (AgentTesla)", "value": "0095db0e44cbdf1d07247d84469435ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526388, "uuid": "b207fd4a-5a97-4be7-8b52-ca0495438a45", "comment": "Malware payload (AgentTesla)", "value": "890aeb2e38af92e6e8cce8930d1fbfc4119418fcdef0bd0e6a055f3ec2619ca9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526388, "uuid": "7206ed49-96dc-4c3f-bf25-026fdf468334", "comment": "Malware payload (AgentTesla)", "value": "84745c542d7d1e0cb8c03ac4549a9c3f4cb40153", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526388, "uuid": "eca51974-c579-4acd-9bdc-e7859782ffda", "comment": "Malware payload (AgentTesla)", "value": "ee56912039ba75447e44a993a664eb457cfb0bde000cd59c5946a1f6d7aff541df17c45d5106efbd26a6b2679f89b59e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526388, "uuid": "61aaa5be-a51d-4f66-aed0-fb0c9d7af9e8", "value": "T1FDB4EA6C96884FFCCBCCB3B47B0A2F98014DBB65A786B5B7453873B11F9207B950A491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526388, "uuid": "d33bb4b3-22e8-4659-bb15-6ec32b03ea09", "value": "12288:gTCLG8i+UKudI9eVjs92DdYkHyXcwKPObdB91s0YdgTpPGPV:gTs6F/ju2DhMcw1bjSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526388, "uuid": "5bebea63-a6a3-4439-a656-2f913d5d32df", "value": 533507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526388, "uuid": "c320ae70-b0bf-449a-b4e0-d9e72b63f47f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526388, "uuid": "c0fa5273-542c-452f-a91a-ea8aee2f40d7", "value": "8111020AKL2329.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9499eac-38e5-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635531958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531958, "uuid": "297055fe-4d6c-46b1-bfa4-a7fa7e4fcb5f", "comment": "Malware payload (RaccoonStealer)", "value": "c5a077a9785424c21611801db5dd0f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531958, "uuid": "c902071c-bdaa-4852-9463-d5f72073d805", "comment": "Malware payload (RaccoonStealer)", "value": "8920b1d5b8a3f73bb010cdd5014602e4d974f2d7ef3e63f25674be6b03a4b21e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531958, "uuid": "9bd1a6fe-b4dc-4964-9800-7364c79a42fe", "comment": "Malware payload (RaccoonStealer)", "value": "423bfbe43ac7b308f0b889be8824c317bc1f4846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531958, "uuid": "ab16494f-971c-4122-bdae-9f59f84c7eef", "comment": "Malware payload (RaccoonStealer)", "value": "08936d7e348ba0190b824955d52529467d01f7982d863a01f425cb17e0b62b59b0f1de01164fe0557448da692186c501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531958, "uuid": "e4b4f29a-ba0e-4eb7-94a9-95848fdab316", "value": "T1C9746C00B6A0C039F5F722F44AB99368A93E7EA15B2450CF52D42AEE57356E1FC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531958, "uuid": "acf90552-4074-4f04-b7f0-db17b67e29fe", "value": "cc12fa1c06b94f51dc8ec5d000654e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531958, "uuid": "2b90fd9b-1f88-4f68-bba7-23a2179e1c88", "value": "6144:Kl0zomRIf6aKHTVHcoLrCM9ZMxUrNveZY8oYEdbC6Vqov0LVJErtFwg:Klwom1aKx8oLuMIoxC1oYEdbCO/OV+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635531958, "uuid": "027abc63-2ffb-40b4-add5-900cf502d6bd", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635531958, "uuid": "c2aae39d-b250-4880-af88-d427a927edc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531958, "uuid": "3fbef7c5-5ea2-4295-857a-53620723c6d1", "value": "c5a077a9785424c21611801db5dd0f95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94fa8a3-38a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1635506241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506241, "uuid": "c53bbafb-dc14-4b47-9593-23e3e28c155a", "comment": "Malware payload (Hancitor)", "value": "ba23c4970aa9c2de50bdf1b1e33bbadc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506241, "uuid": "bb2009b4-3f93-4539-8659-404edba0d731", "comment": "Malware payload (Hancitor)", "value": "89885adcbb030fd0251b08cc401392e90d4ad948f6cfc68dda34472c455a8951", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506241, "uuid": "c9f5c804-a94d-446e-8574-7887d8fc225d", "comment": "Malware payload (Hancitor)", "value": "d51ee5f01cb47da056917564e8046cb41fc0e052", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506241, "uuid": "25906fd4-d292-4cb7-a172-1899d613648d", "comment": "Malware payload (Hancitor)", "value": "a3aa2f118f66e2322825b85a6ad6d2bc9acdf5d343ebe9d8b5b34d73d37086f2ea4e7787f07a18d6832174afa032dfd3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506241, "uuid": "9bb44e34-8c41-46ee-b8ed-a8f78ae7e11b", "value": "T19D94F003F205CE43E4194779BDA2D9C93B28FD46AE1AB3AB31953F4E3E753109C52629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506241, "uuid": "d5d0f79a-0e9f-4da4-9d8f-0b1377ef1b46", "value": "12288:N8CmEKY7gpWMBgYRCVVZ/kMVeNN84YaFyOVp:N8CmEj6BXCDZ/1VYNbBy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635506241, "uuid": "02555e16-c80b-4c6e-bf46-6c30c8ea3080", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635506241, "uuid": "58f2d242-aaa6-4c1b-b5c6-db4f3489c6a9", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506241, "uuid": "68ffd3bd-3a79-4054-b493-d13e8e254632", "value": "vir.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da329b7-38b1-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635509524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509524, "uuid": "1a72736a-2e1a-4560-9810-5ff162deee03", "comment": "Malware payload (RaccoonStealer)", "value": "614837a3cc0b973720464f3a54588543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509524, "uuid": "475bbc4c-5f4f-4b0f-a8e1-e9e6ada28906", "comment": "Malware payload (RaccoonStealer)", "value": "898956bbc678f1b2156d3146a4fcefb447865610ffef7fc2dd13062b2d435210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509524, "uuid": "014cdacd-4f50-448c-ab44-f9fec90d0e9e", "comment": "Malware payload (RaccoonStealer)", "value": "0b083edcd74c69305eab4423ee4b6f929c111757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509524, "uuid": "4c57a239-b7e0-4fd9-b76a-6189ea2cdddf", "comment": "Malware payload (RaccoonStealer)", "value": "f62920923082e4cfddfd6caca254217bc62fdcc73716a518f81d01e60b3c8a037ebd4002f614952a57e3b92d4872de83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509524, "uuid": "0eaaec55-a5b3-4b6c-83ba-88d91ae3ddc1", "value": "T11ED4D000A6A1C034F5F612F84976A6A8B53E3AF1A77854CF23D926EE46349E1FD31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509524, "uuid": "1b013bcf-1064-4729-a57b-0decc9f29804", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509524, "uuid": "daa59cd7-088a-4dd4-a4e9-e4cdc6c6d321", "value": "12288:S7aQPiOMBuVmvpKYDq2iKMdGSAgAILsqg8xiRu6:UZFMBXAYDmKMT4lR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635509524, "uuid": "19fb8846-474f-4817-8af6-ba46725c65dd", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635509524, "uuid": "0b8d639b-3e5d-4da2-a6f5-bd6702a94060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509524, "uuid": "f6c5c457-5b3d-4d72-8510-cdc662e689ac", "value": "614837a3cc0b973720464f3a54588543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fe17a7-38cb-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635520629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520629, "uuid": "18ce37a3-c905-4c7b-9032-f29ee9971be5", "comment": "Malware payload (RaccoonStealer)", "value": "3eb75d7dbac9138862f7301329c980fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520629, "uuid": "deffbaca-fa64-4dbe-9bf5-02ddece7fd32", "comment": "Malware payload (RaccoonStealer)", "value": "898a8b393ba6cce23265687a7347bea58e0e973f638c091ca04a152908427211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520629, "uuid": "d29a0c42-fee5-4c17-8df1-964dec0379ed", "comment": "Malware payload (RaccoonStealer)", "value": "8f70c20f740296912aa28a2029dad1aafa1b8c26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635520629, "uuid": "15d9ec05-8f08-48e1-ac96-267697f2e2fa", "comment": "Malware payload (RaccoonStealer)", "value": "2def813337d4180844e6853230419aaf263a462ee2b4d162f10f873f4a816195ded70cfd58b9cb60d264964837e1ce79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520629, "uuid": "a6153367-4ed0-49a5-bf7f-0d7b8234e730", "value": "T135D4E000A6E1C034F5B612F859BA9269B53F39E0A77494CF23E916EE86746E1FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520629, "uuid": "a09df7e3-1572-44fb-9943-0c53d317b944", "value": "4649591756a77695954d3f167e28cc87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520629, "uuid": "059a9286-5064-4f6b-83ed-5e0cf7b35de5", "value": "12288:0beBJ09/89kZvhyk+Fja0tTKBXQO0hs98ug4NMWGJ+y:KeBq/2IhykujJ893GjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635520629, "uuid": "62dab4bc-02c5-464a-909f-252db3dc615f", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635520629, "uuid": "0d551b9d-eabc-4547-9e70-c8f3add6810d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635520629, "uuid": "3abffd64-5f96-4077-8eb4-a0d2f2dc7d09", "value": "3eb75d7dbac9138862f7301329c980fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919d53be-38b1-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635509584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509584, "uuid": "dc4562e4-665f-4f23-9549-1939914bc9de", "comment": "Malware payload (Loki)", "value": "7bef92a714ab84c862d3a5b802379b22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509584, "uuid": "19e972dc-a90f-4926-bf28-183946b83e96", "comment": "Malware payload (Loki)", "value": "89b297dbd3206cce1deb9fb69a95c57acbae86a7b18f8fb4a270e1d1687a816a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509584, "uuid": "07ff4195-63d7-4f9f-801c-961c4f56086d", "comment": "Malware payload (Loki)", "value": "cde4e74aae925a2cf85827e699f2288af95bdbaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509584, "uuid": "f2024f41-4738-426b-a04e-a4b3de1107c8", "comment": "Malware payload (Loki)", "value": "0628d5d4570f457ad4334c0f04d888456e3aebb4fad0519d81dcb56d3d2230726864c66cdb6762d3eb30ca78d1850a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509584, "uuid": "b351e6a5-2b14-48e0-92f6-29cf76acb06d", "value": "T15A64E004A3398B2FD1BC4BB840A3123547F6A8637361FB554FD638DA1923BD25E11EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509584, "uuid": "7462de8e-1b56-49b2-97c6-0d6503999e37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509584, "uuid": "5ab15154-c26f-4fd5-95d3-001bf2dd2aa9", "value": "6144:nlfZxGip614b47d6f4Gz4K6LCFWZ1BNHUGHH5q1QeUQj7G35+pMUu663i8tXFOb9:nlfZxHYB5HH5+QFs7ql1tBXF+L3m7zZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635509584, "uuid": "d7d91c80-dea6-426c-b1fd-a5cea53ad522", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635509584, "uuid": "dd00846a-ddee-4fce-bfe3-8b1f1fd38b58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509584, "uuid": "6ac01903-a196-47fb-b14e-84223d27e006", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3edb6c-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635526349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526349, "uuid": "839305c5-1965-4121-b0b9-6b4a761da14e", "comment": "Malware payload (SnakeKeylogger)", "value": "13c12db36fa771a93f92ea20a50feaf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526349, "uuid": "3e057d15-601d-47a9-85c0-41a071efcc31", "comment": "Malware payload (SnakeKeylogger)", "value": "89c05c9f13d280065a2a56358b85e6ebc8b8169ef2a543e41e4158cb230473b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526349, "uuid": "14d4b635-2c67-4f5d-b193-f7c9e7fc297d", "comment": "Malware payload (SnakeKeylogger)", "value": "27caff4dad6910c942e02d97a0e74223c7407a9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526349, "uuid": "e514c8f4-85a1-4825-bb65-cb3467150e02", "comment": "Malware payload (SnakeKeylogger)", "value": "3447c2ac12ed4817af5d70834c6585077141f2f34d29e18aea2b19a5c7f7a803edeec6c47289b4595ceff6b7a1685f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526349, "uuid": "d5bb9953-e6a2-4c2b-bbb9-5d70460a7dca", "value": "T145E412095378AB7AE2AD03FC8097126407F2A8676721F7414FDE34CA2A33FC55E54A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526349, "uuid": "9b56ac2a-b5f9-45de-9462-f559575e2a6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526349, "uuid": "cb45aa34-c9de-4946-a540-d04bc94bc93d", "value": "12288:oMSA/vi3D/EPLlEh58RanK8DNhYBNAzEKUxL1G7IfM0NNvTLCNjZ6eigAM8Q:oMSA/mcZEh58RanKyh2QFUxBG790XfCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526349, "uuid": "836c2873-5fdc-4ada-89a9-10fa3f37d3a4", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526349, "uuid": "880566e5-6ca6-4271-bc26-5c4b550b3132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526349, "uuid": "a74b2b83-09c2-4fa7-8959-ce8ce2250e18", "value": "09876543234567898765456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b269911a-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635526389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526389, "uuid": "781005f4-92e2-4ca9-830c-80da28fb92a7", "comment": "Malware payload (Formbook)", "value": "5d70f853c62e03f61e0ad43f4a96db4c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526389, "uuid": "d0077d09-5665-4f5e-aa41-944314fe6336", "comment": "Malware payload (Formbook)", "value": "8ae5bb65fe97959f7ff2f34fbf055a94a35fb0c9853448ddf8d20b25dc4e4889", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526389, "uuid": "10a6a38a-e430-4957-b3ac-8499269e5c73", "comment": "Malware payload (Formbook)", "value": "9d42c23efbe67ec377e77b694c6d2782ac9d24da", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526389, "uuid": "8910a6c8-7fc1-48f8-9ccf-02b56c686c86", "comment": "Malware payload (Formbook)", "value": "f0a0f7c258e7fa392c2ba3c91f05e893971fa0853b927202fcd2d762bfd1187ac25218289f39dcfe3edba6838c7d474f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526389, "uuid": "bbccb78b-63e2-4edd-9640-04e842c0ca3f", "value": "T16BB4F96C96884FECCBCCB3B47B0A2F58118DBB55A786B5B7453873B11F9207B950A890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526389, "uuid": "bca3be66-6e9f-430a-b65f-b3eb53339a01", "value": "12288:+zfqn3ZldIUTktmyaIa3Bby/7ov+Tzeid32/CKGXaXbnP:aqndIUYttO36T7d3FKlXTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526389, "uuid": "9a18b4e2-5ad3-4767-baa7-499528e27471", "value": 533489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526389, "uuid": "2577e523-4c7b-4cd3-8a45-d7b0626a2dbc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526389, "uuid": "4ea1329c-aef5-45eb-8d5f-b5d2993234c0", "value": "P-202110293029384.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680c1df2-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635485033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485033, "uuid": "137ccb84-a0be-4a33-b480-f004cfc41e13", "comment": "Malware payload (Dridex)", "value": "0c3db3ed9616f551dcf2d2ae956dcb63", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485033, "uuid": "f031dfd9-5693-4579-9d98-bf8275e96138", "comment": "Malware payload (Dridex)", "value": "8ae5f55ab3daf17815ddc4e22c0ea2df476a0411a8b40f8cf034eb3cc89f7eb8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485033, "uuid": "e8c1fbb3-6a94-454f-ac62-4c4ca0057d0d", "comment": "Malware payload (Dridex)", "value": "743ab12c382afd80008d923cead1fa40470daa95", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485033, "uuid": "36462cd1-695a-4f3b-8252-7c0a868962c5", "comment": "Malware payload (Dridex)", "value": "aa3bf8beff829bdaa0daeb1d984aa4117e2d39e958343b028d44e09121697890bd027df6e4b88e7197ee22767792a5bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485033, "uuid": "46bff64c-1a42-48bc-94ba-e568e065df7d", "value": "T135356C0237B24038F5B306F955FE61E45D7DBAE1672984C7A2C036ED452AEE1AC34B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485033, "uuid": "ea192c1f-6493-4d12-8dc1-00045eb3a1ff", "value": "da6b61b1044c1468d1deb0c4944ee99d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485033, "uuid": "b7eff448-8add-4de0-9ff3-895cf2d52cc1", "value": "24576:c2c6WRTUUt+HxHGRivPX04OhWqVD6wKhGm31m:ZW5tQHlvv0f5B6Vhv31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485033, "uuid": "b94bcb73-7ade-496d-9a72-80b1c4fa37e8", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485033, "uuid": "ca95f635-3627-4cd2-86dd-6b4f6ae81c41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485033, "uuid": "33b3943b-9950-4442-b4dc-f5a6bc372ff4", "value": "0c3db3ed9616f551dcf2d2ae956dcb63.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e8d5fe-3877-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635484620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484620, "uuid": "52a89b12-5e4d-4ba5-85c7-132a3c4fff4b", "comment": "Malware payload (RaccoonStealer)", "value": "00c1f8721ffbc325652e2f7778ce0ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484620, "uuid": "02539a05-66a5-45e6-8f4c-34e4fb833f49", "comment": "Malware payload (RaccoonStealer)", "value": "8b4f750ce68702f0a291c770fc0f556bc34fb7e2a9eaa66d79b294a1d3bf7ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484620, "uuid": "473acdf4-2d85-4010-a575-265ffd2d3d21", "comment": "Malware payload (RaccoonStealer)", "value": "e644d8152ac8c3e73e2c22bf3f1eef8848828501", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484620, "uuid": "10f19dc4-67e0-49b8-9de2-f6c561e5fccd", "comment": "Malware payload (RaccoonStealer)", "value": "92038d37fbb4e8a464744ca6d8b1fbfcb9fef35a986fd79b5988e638faf89718888ad05fb7608855352d4dcf6e571791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484620, "uuid": "317f89e9-b6ba-4173-8a65-c70cd4b14209", "value": "T117748D10A7A1C031F5F252F8597A9369A93F79B1AB7890CF12D516EE4B74AE0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484620, "uuid": "8a3fa6a0-ec08-4343-a8f4-10178a7d5ad5", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484620, "uuid": "70fe69e4-53d5-4494-a3bf-451dbadd59f6", "value": "6144:RuU/wJ06cQVns8XCZ0vSl48L73sUkhp7cSd:R9/axcQNXCZ0vSG8LzkISd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484620, "uuid": "5c14eb70-6130-4add-b656-53cb39df6a0b", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484620, "uuid": "2d35e30f-27f0-476a-b699-886e2b5dfcc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484620, "uuid": "bba409c2-6c2b-49d8-8321-6a0ea23e4773", "value": "00c1f8721ffbc325652e2f7778ce0ef8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41943bf-3911-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1635550874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635550874, "uuid": "91839595-ef38-4499-a595-6183e5624dec", "comment": "Malware payload (DCRat)", "value": "857b80d668a60f9ab7d95347b0133989", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635550874, "uuid": "9d57bc3c-524c-49e1-80bb-b55049dcde89", "comment": "Malware payload (DCRat)", "value": "8bbb5065b3abb10be56264acd1d325f8df2c85f374ce74a005ddadd49a2594b6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635550874, "uuid": "47684a47-d9ab-4a5d-9dfe-161b0a07e3e8", "comment": "Malware payload (DCRat)", "value": "8e70a9bd24392b1902749302f697a8b94ea43a4b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635550874, "uuid": "a6b9aa3d-d4c4-4758-b085-c4d824655c46", "comment": "Malware payload (DCRat)", "value": "29d688fbab829cf0fa2a9abdf9148fac5faabab9e9665aff89a109dc59acdac93f0b29b1c4e91759f21c3ea53798903e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635550874, "uuid": "fc018b17-c5cf-472b-9b49-938fda6f5ea3", "value": "T1404528023A46DD07C02A1637CDEF447817A8ED806B66DB3A7E9F335D64523A79D0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635550874, "uuid": "88140915-11dd-439e-bc0a-24ddcfa555d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635550874, "uuid": "cf428550-291b-4abf-adce-ef503f6834f0", "value": "24576:nFQDMlPm13VnFc8fkdwXqts3PZR5bcJgHAqN5d+4:FQZadHsf9bc6HAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635550874, "uuid": "ab9ca228-26ef-4357-a012-b9eefc2a27bd", "value": 1265152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635550874, "uuid": "f89a7b53-575a-4cbc-8267-cc33ae8a6c78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635550874, "uuid": "4d54d72b-e609-4184-b3e0-33b03765e5af", "value": "8BBB5065B3ABB10BE56264ACD1D325F8DF2C85F374CE7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6c6814-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635530080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530080, "uuid": "8f30a244-f45a-498f-9d50-fe5c22223b8e", "comment": "Malware payload (Vjw0rm)", "value": "c564d2a0035391aff717e59dd955642a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530080, "uuid": "33f88a9d-f194-4acb-b904-53f871b2942c", "comment": "Malware payload (Vjw0rm)", "value": "8d745015b19835c58b6cc5e9a37df00f86ee6fbbc14ee3557409d4bdfd89da3f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530080, "uuid": "a8b5be56-168d-4cf2-ae00-56cf057574f5", "comment": "Malware payload (Vjw0rm)", "value": "4f694e49f05d41a2a2160d5f1709908bd6ccef29", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530080, "uuid": "24fb33bb-6fc7-480e-8178-a768579bbad4", "comment": "Malware payload (Vjw0rm)", "value": "6b4cdf76d342bf96c4636b0350878dd0c6955e60d437c8215727953966243482a67385556db4fb5f550f670cdb48526c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530080, "uuid": "50aed7c3-bd1e-4f3c-856a-94433b76bfed", "value": "T10683801192612D46B9B1DA02F71D0510DF14A6F4EF6AA0AAD143C8CD3EFF2075B9FE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530080, "uuid": "452771bd-97a6-4043-9a54-7a3b5cc54312", "value": "192:gajTKDrSsWruBc3N19eFb1ow9yQ9y9JkLE6+61Wsz+fr+5inP7TvsC+U6OEsO+Rn:bTvPkrvmgpR/4K/Ktr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530080, "uuid": "0f2a52fd-baf6-44ee-a0ad-83d295a736bd", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530080, "uuid": "1c4f8cca-df94-4546-8f8b-a6354fc0c844", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530080, "uuid": "723e0078-26b2-4107-9de7-668e0ca3d022", "value": "Dranreb_Payment_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe820db-3877-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635484831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484831, "uuid": "110b2f20-f5fa-4895-b999-9ddb96c75513", "comment": "Malware payload (Loki)", "value": "cb37241bc90fefcc0d61becffbe4d1ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484831, "uuid": "42a99e23-e236-42cc-b160-4957fd4ddf89", "comment": "Malware payload (Loki)", "value": "8e3206b607c3117dd77a80c10f67a62b3114a6835b433ea1e06a76f8f52ab487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484831, "uuid": "f5404af3-bf40-4ec9-8b60-a6845f103a63", "comment": "Malware payload (Loki)", "value": "21ef82fe30fc866e2300b812369564663df7e2f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484831, "uuid": "3ab8fd40-9540-4adf-8457-b62590bd019e", "comment": "Malware payload (Loki)", "value": "9271f3f7277dc11a712415319218086eb265e972cb7fddf82bb184fcc8401ca645c693e413a44163fd98ef96d5850683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484831, "uuid": "38895fe1-cf60-4bcd-a589-667b74a25362", "value": "T1A35413AE60D149B3D8761BF56FFA9938E23AD3113175828717703F6B31794CB092A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484831, "uuid": "298d6ca1-b388-4c6f-a5c6-45734d30305f", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484831, "uuid": "cff6b643-86d7-4d4d-8654-e2067f505a99", "value": "6144:wBlL/ckt5cu9WZ2yEMX2QAk863wniOMO6f3s1guaTK5TD/bc:Cekj9gHmxkPguREJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484831, "uuid": "907d4ad2-d98e-46f4-af22-f5847e61dca1", "value": 278753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484831, "uuid": "35dba343-e4ed-4625-ad1c-16397714fbc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484831, "uuid": "53f84d92-b3c6-41c7-b2a0-a6ab8622e258", "value": "cb37241bc90fefcc0d61becffbe4d1ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48796d37-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1635484121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484121, "uuid": "46408075-9b31-4da9-8ed7-7b3d1f7d9094", "comment": "Malware payload (BitRAT)", "value": "bea12b6b586c2401c6c16210c4d3f114", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484121, "uuid": "a183e003-2c9c-47d6-a683-ba0b1834e0e0", "comment": "Malware payload (BitRAT)", "value": "8e476e96fba5dc1ddd8651b1f2039628880a0f7284f21d72d7e1ce70987e1a1a", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484121, "uuid": "029b9515-8748-49f7-bc4a-fc6a628507be", "comment": "Malware payload (BitRAT)", "value": "23e41e5f5101f6c71bc2d47b863884db1d220da4", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484121, "uuid": "77f96ffd-c2ff-42df-963e-6b441d0bca49", "comment": "Malware payload (BitRAT)", "value": "be6c635a53514b444bd4a898ad7126a7a17d8529e03bb758e7fba91e7d9b454193f77eebfabb14584810239ef8c67924", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484121, "uuid": "0f3e6e55-f166-4cd5-8e08-345375dc84c5", "value": "T15CF5CF1EB358EE83D15D6B35C81B9CA493E588933331F25F79C56EC12599F890B2F02A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484121, "uuid": "b849d058-6b8c-425a-83c4-d357ab5a011d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484121, "uuid": "a0eb8ca5-3982-4344-a74a-cbbdea6db151", "value": "98304:Xy2tl2C7w1ZtlozSl6sW1Ppnlh+xrzKr/PTbqn9pEmU4HZzjPLgBvxGod5oDvsGG:bmpkf+U6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484121, "uuid": "7c9d63b4-f135-4326-a7fa-dd7efff316ff", "value": 3464192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484121, "uuid": "46bf41f2-aac9-4401-9d0c-71ef45dcc96b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484121, "uuid": "b5c3825c-e65a-4e90-809c-779092b72b6d", "value": "DHL-SHIPMENT_INFO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8628497-3881-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635489087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489087, "uuid": "94e11bfb-16f6-4229-834c-7821ed81973c", "comment": "Malware payload (Loki)", "value": "c2c509a61a1d811d29ade6067e54c011", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489087, "uuid": "79811117-b672-48da-97a1-4e75b0b36ba3", "comment": "Malware payload (Loki)", "value": "8e485f57dd58369854070e6626690f77c1fbb8bf7dace3930897b9f9eb35e5d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489087, "uuid": "43991134-abd8-4a6e-a672-f94ca5cd6475", "comment": "Malware payload (Loki)", "value": "d012fba0f39a14ca051e84f4cba078c52777dceb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489087, "uuid": "21204a17-6a45-41ec-8a66-fac24418e428", "comment": "Malware payload (Loki)", "value": "a6e2a561db2e0e4dcdc80951cee4fb65be9b275567df6bdc155700b6f2a440e8f2ed38bdbdd95a34166fa5ce7d150aed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489087, "uuid": "0eb3e2aa-52a0-42fe-bf9c-6da74e3b66ba", "value": "T17094CE01A3E5A91AC3BD4F76087310201BB5B9977D25D34F5EC861DE29BAF810A81F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489087, "uuid": "a6ad4a41-11e4-4fcc-b925-fa96970d6f38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489087, "uuid": "45a9a6c4-f3a5-425c-9063-a98120efc37f", "value": "12288:wHWo3QzcsE0nfBYoT+oNmkivxZp6U3r3:IW/EIYoT+KmTzpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489087, "uuid": "70eeb370-c120-4ec6-b384-11a01303eff4", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489087, "uuid": "d6a63967-e52e-49f2-b109-7faabc2e29a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489087, "uuid": "41a00226-e38e-4161-bf29-c23bbe3e09ef", "value": "c2c509a61a1d811d29ade6067e54c011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638220c7-38e9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635533558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533558, "uuid": "b9517b4d-fa8d-4445-998c-8f7959566138", "comment": "Malware payload (Loki)", "value": "f9644cc2bef1b60ee2daa8416be83f31", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533558, "uuid": "28da207e-0c70-4445-a13d-681769fd1baa", "comment": "Malware payload (Loki)", "value": "8f2863a64b0bedc09de0340a81b4986410204ecf596586c12287dc4e4419b1e6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533558, "uuid": "27b56feb-bc7e-4ee3-843d-ac0dbb3003ea", "comment": "Malware payload (Loki)", "value": "95ec101ace65ab67283d28dfb6f2419bef1cb5e9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533558, "uuid": "d866f05a-251c-4b1b-bfba-1079432d8dbe", "comment": "Malware payload (Loki)", "value": "aea9e8b2b7f5f442225e0c5021e87cc23329a5e145a41dc483d07a71012e2fafce065967ae13daf7e6e654e418b2aead", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533558, "uuid": "ca79d85d-ece0-49ea-9f09-201541a03c28", "value": "T14B6423726050FDC9C18DF8050EEE90D4F432F5675D93FFB208474AA9A5BBA87D062A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533558, "uuid": "dae9847f-08d4-422f-a4b9-f9f8d978a9cd", "value": "6144:8fgNI6HDd4wQ2dzOn8s6hWTfrHnOndtVe8Mgb8U995Qp5FsIZoPWmU:GNAD6N2dKn4gzDOte8MggU99sjqO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533558, "uuid": "4ac97518-9848-40f0-a13e-df5578414f72", "value": 327137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533558, "uuid": "0a93bfcc-9f95-4323-baf0-c65b3d183b1e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533558, "uuid": "1c973df4-8347-4be6-8836-e954ed5bf073", "value": "PO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008f6a18-38fc-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635541553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541553, "uuid": "ed28da99-fb15-465a-9083-14b03b4f65bf", "comment": "Malware payload (RaccoonStealer)", "value": "f7e88ed3b68f345a2c45dedbc0eb911d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541553, "uuid": "c724f124-59c6-4bdf-ac4d-73a72cb41e82", "comment": "Malware payload (RaccoonStealer)", "value": "8f50e119ea2ca2bb94735c6d83138252b200ce6dcda443dbe8599a991bef320d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541553, "uuid": "4b72745a-0247-4c31-a94a-e8787dd7e1c8", "comment": "Malware payload (RaccoonStealer)", "value": "84c9a2dbed7437fd98c3747352b88d5a452d71a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541553, "uuid": "0ed72f30-8018-4523-af21-8556ab5572c2", "comment": "Malware payload (RaccoonStealer)", "value": "50b6be8c0d59eadd30922433b311ee95b60994b04a42e083a1c07eaa52457d4f6fbdec40b974ce4bb8280f52ec215f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541553, "uuid": "0421e90f-37ac-436c-bfc2-c68f516a5911", "value": "T1C2D4E100A7A1C034F4B752F889BA92A8753F7DA1677460CF22D926EE4734AE5EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541553, "uuid": "83e4d39d-0735-4247-9774-385ab07ec328", "value": "518d84bc9a231f5bb2827b0550b9f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541553, "uuid": "40016856-952d-48a1-96d0-1e218b88c4c5", "value": "6144:HUWbtRv3973CrfwEe9hSX+jzfDNciWNTcwM9p/Zx47X6ujC/N5SNUFDkwKbQ:HpJR1pHc+juiWhjMujC/N5SgDkwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635541553, "uuid": "09ca2285-5bba-4461-9ffe-677eea874114", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635541553, "uuid": "3a305324-960c-4d05-85e9-6ddfa1fc35ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541553, "uuid": "1acb5e6e-03e4-4557-9dd1-1ae35f262491", "value": "f7e88ed3b68f345a2c45dedbc0eb911d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2c7102-3885-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635490655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490655, "uuid": "99e86ac1-2e75-4add-8653-0b7a8394aee9", "comment": "Malware payload (RaccoonStealer)", "value": "946fe609f46a3053f4356a6df184c5e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490655, "uuid": "4b1aedc8-17c1-4e43-8e8a-43dad1855bb9", "comment": "Malware payload (RaccoonStealer)", "value": "9012e4c26b86f5dcc9a921462b9ef05e1621791d79698594db58085b60d5bc3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490655, "uuid": "01b9aff3-c455-4bfe-9d10-e0b5f31928b7", "comment": "Malware payload (RaccoonStealer)", "value": "6605737ddb9884469c634112087dd5a18cf20fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490655, "uuid": "a14a582d-679e-4c39-a526-c1bb020df0d2", "comment": "Malware payload (RaccoonStealer)", "value": "56cf4f52eacc69a26abef5806965c14f6bc00b44c997c9811eb8acb2358304cc49506c15dbd9b170a4436091d0ada382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490655, "uuid": "46c48fa7-a8cd-495d-92a6-a1c506417782", "value": "T176F41209B339CB6BF6BE07B940E3165503F6682233A1FB456FD638D61923B821E05D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490655, "uuid": "cc24cb26-3ba5-42c1-b0f8-deb0eb843cea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490655, "uuid": "0806d250-06ae-475b-b572-81e8162ad8aa", "value": "12288:RlfZxmOBp8xDqQJVX4z+rHNzgjHiMoVAR0+7SmUeDNcjh/APHtR+FH8RPSIw8T3P:RlfZxm9d4z+dgjHiMoVAUXedPHt+648D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635490655, "uuid": "fac368a1-fcf8-4ca0-8a01-c619f9d88b5f", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635490655, "uuid": "38d889b2-22dd-4aaa-a895-3add7f194e35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490655, "uuid": "1305697d-566c-4d4c-ac05-b2cef3bda3b7", "value": "6810825092 ISF - EMC ??? - Draft.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9400aaf-3877-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635484793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484793, "uuid": "edcbce86-97b5-4bd0-90ec-b6c7c2ae81fa", "comment": "Malware payload (Formbook)", "value": "ff1c94584214d5eef525a0d3ff196a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484793, "uuid": "e443a427-a383-4e92-a49e-369838ead3d5", "comment": "Malware payload (Formbook)", "value": "92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484793, "uuid": "d915911e-cc35-4b23-9e95-dc1644c29e2d", "comment": "Malware payload (Formbook)", "value": "64841f419c3d8bff98b1ada134ecb8d63be07ec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484793, "uuid": "10a2e0af-72d4-422f-aa01-503765122bde", "comment": "Malware payload (Formbook)", "value": "33b195afc3020a2ad7e56ef5e378dfb8a3af95ed461e7b56444a08a6236f743ac1ca61ea87b7e736749a261ea1ec0db5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484793, "uuid": "71a109a1-f11b-4d35-87ff-9feb41f7af29", "value": "T11494E04933A4F59FC05B8F3655921C20AA71B8772307C213A95721ADAA5F3EACF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484793, "uuid": "41774793-7be1-4bb1-acd2-2dff08f6da7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484793, "uuid": "ccb3d677-fbb6-4597-af8b-7223940b0f7c", "value": "12288:4BkQ43dOVRB08d5VU2B4oiDv9HlIrgKdjXtmy:4BUdObBpbwDIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484793, "uuid": "9ccd95cd-2395-49f3-9f26-98e444cfbd80", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484793, "uuid": "fc5c0098-734c-4acc-a9bf-f33ec895c585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484793, "uuid": "5e7187bd-084d-4909-9dfd-7f054764eef3", "value": "ff1c94584214d5eef525a0d3ff196a8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd262ea-388d-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635494089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494089, "uuid": "36223b0f-9ce5-4590-ba20-231bacc4b7a8", "comment": "Malware payload (SnakeKeylogger)", "value": "3f89456cee6f6b582046a7af62ef0c34", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494089, "uuid": "f02c28f7-8e53-4112-ada8-4e27ac59c1a4", "comment": "Malware payload (SnakeKeylogger)", "value": "92ebe7b28a99f11bdd1ad0552f6274fc54d0e1b84dfd99b435367565548fb8e2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494089, "uuid": "b8af72ab-875c-4902-b351-e7df9642d44c", "comment": "Malware payload (SnakeKeylogger)", "value": "a31207a3ddfdf3e4f4edf4823f027ae4330b8ecf", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494089, "uuid": "07a8f54e-44e8-4f33-b8ad-1210ee3f080c", "comment": "Malware payload (SnakeKeylogger)", "value": "d65f29e3d31be28136dac082928e7276984b71c255069589f3c8890edd735010da6bcd36d960ede01b950ebee35583bb", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494089, "uuid": "2678b6d0-31b0-4b86-ba76-eda621ca9709", "value": "T116542366B18C46B3F88CD9A201402C2B6FB5BA89C6404FE53E17A45C371DAB4DE9F178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494089, "uuid": "5bfa8647-0e4c-44ab-a352-e22da494b974", "value": "6144:PjonEHQkfN8lekaD//PUrMOiA4VCboqLz16ppL7TFMa6Rp:PjonyRN8oz/PUrMOiA4VCMqLx67L7RMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494089, "uuid": "e764681f-2727-4252-b1c3-583cb637a9db", "value": 279958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494089, "uuid": "9ec57de4-93d7-42ac-b772-8edaac80cb5b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494089, "uuid": "4aaca1b9-729b-49b5-ae78-0fada7fbb5b5", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a8f856-38d7-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1635525908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525908, "uuid": "c1aacb46-3ded-46dd-8b20-ab44fb44904a", "comment": "Malware payload (Stop)", "value": "b79d3399603938a695a98a75dcfbab91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525908, "uuid": "36887128-fff8-478e-9aba-311b738083f5", "comment": "Malware payload (Stop)", "value": "934690e391745fca58ca0df6d41952d6f58ed7b18ab8fdda22484b01eb262be8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525908, "uuid": "d82c717a-7b81-4cf6-b440-182006b35298", "comment": "Malware payload (Stop)", "value": "af9a85f2cc85cd3b040536c988aab45c237a22d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635525908, "uuid": "0720b723-1cad-4620-9bea-161105ad1917", "comment": "Malware payload (Stop)", "value": "d91bb2558613bac263d632f5ae4dcca4afde4d07ed7a14d3dede290624f5a8a314b28f4956c2f7efa25cb52d6f460646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525908, "uuid": "8e6ea932-52b3-41a7-bcde-773115559eef", "value": "T1C71502107692C034F0F212F859BAA3A8B63F7DA15B7465CF12D616EA8774AD0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525908, "uuid": "98c72908-57b3-4ff3-ba18-608531693f71", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525908, "uuid": "ee46e5e9-e7a4-4621-8551-5c019f0a4d95", "value": "24576:yYuSM7Gp8zSjQLCV9ibUqyuziiM95BxXEr:yv7i8zSjbVwB1ZM910r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635525908, "uuid": "4c5b1698-9861-42f4-971a-392ddfa5cd70", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635525908, "uuid": "a1dd0063-a8c2-43db-b9d2-76421e63d20a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635525908, "uuid": "a9727a91-a830-4a5d-80da-3ed3249f7c48", "value": "b79d3399603938a695a98a75dcfbab91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db857b5-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635485042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485042, "uuid": "7894f65e-f9b8-4d03-abfd-504938e9b73c", "comment": "Malware payload (Loki)", "value": "fd779cdaf48d63ec3a74744fd179aac0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485042, "uuid": "c71feca6-0919-4d31-91a5-d065deded2f8", "comment": "Malware payload (Loki)", "value": "93b125d3f2eb37ffe0bf570919fab7052b8c15814775691ef0602598af3cf328", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485042, "uuid": "5777a43a-6548-464f-a734-1479a176fcc7", "comment": "Malware payload (Loki)", "value": "32bef45edfc65c2f77f5d2c336540e958daedc57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485042, "uuid": "989ccaaa-7b43-4d44-86f5-0bef06ec9072", "comment": "Malware payload (Loki)", "value": "cbf53cab251af8cec7b33538df8fa11324d0414b228c06f1bedd15b7956c29253ea739d714840633130112cf5ce39663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485042, "uuid": "df1858d8-fe26-4fa1-8ba8-db0fe98b8ee1", "value": "T16E64F102572A5FB3D2AF47BA04A31AA013779D676C11D7DD1F84BD997EB23400E20AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485042, "uuid": "37833586-c9b6-4108-8dc2-a59fc28559e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485042, "uuid": "33a34644-305d-41a3-918a-1c0a53cbd8ad", "value": "6144:X1H4QqciY4aksmbdCQghe/qKfeMXEs/nA9UFth1:FYQOY4aksmbd1ghdKfeMXv/AeFth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485042, "uuid": "f5e48635-12c4-43ee-9581-ecdd8c2d72a9", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485042, "uuid": "5013a73b-d5ab-408c-8a9d-fc2102d99b67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485042, "uuid": "33ae7c5c-ada4-4c46-9778-756454ec9c8a", "value": "fd779cdaf48d63ec3a74744fd179aac0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5382c3f1-3888-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635491870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491870, "uuid": "103db0f0-756b-4f66-90cc-103a66df8440", "comment": "Malware payload (Mirai)", "value": "8c305137c8b025af33ac608a9b5465b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491870, "uuid": "5bc48d83-645a-4aa1-9470-abf358d426de", "comment": "Malware payload (Mirai)", "value": "93ca4f85d13c01834ae5b36d93cca17bd924dcbb9b238c7a3e2d51646d0c636a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491870, "uuid": "b3db75b9-70d0-4f63-a0bb-4b21664ed455", "comment": "Malware payload (Mirai)", "value": "4dc66a698ddbfbb1bf77a67af5c85b997b99a17e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491870, "uuid": "c29203c1-a626-465b-ad3f-b2b0579969a6", "comment": "Malware payload (Mirai)", "value": "96db8172b5267213885a6ef5c6fee0d6e79f65ba2976e8a1599236f7b989762af52867d11bd38ead0d4223ba41314434", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491870, "uuid": "5f988c54-252b-492a-a687-352e50270a85", "value": "T17323201A29725FEDFE5C92B0E773AE21AA0CA2D636EC8141D55CC5853E6060F708B7D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491870, "uuid": "94885acf-d08e-4a67-ae02-de5587aba045", "value": "768:JSLLLLLLLLOIqHAH1kJJ5hpnagnRqZPqtbKSWQiyn3Sb6G8dhDJ:W0TV3RqI8nyCb6lJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491870, "uuid": "141aaee7-f35c-46de-b6b6-7250dca16ed2", "value": 48272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491870, "uuid": "e0304cd6-2dfa-4987-892d-63791e7911e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491870, "uuid": "b3deeaa0-264b-489a-b405-f5874a52db45", "value": "8c305137c8b025af33ac608a9b5465b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b945b55b-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635526401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526401, "uuid": "bde16f7a-0c4e-48f6-9b0a-a5079b7adc27", "comment": "Malware payload", "value": "9b50011e2e440ce076593d979f5d88b2", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526401, "uuid": "4e086068-ecf6-4425-a3e2-a6f0110928b3", "comment": "Malware payload", "value": "93e3236b047c6ed504bb5d8fc19aefd24509fb3146e3b5cfb75d62da0815cd31", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526401, "uuid": "7f5ea10f-66ca-451c-af61-f62500920e16", "comment": "Malware payload", "value": "2483b34c8abc0f8366c7113a713c52029699c4d2", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526401, "uuid": "3508e17d-3691-44ec-9cb5-e007644a4919", "comment": "Malware payload", "value": "907b769498c238d6dfcaae6c983cfc92cb51cac3e9ea9e5ae149d29e44d6db84bcaca24a6b6df27a88d8e440bf4b5c73", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526401, "uuid": "f39bef26-f70c-4d85-bd92-5e5229bfeecd", "value": "T1A3C4F134ACFC0FCBEE21D17907099C9D69BCDDBB66C1C49B8141B786ADB03486CD4A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526401, "uuid": "d32e030d-5cbc-46b7-a14f-3c08f3bf05cb", "value": "12288:5lHdbeX+63jNjLbmgt0d3v7HL3HnE6wVDfXjxHIo8up9PLN:bleX33p7mu0djHL3HE6M7XNH+c9P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526401, "uuid": "17d7346b-1296-483e-9bff-5c3bac86d1c8", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526401, "uuid": "88778cee-a6ca-467f-aaf3-3f7c73042618", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526401, "uuid": "9fc1063e-2c6d-4b1b-a82c-85ef9f97bb4a", "value": "CONTRACT PROPOSAL NOV 2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62939563-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484165, "uuid": "88c1defb-ff48-4c3e-9155-d51a4320f1c6", "comment": "Malware payload", "value": "d6a45d44ebb847fdcc02caa79b8978e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484165, "uuid": "2ac56f27-a1f8-415b-a7a9-d22eacb5ae88", "comment": "Malware payload", "value": "94d48b36da50eaa8245eb3af323e0caa09cd919b18f0968acd5f7e6bdcac97d2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484165, "uuid": "edd7809c-d8dd-45e6-836c-5766760a90b4", "comment": "Malware payload", "value": "fd41275fd8e33c5612a4d6f6ac1bbf226163bc14", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484165, "uuid": "f42c8310-98a8-4889-84b8-53f9863a0939", "comment": "Malware payload", "value": "8c35f0f3ff5214b6725baa793c0bfe553e7aabe37b3d4751f95a07b4722eb1396b3b5d33a244f01e479988e028a36271", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484165, "uuid": "5be1aef3-c531-4ccf-b339-fccdd27c087e", "value": "T1C2058C4530C5B8E5DEA3C8C4F7968448F5BC7B75F90DAC42EA49E89039C4A33C93A976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484165, "uuid": "8e5fabec-42c4-410c-bbc7-2c04c6529935", "value": "12288:ObP2F/ZPuU8t4tWMqTefNfRELGUB5jyLhfteE51a9X1L4EiR6NBIqMk:ORd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484165, "uuid": "ace5922c-10b1-4788-a3a8-44ea3e70c353", "value": 825469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484165, "uuid": "6071eaf5-2260-40e8-b96b-0f0f3c8f04fc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484165, "uuid": "c0a85132-71d3-4330-8f4a-ee0e52dc36ee", "value": "INV-736478735_ Oct_28_2021.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f15c24-38a6-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635504808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504808, "uuid": "c385cae3-1bd8-43f3-b4c0-f46286533d01", "comment": "Malware payload (Formbook)", "value": "2953a7fb129cbb29a3f913e5e1f01d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504808, "uuid": "57280f04-a6b7-4b76-9fe2-c2318a1aef22", "comment": "Malware payload (Formbook)", "value": "9508c04b4c1dd578c8c3b8597a68bb73548b107edcbb37f13909a18d85f78b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504808, "uuid": "ae238247-bb9a-4da4-97e9-356d27bfd50b", "comment": "Malware payload (Formbook)", "value": "88cc356cf7566c6c5fff68821023c97f4c79d151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504808, "uuid": "1231f00f-0a33-4b4a-83f2-48b8e791600a", "comment": "Malware payload (Formbook)", "value": "9100c8270656dc8769afdaa45a3d2ddc7e3c540c6c228808e9f9c8f6bc6b336f3708079c976608913cb44691587ddd3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504808, "uuid": "e012ff46-7d5e-4c16-afdb-4754967a16d6", "value": "T12384F1496378876FE1BC43BC44A3262847F29D2333A2F7554FD678D62D23B814E11AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504808, "uuid": "259a2370-a05c-4a4b-bc6c-a91b8194214a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504808, "uuid": "3358ca17-4eda-4ff7-acef-f48fe3191eb4", "value": "6144:hlfZxQwz614b47d6f4Gz4K63CFWZ1Bx+ZG2/n+qQQkXcNO6U8t3Np0Pm3eZDPMRC:hlfZxbGBF2/n+TQecNTd2PpMRLJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635504808, "uuid": "b57e1be6-2a39-4e55-84c7-a4bcfde867d7", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635504808, "uuid": "97081c8a-4553-4c40-b5ef-c3aaeca862ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504808, "uuid": "bb7b78a7-3f19-41e5-8a46-0272a1361e4e", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb4a1eb-38c4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635517822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517822, "uuid": "39f6f60a-78eb-41ce-99ea-b1974a535578", "comment": "Malware payload (RedLineStealer)", "value": "3645676180db7e06664a53e0ac6317b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517822, "uuid": "d24627f5-29f0-4350-8b3c-b93cdd9eb33d", "comment": "Malware payload (RedLineStealer)", "value": "9642554127816b22f13288b6ae6b06f4ca66f04d1e8073bded6ad065f6147abd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517822, "uuid": "15e9a5c7-4d19-4513-aaf9-bcf1bdc55f62", "comment": "Malware payload (RedLineStealer)", "value": "caa35a080f3e5b2d7f2672b08533fae7350cb71e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517822, "uuid": "6f895950-fc9a-453f-ac85-b2e7f21290b1", "comment": "Malware payload (RedLineStealer)", "value": "7c8a02b7c95949c1cc48d2b3357c50c384bb9766b2a8919dda941b22006076609373b1351ffb92fd1aee0053ad3af0f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517822, "uuid": "c81d0cef-b19a-4288-8af5-768e05e43954", "value": "T12016232372294095D0F58C39C673BEF171FA07268B41E87F63DA5ED52A219E1E323A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517822, "uuid": "b93a19eb-1f50-46ea-af73-4b3acf1ee9ec", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517822, "uuid": "4fc707be-92bf-4c15-9343-b231060f3da3", "value": "98304:q74x9tum8OvcqReP2V827sYfB4qdSW/NdVlMEIOTGnO2:ZbtMqReP2VTvfB4slVdrMzOT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635517822, "uuid": "12328800-6975-43f9-ac98-d0615a2dc958", "value": 4361728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635517822, "uuid": "03182a37-0776-4e18-9d04-c90ce01ee9a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517822, "uuid": "8bc08642-97df-42df-b84d-aab4b300f9c9", "value": "Genshin Hack Impact.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ad9968-38a0-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635502073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502073, "uuid": "56554f71-c4a5-4fb8-8802-45b8261d17ca", "comment": "Malware payload (RaccoonStealer)", "value": "263df5ce4d960eff01ce28622b5169ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502073, "uuid": "1edb16bf-3eae-4775-874a-16b300a08486", "comment": "Malware payload (RaccoonStealer)", "value": "969038f4beda3d9d7040f8093970ed51e1f65e2e4684fe0d66023f1838f0f582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502073, "uuid": "e2e9e086-a492-453d-845a-afba549c649a", "comment": "Malware payload (RaccoonStealer)", "value": "0637bc6c7ca5fdb4dd6487f0ecb3e6eb07b87c36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502073, "uuid": "d1441455-d6b1-449a-9c79-40ed83edd654", "comment": "Malware payload (RaccoonStealer)", "value": "c37a792d8cd430d9a75892936d3418a799d12127eb255ed26939af852b15de5e7e09685fc710711a96187da1556a2421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502073, "uuid": "735519d4-ac01-4809-afc7-b5ccbee1f3f6", "value": "T10CD4E010B6B0C034F5B216F84AB5A2A8B53F7AE1677491CF13D926EE4674AE1ED31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502073, "uuid": "16d1f5f8-aaa7-43b2-8d53-881c4193351b", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502073, "uuid": "c6c5b79c-f3e8-480c-bf0e-096b13a96a88", "value": "12288:11tqfZxN9otEIreIawmbJa3cckgjcbidDSObtwUzgBeg8So++DZ:zwMRKIB+svkT3O9Ua+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635502073, "uuid": "47a7e3f1-8e12-4745-8f34-36f292863bb2", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635502073, "uuid": "d3cc214f-bf79-428d-8dbd-c0a83990337b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502073, "uuid": "cd7ff6f7-e077-4dfd-b7ad-42ed25e59ef0", "value": "263df5ce4d960eff01ce28622b5169ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fe85fe-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485665, "uuid": "fd39d864-1cbb-4712-bf48-18f7553abebf", "comment": "Malware payload (RaccoonStealer)", "value": "bd7d4b8cae273ab82b16df999b170f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485665, "uuid": "1516c2d2-0932-485f-bfe4-e13d5848c58b", "comment": "Malware payload (RaccoonStealer)", "value": "970c8955fa0b87bc2f8d0b2233bfd7b3c734b117c7970668a69501b64adc135b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485665, "uuid": "77be338b-54ec-49e7-a40a-f0e72093940b", "comment": "Malware payload (RaccoonStealer)", "value": "7211c6c660c8b51befb9f31f5571725cc0d4c08c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485665, "uuid": "c29752ec-c1ba-4f56-929a-50980ea68ee8", "comment": "Malware payload (RaccoonStealer)", "value": "c31a96a234986454535ece0fad619f95b3be075b2d1b4e61d3c43535bdfa154e0607ff273fe8856d8620d60a38cfa0df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485665, "uuid": "9b09c43f-b7fd-4ce0-b99f-cc4152f58b27", "value": "T1BBD4D0006AA1C034FAF712F859B6A268793F7EA1A73490CF62D516EE47749E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485665, "uuid": "ea91af01-f711-4fd1-a347-647c04738c4f", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485665, "uuid": "2653536b-a30e-4ecd-81da-88da5d29b8dd", "value": "12288:CclPFj5MrXc2kfq5ZlWNVC9wp7g7YX1oRoQ98G/raD:flPFir9kfQWPvpzat+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485665, "uuid": "20bab092-a5e4-4ea2-8fee-a0f14b8b604b", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485665, "uuid": "396ad8ae-f5d1-41b8-ad3e-17094960c181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485665, "uuid": "40979162-f24f-4622-b7a5-016cc5288835", "value": "bd7d4b8cae273ab82b16df999b170f8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8169da-38e6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635532257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532257, "uuid": "23cbb0d3-b3bd-499c-8ba7-4dd66f7c0e28", "comment": "Malware payload (RaccoonStealer)", "value": "8818391d57ca5a53b7b0b347d506c266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532257, "uuid": "c29ad182-9b19-4bba-9d07-440880c94884", "comment": "Malware payload (RaccoonStealer)", "value": "978079504daafe2dd8e87257014312e1a9feee7577e2238b524c3ff70ae94b3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532257, "uuid": "7db7b354-860e-444b-b0e2-3fbed0dc686b", "comment": "Malware payload (RaccoonStealer)", "value": "6ec87c1552032231c5d359527ae2222981c296d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532257, "uuid": "3877ed24-28fb-4522-a6f3-c1e971de88a9", "comment": "Malware payload (RaccoonStealer)", "value": "d792b6242bfc7dc6f68dcd6061072a1d3d1e32911d18e8c6f6ae970380b03b79d267b0f99b14cb4178f8b8b99c60faff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532257, "uuid": "2f017562-c1b7-43ff-892d-052019c44c83", "value": "T148D4E000A6A1C034F0B656F849B99768BA3F7DA1A73444CF63D526EE8774AE1EC31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532257, "uuid": "8e576bef-fbd3-4fc7-a180-257d8cdd9d18", "value": "5243e0b7a8cb0f582099146f832c26e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532257, "uuid": "dad6a374-50f1-41c0-a101-1f0f36813071", "value": "12288:7bsSPrGGKfVHYKXv/XZb3xW9FHqklqzjbDd1S91Pk4/:HsyGGgXv/XJ3xqHqvX61P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532257, "uuid": "2a239341-b4ba-44fa-8151-251aee3a528f", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532257, "uuid": "a5e1ff90-735c-4332-a6a5-589729001177", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532257, "uuid": "9c2452da-6fa2-4f4b-a8ec-1ec64fd1c221", "value": "8818391d57ca5a53b7b0b347d506c266.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c67a702-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484262, "uuid": "e5c633b1-7e7d-4919-8847-6b70f8e9b863", "comment": "Malware payload", "value": "b180192a35432ba9a8a96c14dd690955", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484262, "uuid": "65be77c9-adde-4e04-a790-eb41a3e9601a", "comment": "Malware payload", "value": "98149ddf070f30f844fa54cb7f5450d45bc6cd2f52e2ebe4279e98fd6216100d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484262, "uuid": "a4d862fd-fe43-4136-91f7-356a4f53305a", "comment": "Malware payload", "value": "1f586c1ed1c112cd6bde4c271c4ce0859b519352", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484262, "uuid": "a4287b8b-08f1-4f90-8097-f242b5dde97f", "comment": "Malware payload", "value": "4715c842d36a3b8d36dd9f4d65c8d1f44b0ab43833190aa7ac6f26d456217ff67d929a9ff31f25ccfeee7580b2bf6b56", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484262, "uuid": "02154589-fa5f-4507-ae3b-b3427b153b48", "value": "T1A905040466D570F51A93C580B97E1684D3B93B2DB548ACCEEAC2A40039D9AF3FD37936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484262, "uuid": "938a1398-a40d-414d-87b8-a92763cbee98", "value": "3072:b1smkzW7XMZjpvd4OkZrJN1Kw+3vF1Ks/rZWvBdLqYylllllllQlBllllllllllI:bWmvMHV4u/rZWvBdyeFEnDDS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484262, "uuid": "efd5ec5a-d77f-4385-a200-f87e1f9ab359", "value": 830019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484262, "uuid": "1f258b2b-8904-4333-9792-64132b6010f7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484262, "uuid": "3e663649-09a1-4fb3-a0c5-3d70f8a8e2f7", "value": "ATY000000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff0e508-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635526358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526358, "uuid": "d947bc5a-a89c-4f63-8dbc-ab6cd498792e", "comment": "Malware payload (SnakeKeylogger)", "value": "157689aae1a3a3ef0c47ba81d0b2f822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526358, "uuid": "6a2ed210-bc8c-46d0-b6da-d1679fe5da96", "comment": "Malware payload (SnakeKeylogger)", "value": "981fb1e99ff5258ab71ecc5991e216dd4d2cac65c7f7c24f9c14570dc4686916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526358, "uuid": "9c730b5c-3c4c-40e4-8b90-1a064850fb9f", "comment": "Malware payload (SnakeKeylogger)", "value": "bcea80ba01074c7d825f080a8862d4640b3f3b33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526358, "uuid": "780bf236-eaf9-4c6d-9005-566bfc444e47", "comment": "Malware payload (SnakeKeylogger)", "value": "24598dff81c5b3138bebf54dc2cbc5178a349ee399b8ec8112bf34f5dbc59963a74dd6f245e7b5de630b98dfda36d3a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526358, "uuid": "abdc2852-a47d-4a88-8aba-7ec41f1e3d43", "value": "T1F6F4F5A1E1400159E2210FB0398686BCB6A41CBF1FE3817D7962F715B57D1F3CA69A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526358, "uuid": "f16b9fda-4562-487f-92a9-d434638c08d5", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526358, "uuid": "af353bff-a7a5-4983-96e1-71dbcaec995f", "value": "12288:h/ld/SAVc/V5mkKhgyY/5X3qdIpKivdZZGiPW2PxHaUrb8dRdXRK9JM6m:Fld/SAVc/V5m45nqCpPXy2gUrbmQeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526358, "uuid": "79a72d7c-1c2e-4395-8f23-c04b9a9badd3", "value": 741014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526358, "uuid": "1e2a0cc8-b18f-4a3d-bdf6-33069d937c9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526358, "uuid": "24ee27bb-a57a-4f26-aa50-97ac43e63f1e", "value": "230987654312345678909876543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e019028b-3898-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635498978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498978, "uuid": "d58c5f48-5ed4-48b1-81d1-31bca82c4d50", "comment": "Malware payload (Formbook)", "value": "8980a24aeb5d63283add48c1391ebc40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498978, "uuid": "9e6f7478-6bb7-43dc-8807-7265847fbebd", "comment": "Malware payload (Formbook)", "value": "988bdc2407982afc0484bd010bee96515d2594d4bd770453c3a74812633075c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498978, "uuid": "51abbfbf-bff2-4994-ba99-2532777b98fe", "comment": "Malware payload (Formbook)", "value": "724825e83b8df65e7af7d39828341f6c92888645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498978, "uuid": "01e5f532-23d3-48fb-b147-fde754bf2d9a", "comment": "Malware payload (Formbook)", "value": "6e00844065d45c8b758397e1b56d822759588aa99fb7085cb2428e69b7411c32c7d4c3a7e1c5dd6da1cfbe7c7c62cbff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498978, "uuid": "9c1e358b-3d71-4106-9db7-06170ff0721b", "value": "T1F025AF92B7D0A43BC0326ABC4E0593E76811FE542529BCC7BFF86E4D5E7B140B829563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498978, "uuid": "689b2f6f-4448-4de6-874d-fa1394344262", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498978, "uuid": "60b6cd13-13c5-475f-8bfe-2ffc195b3c83", "value": "12288:qXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4Jt6NuLpjqayC94M0LdEegD:q4uBfTG2pM9o6NN+swhY4qMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635498978, "uuid": "1e56ed5c-b630-4abd-89d5-a0041c0f0ca9", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635498978, "uuid": "0bb5cd01-da82-4d06-a96b-8d3d3bf779a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498978, "uuid": "a8d40ef4-471a-493e-8c84-56d6b3c5e4c8", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8d9afa-38c1-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635516476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516476, "uuid": "d22d3742-f0e4-4596-9e3a-3a51081bb241", "comment": "Malware payload (NanoCore)", "value": "4c342f040ad8b94e4f814e1f62e488ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516476, "uuid": "8c7e390b-67ec-4c1f-ac35-e6502651e384", "comment": "Malware payload (NanoCore)", "value": "988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3dbd13c87a506bf0e97b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516476, "uuid": "d95aacad-c86a-481d-a0ca-d9a1501df400", "comment": "Malware payload (NanoCore)", "value": "f440ce00e772abd74f9e9e0ff8d227792b48712c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516476, "uuid": "418e5951-9779-4960-bf4a-e56d505748cd", "comment": "Malware payload (NanoCore)", "value": "1f96761b07ec83e5a2f10c4b76eb0cbc3bc1dfb31260813b3f3947e64cae34cec09bcdc84d1c20b631054c910180e0e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516476, "uuid": "275a444e-2d3c-4c92-b2dd-27f8fedafeab", "value": "T14414C01677E98A3FE2DE86B9611201124379C3E39DD3F3DA28D414B39B663E50A0B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516476, "uuid": "7d8445d6-7da9-42bd-a362-41625d5e14b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516476, "uuid": "3fbd5c21-4e80-4f77-9019-cd1bb8d09b2c", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIQHO1RxN+dAu8imqhVPd63DfOB:sLV6Bta6dtJmakIM59wC86hV1UfUgrTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635516476, "uuid": "c415088f-2e28-4980-aa59-b14fcb63ce8c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635516476, "uuid": "2c37d782-ee7f-4656-bb91-52b1110cdcb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516476, "uuid": "10c5c724-fdce-4951-b744-5f7e72c5875b", "value": "988c1b9c99f74739edaf4e80ecaba04407e0ca7284f3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84640b13-3892-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635496247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496247, "uuid": "d11b29e8-9579-4e3f-adf3-c53cf584c87e", "comment": "Malware payload (Loki)", "value": "cd848603273b1d0f6227a7ef17180cc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496247, "uuid": "f694ea63-a5de-435f-92f7-ae60e72f5266", "comment": "Malware payload (Loki)", "value": "98ed85bf441ec79455c8f951b8f248c98a67c4271aa8890efecb6cf8fd60e773", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496247, "uuid": "8920f590-4266-4767-a13a-3b36721eaa8f", "comment": "Malware payload (Loki)", "value": "bfd18a52145c28096e64dc5505966370caf2371d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496247, "uuid": "518d484a-2f53-48ed-a506-dc6ae8ec98ac", "comment": "Malware payload (Loki)", "value": "a2104813f0046dfb6f8962cb0d7d2572bc5289c7036d718d04e107b5a92fa721b687f7c49ceb5bd0c9ebd0f049d1c021", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496247, "uuid": "ba9870f6-baf1-49e5-834d-f7cce91c0259", "value": "T1E084C00023E5A926C7BA4FB608B310501BB16997BD22D74F1EC970DD2ABEBC51D50F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496247, "uuid": "743da207-32df-43d4-8b16-160aed1b172b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496247, "uuid": "bb3bddb8-49b4-4f47-b274-415a8dfecd0f", "value": "6144:P3941IFywPpuBQL3nqN1d3ydBzkQfeqiyzyKy73KspIsd9/ppbhULj9W1nnNN:/94iv4QLah3aefKWHIsdlbhGWNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635496247, "uuid": "816b942e-aefe-496d-acff-9aa7295538ed", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635496247, "uuid": "3a6d3663-a975-4e56-89cd-95fd56e669d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496247, "uuid": "a5212ef0-9f83-41cf-8e87-0a8d8d0d0ec4", "value": "cd848603273b1d0f6227a7ef17180cc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9031aca4-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635526332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526332, "uuid": "40f82687-aeac-4faf-b120-782aa3d5fbe2", "comment": "Malware payload (RedLineStealer)", "value": "7e2f3d7889b939a65e5bc53ecde9cd2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526332, "uuid": "9ba7b42b-d2e9-4e30-b4b3-7db2a832eb60", "comment": "Malware payload (RedLineStealer)", "value": "9917286599113cdded07839787cf574da809971a9de87af2c3dac26b73e53644", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526332, "uuid": "699e9676-2891-4995-b6b9-636b3bca893c", "comment": "Malware payload (RedLineStealer)", "value": "82ee84dc9ff7506682a394fa640d3b4bfb6b92f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526332, "uuid": "78e33fc7-551b-4132-8080-6fd7ee39a698", "comment": "Malware payload (RedLineStealer)", "value": "2e36085f56085166b5e19cfc93589a45776056c892b03021fb59de2823632b4055177ec8b3149a149de9ae83479d0d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526332, "uuid": "a991357e-d2c3-4144-87b3-02e31df3f24b", "value": "T17D94BF00B7A1C034F5F212F859BA9269B53F7AA1A77490CF22E516EE46786E1FC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526332, "uuid": "f9bcd7ff-5b34-4d89-a8b7-7b4cc5100e32", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526332, "uuid": "a5cfeab7-786a-40d2-9c15-425ef6e9f297", "value": "12288:vgN5svqLFeFSQ00dBdjmvraGT+M4xFGb:YNWvq5ep08vjUUMWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526332, "uuid": "0e4d3a04-b818-459b-8006-f0c1ede9bb29", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526332, "uuid": "7513f615-58d7-46dd-abd3-24b40bf9e9ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526332, "uuid": "ba18d897-68de-40da-a9c5-86232bc3f6f3", "value": "7e2f3d7889b939a65e5bc53ecde9cd2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9167251a-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635494981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494981, "uuid": "024a8616-2992-4202-b1f2-53ee2ebb1eef", "comment": "Malware payload (Loki)", "value": "b401c47efbcd7b41dae4bc47ce4fdc43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494981, "uuid": "348192b6-4da0-4967-9a66-2a362725118a", "comment": "Malware payload (Loki)", "value": "99d9efe5477edafdec137e05fac1b92e37a4a2fde0d65d80859fe0fb046620b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494981, "uuid": "10bef2dd-ac20-402c-8fea-358576b49500", "comment": "Malware payload (Loki)", "value": "ce2881bae7b9974e3b4037d946becabb8ce631cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494981, "uuid": "75d9be76-31b1-4aa0-a62a-333510b15cb8", "comment": "Malware payload (Loki)", "value": "00a78cb209f90a8be998ad5073cd7213b978dc857a304103cb37c95d26f06fec5cc3fcc208de54410faa3f5fa2729811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494981, "uuid": "e5b4e6f6-ab92-4213-8f7f-d2d6e41f4fe9", "value": "T10C74D000A3F81BAAD2BD83F8287211501BF63D5BB232D74D4E8570DE6A72F854A50F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494981, "uuid": "3e0803c8-d3e8-4dbe-8d07-62219c952e72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494981, "uuid": "2ebc2c3a-4fbb-4ace-a06f-b90b35c0a333", "value": "6144:0WczQpudQkiQZcH2r9XMTLD/9uqjdr1b+d5R8bBpadie7U1O1h/jG:hOQkCHYXMp/hb+7Rss7U1kjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494981, "uuid": "20f5d216-17c4-44b1-b72f-e4116fd43a44", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494981, "uuid": "7c421b06-b2ae-437d-a9f7-3d39c672d808", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494981, "uuid": "b04dc484-ee3c-462f-8077-c2726beefd7e", "value": "b401c47efbcd7b41dae4bc47ce4fdc43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fb6f6e-38a1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635502726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502726, "uuid": "4633e8de-5c8b-4ae6-a3f9-e01fa2089d24", "comment": "Malware payload (Formbook)", "value": "6dfcb41ce4cc51a4c8ea418960b45c0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502726, "uuid": "538b5df8-ae6e-484e-b453-4cab33011f2e", "comment": "Malware payload (Formbook)", "value": "9ab16c3b0caf257f8652d17d642c53cf2e8056f38f32f091fa23d6acfa4d5b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502726, "uuid": "1128642e-05ed-41c4-a39e-2e1a18e24087", "comment": "Malware payload (Formbook)", "value": "898c4721b6e4593cbe0b88dbde8c152bc8a87a55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502726, "uuid": "57fa0d0e-f445-4656-9e1c-c4f5a91c3c0d", "comment": "Malware payload (Formbook)", "value": "e5cf023bbc103a0ea902d4f0634ddcaf21e0bb6ce10ff8025f1575d1b5408d3963b21772eb81c8ab61e7715f7cc90a09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502726, "uuid": "bfe84588-128d-4d90-9bf0-ed109c76a15c", "value": "T104C47D48B100A5BEF816893189D73D54DD18A8A2460BC642677F239FBF3F1D68F0D5EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502726, "uuid": "f33b05ec-1f87-49c2-822b-a33c3b4a35b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502726, "uuid": "abbf1dcc-134f-40fb-9f47-d8af05ad5f02", "value": "6144:Qz/dU0J0sHpQZHroUBn+lV5PqW5+nL2krhPRMBLDG6smdhTXyCkAw:+DJpQZHP+lWRLreDHFfXyCkAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635502726, "uuid": "43ad63a9-cf92-4b4e-8f9a-573e4bfb638b", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635502726, "uuid": "84ae9b4c-2a89-4182-82c9-ac3a9837de28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502726, "uuid": "0648d64d-628a-4b28-8ac4-b197f6d75d36", "value": "ArD5nO3F91myqTV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ba5984-38e8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635533191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533191, "uuid": "f8d042f0-dc2d-4dc0-ba89-842adfd3abfd", "comment": "Malware payload (Formbook)", "value": "29d0ed1ca60e07577f03d4a17b598d67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533191, "uuid": "641f85d4-e771-4fe4-b179-a71232477eac", "comment": "Malware payload (Formbook)", "value": "9b4ca94ec5ec101754d54a2d73aa5f84fdfe97bc1021d166f07ddcaf5482c059", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533191, "uuid": "30ac9546-8832-4b50-b246-8cd0158418f6", "comment": "Malware payload (Formbook)", "value": "c7fca7d19543a29ad4d84ca352e0c2f914625f67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533191, "uuid": "8ae1b1de-165d-418d-ad22-7c144deb7c19", "comment": "Malware payload (Formbook)", "value": "4587c3ec565bffd666c926e03153e76b76976c9e78808243c661d27e1856da95a8626926a8e75e0f95e1a6a89a22f3ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533191, "uuid": "2eaa1267-684a-4dbb-ab36-cb41944cb0a4", "value": "T19A257D3367C4C435C1226FB89D0BE259542AEB117D18EECB72F96E0D9FB4640346B9A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533191, "uuid": "1914734d-284f-421e-9642-3040867d0937", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533191, "uuid": "7e6a1ae3-39f7-4636-9279-2a4a2b810b2a", "value": "12288:qXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4JN6NuLpjqayC94M0LdEegD:q4uBfTG2pM9o6NN+swhY4iMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533191, "uuid": "2d4c05e2-091f-43e9-8f0d-bb4282b58d49", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533191, "uuid": "862d1eca-c7ad-4b14-976b-f78886fb5bfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533191, "uuid": "5b0390c3-0f0a-480f-8d2c-12a326c234ee", "value": "29d0ed1ca60e07577f03d4a17b598d67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6844ded6-3884-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635490187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490187, "uuid": "c5353c3e-a479-4f7c-8da5-229a8ffa00af", "comment": "Malware payload (AgentTesla)", "value": "9071a6eb601e080a5a1ea0ba97f98d8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490187, "uuid": "93e4ad85-296b-4045-bbf9-d0b5749ddcec", "comment": "Malware payload (AgentTesla)", "value": "9ba8db97628be905d2a7ef778cf60b318676038ccbfa5d2eddd6272da4b76026", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490187, "uuid": "29d3cab4-f5ed-44a4-a01e-88400207d767", "comment": "Malware payload (AgentTesla)", "value": "e8c29a077e9d402d6698803647d109d2613662d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635490187, "uuid": "359fd55d-a08a-4a41-9e33-0762d44d820c", "comment": "Malware payload (AgentTesla)", "value": "1e186cbac4b4e95c038965f10e4a21af6ddcc33e7117d68e8a8e51fe9df99347d5e14c8137beeb39da1f9e09979566df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490187, "uuid": "8f98c048-745d-4773-bc62-39914f20e281", "value": "T1638423DF26CDCABDAD9EB376B527CE608C1FB742C64F9CA6255D488350F124247824B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490187, "uuid": "b59b379c-61f9-40ae-9367-1153a93b6553", "value": "6144:KCmLfRwaZY1nlWLiP+NEtcT8E2yiZBShyoIVQnMMhQstcJLl/L3zzqfJT+QRjeq0:mzrZYDBE2ywBjNVYMPLlzDzqfp+Cns3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635490187, "uuid": "f11127dc-0aff-4365-ac43-e46690a4018d", "value": 385889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635490187, "uuid": "686ea681-1f80-4418-b2fd-728a510274a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635490187, "uuid": "35e0db10-5d15-4928-85b0-210e3a8f3232", "value": "TRANSFER SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c6958e-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635526742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526742, "uuid": "189aed9b-66af-4463-af8f-642744e56268", "comment": "Malware payload (AgentTesla)", "value": "3833334c64b6ccd819567f72994f5d4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526742, "uuid": "6ce89a8e-c899-4ea9-81b4-2502182b5b39", "comment": "Malware payload (AgentTesla)", "value": "9c03a313cb52c3b349503693e9266f341ae9028fd82636c19cadb261a91d463c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526742, "uuid": "32d4dcf0-81e0-43f8-8314-d26680e5a317", "comment": "Malware payload (AgentTesla)", "value": "f1a6da967a2ed912006bbb5c98a6399f7c4a1a0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526742, "uuid": "1815d683-bf52-4afc-83c7-596a1d7ced5f", "comment": "Malware payload (AgentTesla)", "value": "d561774f8b63597b688248658f2ae9629fb04da64bb1fd4a14ba76b7f8498e5aed143a9c6b56e6357206af07a22dfc4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526742, "uuid": "082920a0-d464-4d2b-8419-87279c9ef057", "value": "T1B997F1566378C76EE8AD03B94096036583F6EC337261FB458FD634DA2967B810E01EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526742, "uuid": "e5bb3987-f4d8-4df1-ad83-849be023e2a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526742, "uuid": "ed425a60-8ec4-43b9-8a7f-eddf94759c49", "value": "12288:8lfZxIgBHdgbxQP2SvKEESYdBjaGFff1Cw9:8lfZxIsARBhff1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526742, "uuid": "0c2af49b-8799-4fc1-b72a-2e4ec4229644", "value": 39845888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526742, "uuid": "00d090a9-0dca-405e-b8cf-9fa286f322cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526742, "uuid": "fe1e0a20-ee46-402d-bb65-daa80d499ad6", "value": "0093466437_doc.xlxs___________________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b36bb16-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635530162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530162, "uuid": "c7964659-ec51-49cd-b9fe-1709ce35bbfb", "comment": "Malware payload (Vjw0rm)", "value": "710d04f2b665a976dc04f18b9f4fc53d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530162, "uuid": "2eb919e8-c853-4004-be2b-f2c8565f6bc8", "comment": "Malware payload (Vjw0rm)", "value": "9c111033a03c672c6ef87785e496662b34f62a729d59d55e0b75f9d8d3ef2134", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530162, "uuid": "c3c75b31-29f2-4258-84fd-8d7f9cc7fbb5", "comment": "Malware payload (Vjw0rm)", "value": "4014300822d8e2f8c61e17db04801fc7ee65f28b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530162, "uuid": "c25fc263-f431-450a-9c5b-9c15d70acd76", "comment": "Malware payload (Vjw0rm)", "value": "dbc5dd38db082395e24a9c47a40e8bf2c43063a2057f02c2b1622089d93286e732f9122446648d89dd17ea01b0b6165f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530162, "uuid": "ea2eb2b4-791b-452d-a8ce-34f573134f97", "value": "T133838001BE801D47B5B4D693409D0434EE19E2FCCF6A646ED091DACC1EEFA4B6B87E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530162, "uuid": "d8f4cf7a-411a-423d-8643-5a91ed13239d", "value": "384:LDgD/k07rs4zQBX8A9dq7xoJwX+nLwi8ebuxNRwj/qRwj8A9dEiHxL8e2D/g/2/K:Td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530162, "uuid": "bf685d75-dc76-4123-aabd-92dd4cbbb6ad", "value": 88044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530162, "uuid": "7fce9248-a80f-44d7-af06-efbed360707e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530162, "uuid": "6595dfb2-5f33-40f8-b885-2cd397755a24", "value": "716524_Payment_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d439bf-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485251, "uuid": "4ed032e5-47d1-4d0e-bfca-0f5193234cb8", "comment": "Malware payload (RaccoonStealer)", "value": "6558d3edf2ee872c304e45ec8075697d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485251, "uuid": "61aaf722-a06e-4020-b878-c562dfda2684", "comment": "Malware payload (RaccoonStealer)", "value": "9cd5cb0aca7d94e27e3e440d9e78efda374a61fab79c1df78747c448660deec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485251, "uuid": "c2a066b0-d496-4022-9efc-c37cdef4a7c6", "comment": "Malware payload (RaccoonStealer)", "value": "830fcf90a70290b0b8cdc78b62c987a29c3c3534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485251, "uuid": "6c637acb-d964-421c-87c4-0dab9cfc1b4c", "comment": "Malware payload (RaccoonStealer)", "value": "34594b67cd014a0142b39984a966af2f4977cd09e303b6a3d0a7b1f401618de83018f47a03bd5368573236440c34e9d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485251, "uuid": "4654fcc7-08cf-47fb-bc9d-23d293c3a13f", "value": "T10ED4E000BBE1C031F6F612F449B59269A93F7EB1A73891CF22D516EA4674AE0ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485251, "uuid": "867b955c-32ac-48f1-874b-cf7f5136cede", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485251, "uuid": "0a9a5fe9-e024-46e7-be19-2552000dbf69", "value": "12288:n4JaHTh3BTzW4rtPxZApYZ2xBrScZ0ZGLBYUGx/:4JMTh3FZ77Z262QkGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485251, "uuid": "5d223919-7a40-42a7-bd91-2b1bf29d9327", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485251, "uuid": "b4bdc4d2-3d64-43b2-a890-916c36f1b183", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485251, "uuid": "48b38108-1ee2-42f3-9289-46a9378d3196", "value": "6558d3edf2ee872c304e45ec8075697d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236b4e2f-38af-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635508540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508540, "uuid": "dd49d49d-1386-4106-94e5-9112566a09e9", "comment": "Malware payload (Formbook)", "value": "6a1c7256d8a418c11e20eae8d25ebf9a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508540, "uuid": "81695f06-660a-4f4d-93e3-b9f8b03488bf", "comment": "Malware payload (Formbook)", "value": "9d669c62373e85e0a950edffebc9e17eb682708192df5d05226590a822f81486", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508540, "uuid": "e3022b32-7de7-4203-8515-5d68f9deac2f", "comment": "Malware payload (Formbook)", "value": "324fabcdba9c53b253b0942ab5c3c0e2b27c8ad6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508540, "uuid": "03ee1209-7ed4-4cdb-b01d-7702f1279de4", "comment": "Malware payload (Formbook)", "value": "2aa2ded5760e0710a0425ec9b9d5071df2a9b314a01be9622c4586587cef221176ebe817a195a2382304d4ddbb8c156f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508540, "uuid": "e6e00f86-b495-4a21-91d6-64185c072502", "value": "T1666423AC889DF8C317A948A833D87C56467FEF713AD46464E236B384CDA933F49C2255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508540, "uuid": "a11fa173-76d3-4bbf-8c57-db43b35934a9", "value": "6144:2wTe4hUtUVqoUacnhnG8VWoqkr7dw9Hi6IPVnm4Acjzzj9kpBEwPw+:FtcV/VrpryHiFPNdzz5kpSH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635508540, "uuid": "0ea61c35-5eaf-4b3c-86b9-37855cb12e19", "value": 330939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635508540, "uuid": "d9feebbe-206b-418a-9ccc-c31bd3e31856", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508540, "uuid": "37f2fd6e-d971-4546-8deb-1c5152f7d91e", "value": "T2812A.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee3ce40-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484105, "uuid": "2d026d4e-2db2-42d2-a8d2-44c83c5234ad", "comment": "Malware payload", "value": "a0c1ca01548be7690f2976742f068e67", "object_relation": "md5", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484105, "uuid": "5becb1b7-d569-40fc-b8c3-a6f086df1880", "comment": "Malware payload", "value": "9d6fdb5344f64e059043980c5bb80e9c8986f1a5a62d7d7871144b388df65262", "object_relation": "sha256", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484105, "uuid": "d0315368-400f-492e-955c-4cfdca735475", "comment": "Malware payload", "value": "e8226dfbb2c055843dbd11547ed8697a1e1ae825", "object_relation": "sha1", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484105, "uuid": "d1c498ad-b9e8-4d85-863d-a764ae760358", "comment": "Malware payload", "value": "aa2286325c8c5169fefc06368e7e8d63d28cb1693b17fdb4471f32df9fbb8d91e8fae3ed7509d28badc28a6377b25b02", "object_relation": "sha3-384", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484105, "uuid": "ef0bc11c-0b16-4fd4-85f7-2b9b47babd8f", "value": "T122A290A4C75AA469C2B7AE7D404904F1611AF942D786FF1F3980FACC099099F073B7DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484105, "uuid": "8b2ac79a-6a20-4435-96b7-ad5e2200aafb", "value": "192:8xB4MFv6PaJwa7Hs+KmIUBfIJL2V++lNhJ8xObpGUyeaHu8LmCKminVN4arzIIWb:IjyPaTskgAc+HD1bpBypusKIQstlX6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484105, "uuid": "728eb09c-d839-4d5f-abfa-d35b8ca20b4b", "value": 22821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484105, "uuid": "755061cb-effb-4cc8-bf1f-b050c340b867", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484105, "uuid": "4067aeac-5eeb-43c3-8335-13dc406a537d", "value": "9d6fdb5344f64e059043980c5bb80e9c8986f1a5a62d7d7871144b388df65262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34c46e3-38e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635532860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532860, "uuid": "92954d25-be2c-44f2-a613-cb122ef20344", "comment": "Malware payload (Smoke Loader)", "value": "b864dcc03681fba0bbf15c3a2fb07715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532860, "uuid": "0c3deadf-d152-463d-a51c-6726d95db633", "comment": "Malware payload (Smoke Loader)", "value": "9e37e5652f551a42d1ed76bdddb1d6be9fde92c235270a38fbfde7f525a7af66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532860, "uuid": "5ffd592c-7d6e-4fd3-802d-e7f4c3d55671", "comment": "Malware payload (Smoke Loader)", "value": "377064174da54b81afe00853fb6474e83547c6fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532860, "uuid": "e365af3b-1ffa-4ce1-aac0-8601b477298d", "comment": "Malware payload (Smoke Loader)", "value": "c991829172ea69acfe15fc410760026ee9b597f87b1abff584e09fe1845194c7766d8d8a92b12bbbe09bff903e0cbe00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532860, "uuid": "659aee3a-2502-4e2c-b532-e4ca1dfb09f4", "value": "T160749D10A7A1C035F4F212F899B69369B93E7AB1AB7490CF12E516EE47746E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532860, "uuid": "6b9a5432-566a-4516-9bb7-f83ac0054f40", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532860, "uuid": "1bd2e449-833f-47f1-a32d-2d82270d00bf", "value": "3072:qwdBNjy106UX9O+02TB3l04UlWg0PSz83KZQ46CMkIWr/cMh4YnsYc6wONyzKuHO:hjTR0O3y4UlTG6gCMq/cI6Yc6w4Ilzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532860, "uuid": "b62857ee-f902-425e-b190-0b26589406ae", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532860, "uuid": "d16e543d-3ab9-4cdd-b3e3-54335bb4de35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532860, "uuid": "8f37a54c-e345-4556-acab-3ac09f0ded28", "value": "b864dcc03681fba0bbf15c3a2fb07715.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3334405-38a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635504567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504567, "uuid": "ff82b9ac-3212-4095-a116-76a315e02611", "comment": "Malware payload (Formbook)", "value": "58edad2a0b7bd0c5048bd95c93272f93", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504567, "uuid": "7533b148-a740-4181-9275-87b79aeebb45", "comment": "Malware payload (Formbook)", "value": "9e5c300f78e216ccf813deabde818bc1279627e4a605258e657a4049af94c575", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504567, "uuid": "b098928a-9133-461b-969c-682705e0c448", "comment": "Malware payload (Formbook)", "value": "4fb040d2d994c9cdf2d8e473af6b77c199165f1c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504567, "uuid": "d80d3619-d789-4884-9110-18d40c6adce0", "comment": "Malware payload (Formbook)", "value": "9ac446e2e31ca368996996bc5bea4277b25d4f29acee51730473b7a6c833f609397f5bc6d0c857cc2e362d3ccc80fb26", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504567, "uuid": "f1d6b211-c993-4ca8-99f9-d5797ad23ead", "value": "T15D227D7CD600F81AD122193DD265C2F1F72C1452DA22783E2195B66D0BE01C38BCEABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504567, "uuid": "093234e7-44d6-4bf7-a22b-3e927c00eebf", "value": "192:ScIMmtPGgG/btMzYPmiP5ONfe77avWBrOU3rV:SPXm2zsmc5ONfeiOqkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635504567, "uuid": "45fde2d8-0e54-4029-8f66-7c926a3b121f", "value": 10333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635504567, "uuid": "cca8a1c1-31ad-422b-9270-8fa19ccb6fae", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504567, "uuid": "8637bf46-7a94-4f4b-a491-e5544549b33f", "value": "IMS211323.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b010f46a-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485583, "uuid": "4069db86-9b63-4b18-bb97-67ba73fae717", "comment": "Malware payload (RaccoonStealer)", "value": "c874d5ded6c0e0f55c75740084a974d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485583, "uuid": "5c91e28b-e897-4fb1-86f6-8d63192bf37e", "comment": "Malware payload (RaccoonStealer)", "value": "9efdd1358f8d37219f5a6b36ef82d03fa5612c5e54c72cd1507c7c2bcf71e2af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485583, "uuid": "067b8a97-e257-4eb3-b2af-f0a19a5ce4a0", "comment": "Malware payload (RaccoonStealer)", "value": "0e32d7a51826b546b5a579b88720af1e424b8c03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485583, "uuid": "7f1d4d18-58a3-46a0-9ff6-f6f596c6719e", "comment": "Malware payload (RaccoonStealer)", "value": "5c64271d32ea64a67eb359b439bc5a2c1a53edfefeaad20765bff802d883926ba14122a2c6f6f59288469415bfd7e810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485583, "uuid": "eb927292-64b0-48b2-9018-aabe6e2c4591", "value": "T183748C10A6A1C434F5B312F859B6A369B93F7AA16B3890CF23D516ED4B746E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485583, "uuid": "d5f6df8f-1099-4b56-b7d6-1dc6306a98ac", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485583, "uuid": "e5f2bc03-8610-4e7d-a3a4-abf714b0c0f4", "value": "6144:zOJMPOIMC7VEHp7JCKugEMWKZ5OF3dgwOl8:zwMPa7gKugEMvZ5O4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485583, "uuid": "8212c2b3-fc8e-49d0-9b45-d83e834fec51", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485583, "uuid": "af1102d1-b982-4cfa-b052-e4d3570d262e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485583, "uuid": "ce2e2575-fb68-440f-a3be-0c7e878a94f1", "value": "c874d5ded6c0e0f55c75740084a974d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad42ba4-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635484286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484286, "uuid": "a9073ea2-ba55-4afb-bdd7-66c7c34d170d", "comment": "Malware payload (Vjw0rm)", "value": "50096f55183266363a8d02110f00e257", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484286, "uuid": "f82314c2-24b8-4e8d-aa2d-010d8ef24f06", "comment": "Malware payload (Vjw0rm)", "value": "9f08ab8cda2c3d127ca259a15389bc04eeacc036db167f0001a1c9d710e37b75", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484286, "uuid": "605eea98-be34-42c2-b19c-d84dd8a67a43", "comment": "Malware payload (Vjw0rm)", "value": "7aee615bf7a183ec4233515721166fd1d504af23", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484286, "uuid": "3e9432d0-b8d1-45d7-9613-728ae48ebcba", "comment": "Malware payload (Vjw0rm)", "value": "fbff4fd6c8bf7595d2fc955ec4ab91289ac59f2beb4fc9bc4267e320efc68b43fae77cf3f43c79179f96b46bee41e08f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484286, "uuid": "ace89881-5a53-4dad-a306-406cd8f9520a", "value": "T15C83801192612D46B9B1DA02F71D0510DF14A6F4EF6AA0AAD143C8CD3EFF2075B9FE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484286, "uuid": "ca2c8a5e-6473-428f-a1ed-72ed00cb22ee", "value": "192:PjTKDrSsWruBc3N19eFb1ow9yQ9y9JkLE6+61Wsz+fr+5inP7TvsC+U6OEsO+Vhl:7TvPkrvmkpR/4K/KtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484286, "uuid": "4725a415-f42c-46d8-b928-c644dad3bfde", "value": 83676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484286, "uuid": "2ffaafd4-0e89-4e58-9fa6-806613c2df94", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484286, "uuid": "5e791afc-8a9e-4f12-9176-78bc059b0a26", "value": "x5g8_Payment_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe05d897-38fb-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635541549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541549, "uuid": "19ca2aac-b839-4e2d-8c8a-e4ed6c831897", "comment": "Malware payload (RaccoonStealer)", "value": "71c9ca85c9748996fd62f431f211d760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541549, "uuid": "34517820-2304-4ad7-aea8-86aef9450b51", "comment": "Malware payload (RaccoonStealer)", "value": "9f1f637f5746983960594883af8120a45b73eef2bfc7750a502ee47ec97ed34b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541549, "uuid": "87261a8c-f6e7-439f-ba3a-7588f0e47723", "comment": "Malware payload (RaccoonStealer)", "value": "9215cff5198e497f5d7dcb6cec5d6112d437f021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541549, "uuid": "b86eee80-9f85-432e-aa91-f76ac16d3098", "comment": "Malware payload (RaccoonStealer)", "value": "ab2984956da90bb9e0da1da04cdf60035d7f8b88295df405289bad22768f667772cab731096940e290420881f6f742bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541549, "uuid": "000517bb-8f3a-40ab-ad15-961f4be462ef", "value": "T1AE748D00B6A1C434F4B612F845BA93A9B93F7EB19B34A0CF12D516EE4674AE1EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541549, "uuid": "29b556fb-9e71-4b92-bbcc-43779d62731b", "value": "518d84bc9a231f5bb2827b0550b9f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541549, "uuid": "0c0f313f-82c9-4b74-975f-dc656140de5b", "value": "3072:EmBNO106XrrByhI6KVD6f/r81MOqcbVm2Bsf3S3sRP7XFfkYVk6996h9wYB:E6WVVD6r8COqB22/ScRJfkADCh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635541549, "uuid": "2dd993d0-34e1-49c4-bf15-39db768e1c35", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635541549, "uuid": "9e57f50d-1010-497b-b838-7d6d94e645b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541549, "uuid": "837b2349-3dc2-4cae-af9a-3b0efbb22551", "value": "71c9ca85c9748996fd62f431f211d760.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ce6567-38ab-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635506774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506774, "uuid": "2d7cefdb-a49a-434f-8693-f2364b7735a7", "comment": "Malware payload (AgentTesla)", "value": "2b47174c9098b752873b29217f2e5984", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506774, "uuid": "15407d2d-2764-4a3d-9f6b-fd4cb0da2008", "comment": "Malware payload (AgentTesla)", "value": "a02c9527890b97ad2687a86f91969967fdd481256d5d3892f6a9e50b94dea0a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506774, "uuid": "7cd96282-0076-4a23-b355-55926eb8778f", "comment": "Malware payload (AgentTesla)", "value": "f9f9046d0f1dc1bc57ce33b89a1b70ec5b06ce24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506774, "uuid": "1e68b448-c5b3-47dd-ad6e-715b0c2c033d", "comment": "Malware payload (AgentTesla)", "value": "268f4e8e6e6cd37a7609176980dcc82275e231b5bd45808591db7feb4203c5a004f25b47ebd4d4c466500034205dda2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506774, "uuid": "20963251-4d11-422a-8b67-17654deed42e", "value": "T19645285A7318BF57D52E6E39C42F1D0983E1851332B2FEAB2EC48AD41549FC98B0F166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506774, "uuid": "da2ee95b-22eb-4ccc-9693-cb9d68e6e99a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506774, "uuid": "766e37cc-0e6b-40a0-aa46-2daef32b27de", "value": "12288:oYXzv/oC10sHwmvRUfU5rUuUH8XIwRHCXrmKsr3S5NTA7CJlvoG721pYCS7te32O:DXLb1NQ/fUuu1HaSC5dAM+i21pc7GIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635506774, "uuid": "a5c749e8-4a9a-4079-be42-34f7640bb70f", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635506774, "uuid": "7a1ad055-0077-48c4-84ac-cfd18071df27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506774, "uuid": "4d8b2fee-0642-4eb7-b865-0015df27a84d", "value": "TEXTIL_0172PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679dfc0e-38b8-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635512520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512520, "uuid": "e9d84c8f-2698-430b-bd49-aadfe024edcb", "comment": "Malware payload (AveMariaRAT)", "value": "f95e8ef943ec46914decc7fe6bff3f65", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512520, "uuid": "29338d3b-2875-46d7-92c6-eff1d9b6f261", "comment": "Malware payload (AveMariaRAT)", "value": "a0faca6b2272201f92435b1764849ab99bfd22e025605e1e2e71e7328ce306d9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512520, "uuid": "e4a3efdb-d712-482e-9fff-943eba10cca2", "comment": "Malware payload (AveMariaRAT)", "value": "6a995a90ec6a7320e34c81178afc9ff53599b96b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512520, "uuid": "dfa4caf2-d013-4d75-8518-3a702f3df8fc", "comment": "Malware payload (AveMariaRAT)", "value": "a8735abdf244d1a98b564911a252ac1002cbeb96aea9abde8bba512960ef95cbc1010a8bba1ab0c4e9a9436c89f5a6c4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512520, "uuid": "0a41c96c-7eb5-4e54-8462-b2fed64b7efc", "value": "T1C625AF2372D05536C1375A798E17B6A85816FF4039E8ECC777F82D4CAE7E28034696A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512520, "uuid": "23485155-25c1-44d8-a985-69ec90fb2598", "value": "39a11c67fb91103b52a452de48d08bcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512520, "uuid": "7e554eaf-e7c6-4e87-9ed9-c21e4db0940e", "value": "12288:FbjCH9eIuiFXM9JuI4QyB0U36URBowFD/wnRZ94LpjqayC94M0LdEegD:F49vFXbIylNdd/DjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635512520, "uuid": "40d4cd9b-ffee-401b-b358-208b3f0d610a", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635512520, "uuid": "19d72d92-aa12-4594-bdff-ee505585c21d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512520, "uuid": "72acf4ea-a35f-46cb-94df-10ad568fadb6", "value": "fax45367876545678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2dd7aa9-38e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635533316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533316, "uuid": "bbc78f87-caad-4b89-b5d3-c88798199844", "comment": "Malware payload", "value": "f71d9b463724752e893116c35b112826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533316, "uuid": "59d6deaa-32b6-43b0-8fbf-a8f204165673", "comment": "Malware payload", "value": "a21bf1ff850f4a6699200cebfc4136a401b1fc8436e7bc814469f19895faaa69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533316, "uuid": "397d720f-baa5-4fde-aef4-b418fbf7a008", "comment": "Malware payload", "value": "245fadf732f53c3a100873dd768856a09d905bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533316, "uuid": "bf5d74fb-7494-4b46-bf4f-f04c3c374128", "comment": "Malware payload", "value": "c72ecfed9c9146353d5ad5f716bb0a8012cdaccf6d296d8a7fdbeeb3cc8c9cbad5d6c060772e8ef1166504bd355d68be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533316, "uuid": "7a4b6ed2-1011-467a-96fa-8871ed2d61a3", "value": "T1D0457C1627847F56E43EE33A9127800843F7E007D7A9EA8EFEE910CE156AF418776653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533316, "uuid": "c41ff19b-a83c-4831-8be3-ad118d75202d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533316, "uuid": "9875383c-8a5d-4189-b8d4-384649590e40", "value": "12288:I/HPW6Aec5giVS6wQ7xXjOqW6iVS6wQ7xXjOqWBiVS6wQ7xXjOqWOejdmXVUn3:wvWJwkxXyfNwkxXyfAwkxXyfOq8lU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533316, "uuid": "8af35ec0-b273-4fd0-8283-6b4aba838dfd", "value": 1202616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533316, "uuid": "dc972879-4f4d-4d9c-8284-26d1461aaa02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533316, "uuid": "755689d4-ce3a-477e-9570-4bef0aeb53c1", "value": "f71d9b463724752e893116c35b112826.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd6db48-38b9-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635513148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513148, "uuid": "5c2e5593-a74f-48c0-b3d3-4b296783f024", "comment": "Malware payload (AsyncRAT)", "value": "697c8de38b66f300b4708d8a3282ff18", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513148, "uuid": "a68ee376-6fc7-45b2-931b-48108fbe9332", "comment": "Malware payload (AsyncRAT)", "value": "a2c975fb3de3396708f18aa2ff9cba6112cb04eb91818b415473081cbc18ebd7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513148, "uuid": "1347fd0d-f0d0-490c-8255-94e8f067fb00", "comment": "Malware payload (AsyncRAT)", "value": "70ce44fc8113aafc25bc19379b256019ba67723f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513148, "uuid": "f6a1268e-66ee-400c-afb0-171bbcc820df", "comment": "Malware payload (AsyncRAT)", "value": "9cf596e76f37e42f2c43e1486d57a8770367d30112cdbba7a34060923a690ffba659ec3a945f259264160cb1d69fc8c1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513148, "uuid": "94c84d82-988c-4fc2-aafd-c4d3424a301e", "value": "T15F14129B505A46CC6B8F1EAECE59C5A52313E8CEEEB9C4F19B140060A03DFD7643985F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513148, "uuid": "6f02a44a-70cd-4a2f-975a-acf1ac72bb03", "value": "3072:0BaPxQcKLsMOvezp/pqC+cZBE8tiKBBdnjlOUjkvErIqfwFw+xzenwlnPZ3kUaMw:ocHmNpqncPE8fBBFj3hwFw4SwlnxcMP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635513148, "uuid": "6886b9fc-c747-418a-bd86-fb2d8580bb6b", "value": 206909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635513148, "uuid": "5c3a5502-a415-4fd8-8564-02a713fd06ed", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513148, "uuid": "44be86d2-f915-4129-bf38-f387195b2249", "value": "PO_Contract_ANR07152112_20210715181907__110.r17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3186ec6d-387d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635487089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487089, "uuid": "0cbcf492-4874-4f16-ad8b-26d2c6825346", "comment": "Malware payload (RaccoonStealer)", "value": "eb3db5499d6268d825cb9290596230a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487089, "uuid": "11b87b1e-ac8c-431d-ac5c-6c0b8d323004", "comment": "Malware payload (RaccoonStealer)", "value": "a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487089, "uuid": "f65a5010-73d4-4347-84fb-33bd656ce7f1", "comment": "Malware payload (RaccoonStealer)", "value": "80e7b787928df6c7599956c08039d108b96c3e93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487089, "uuid": "44665ef3-079f-4c91-8dfe-467f719866a4", "comment": "Malware payload (RaccoonStealer)", "value": "b70023dae5a07815f9cbd90a8128d2008141ae59c2577b827fc814c65465ee2ce0270283f9d9c2fd6dc4ba2b60cd5617", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487089, "uuid": "63d575fb-0430-433b-ab7c-88c49c906bec", "value": "T143748C10A7A1C035F5F212F85AB6936DA93F7AB16B7490CF12D526EE4A746E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487089, "uuid": "1102f510-0fac-44f3-bc19-db272029ac1b", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487089, "uuid": "f2c1b21a-9a61-4298-b362-d6f892c2b5cd", "value": "6144:KbU5N94BCje52ASpvaZv1xZ8gn7FBH0TpUF:KY5NA6i2vaZv14gnL0FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635487089, "uuid": "83b8d6aa-c0e5-40b0-b211-57675866b55e", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635487089, "uuid": "001a5d5a-a192-415a-9bfb-023555a2fdfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487089, "uuid": "49632381-02b4-46b3-940e-61f9bcccc031", "value": "eb3db5499d6268d825cb9290596230a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4591f1-3875-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635483805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483805, "uuid": "610d1e50-129e-4cc3-bd3f-c25ea37ee928", "comment": "Malware payload (Loki)", "value": "49b9294d382c5809619d7c405bf0469b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483805, "uuid": "bdeae68d-b430-4527-bda9-e73358d1c926", "comment": "Malware payload (Loki)", "value": "a3a2ba5b44847a3450d80906eb3c4794de62510854b594104c79456b3cb1bc58", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483805, "uuid": "a62d4c9c-b59e-440d-b346-1fa4ffb515f6", "comment": "Malware payload (Loki)", "value": "bb31d01a12bd5866cd509603404b243d023f3463", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483805, "uuid": "73da6aa6-19c3-43a6-840d-9fe84b3a7bdd", "comment": "Malware payload (Loki)", "value": "145e7223427160473b9caa93bef8a498a8267cc111ccb0933a765930b0dcc722f2764ad1d8dd7c08cba1be726bbfbe7e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483805, "uuid": "631aa810-d4ef-4f7a-9b07-b5110f911540", "value": "T1ECA4D0802AA09557FF2EF47A1D7F85210891CF29DA9D7D598B5ABF3029F4D031B28F24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483805, "uuid": "b0a52de4-e062-415c-8311-f89d5bf526bd", "value": "6144:+kqihRVOXXjC26GXRc+RQYPRD/KQVRjRxc21Re2EM9u1B3QUKS/d3SH2feLr2PZD:z9hEO0BVv9VR1bA2EDD3Qqd3fforuZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483805, "uuid": "7ad0c8a7-af84-4767-a12c-4bb2efa02c88", "value": 451336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483805, "uuid": "b816de0d-28fc-4e1b-89b9-a481f6d1630c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483805, "uuid": "b7d94a29-f6d3-433a-b76b-5e0d99edc63c", "value": "Draft shipping doc CI+PL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68eb30f-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635526370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526370, "uuid": "98b63ee0-64ba-4542-97e8-da5a6c8c05c0", "comment": "Malware payload", "value": "b20d239bf2eb1c52a950a9a23ecb05d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526370, "uuid": "a943f111-95f1-47cd-8be8-e2e99275dcf6", "comment": "Malware payload", "value": "a43ab7c37f4dfcf87f92502afb24a1da79fb8a78ecdfea8417bbcd7c323f3805", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526370, "uuid": "9bd67739-f0e3-4158-aae1-e4680092a33d", "comment": "Malware payload", "value": "8cbf8353847aad315a93ea9db114e766fbc8ca7d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526370, "uuid": "679cbab6-1e8f-4683-bcce-cc4ecc0836fe", "comment": "Malware payload", "value": "9b8a4da9b3d25b6e65dcc7e9042d65abb891a58a77142ebe5d1c6beaf821fee51fd3e0981a962be0efeda0bcf3bb9958", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526370, "uuid": "58366980-ac35-47d2-9420-c860deeffa5d", "value": "T1BE368C15F6D38032E1FE06321A29FF5E8579BC236970847B7BB6379D1E729818520F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526370, "uuid": "3d8df98b-b952-4234-8cd1-d0f16a618755", "value": "98304:sLWPdY5AeQcAmvvLWPaZLWPALWPafYXQi8c:699PNfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526370, "uuid": "20582c12-0143-4257-8d23-7d2ac3acea03", "value": 5000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526370, "uuid": "20ed8e65-eb2a-455d-8bb8-c8ad4102fa9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526370, "uuid": "20bd5746-dcef-43fd-a97f-8ddd2bba90b4", "value": "b20d239bf2eb1c52a950a9a23ecb05d9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ea58ad-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484058, "uuid": "415a7a09-226c-4eef-a089-70495ee3612e", "comment": "Malware payload", "value": "42e6310ffbdd24cf9a2b5d200190359e", "object_relation": "md5", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484058, "uuid": "5d354cd6-5b8e-400a-9b1e-652770175662", "comment": "Malware payload", "value": "a488b6bc2f4674c3a8fada86cc2794888713e61278c7c47d27f9706be0d18f4d", "object_relation": "sha256", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484058, "uuid": "4492c4f9-f06a-4aa2-a7b4-d275b73501db", "comment": "Malware payload", "value": "8197b6f95fb3c84c61a919644caeddcccc4a84a4", "object_relation": "sha1", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484058, "uuid": "5cb36721-ca99-404b-a298-8085d637cc9e", "comment": "Malware payload", "value": "0866dbb05cf4c388b7001e27628d1d68c73fbf0972bbff5281f3c3f0d6b37cba6279ed4da508709ed488342e671cebac", "object_relation": "sha3-384", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484058, "uuid": "a006f66d-a2f8-4690-9471-5afb8b2a2703", "value": "T13A55337D391AE15A58539A4110E8F71A1C583ADB33E04DFD6A2E77887C061CED2CDED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484058, "uuid": "27d879d8-f7e9-4011-9a1d-d96c26167896", "value": "24576:bJwjbVsjK81DVOwk0h03/RTXDyai2GqKdjELVC3L5s7sRtKNf1ZBCoDOM4NoAfL5:bsJsJTO/VXD5GXyLw7C7sRtGfdVOTDL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484058, "uuid": "c17f1154-72db-4c78-86d2-a1c56e90d24b", "value": 1291229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484058, "uuid": "d39d902d-318b-460b-80eb-a33ed0d0068c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484058, "uuid": "243eb56f-6a90-48f6-8fd9-15710fec2bfe", "value": "a488b6bc2f4674c3a8fada86cc2794888713e61278c7c47d27f9706be0d18f4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d2f3ba-3876-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635484086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484086, "uuid": "d7926057-08e7-4f22-aba1-abc366f29261", "comment": "Malware payload", "value": "dec25c57bdc8c945ba975d0f693243cb", "object_relation": "md5", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484086, "uuid": "d9d2456f-7619-408b-b22c-9d73ba8b3037", "comment": "Malware payload", "value": "a6c9e9a9a4a05249502dee5d21dc92b3cdd44a0d0f044678715a6ecd907a938c", "object_relation": "sha256", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484086, "uuid": "892278a9-45cb-4d96-a93c-b276bf7fa651", "comment": "Malware payload", "value": "28a4f1155b0980c4a05505bb60ef805699a4f3e0", "object_relation": "sha1", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484086, "uuid": "5cb79aa7-0ebe-4fcf-bdc3-a7acb969b54f", "comment": "Malware payload", "value": "de6f411e7486a3cbac117fb7f40b712c64eec03e9b21ff6c91537f8c5eac5dbcce67e8cd057b71137f6aec8d99013714", "object_relation": "sha3-384", "Tag": [ { "name": "149.28.162.113", "colour": "#212489", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484086, "uuid": "331f230f-da2e-4706-9f0c-118367d0c486", "value": "T157B2B002B374C629E197DB3A0E31D79431372FAB4C75D16B31E4330C69BD991A695335", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484086, "uuid": "565d5c54-043f-4773-822a-ae4ef69a25c9", "value": "384:FSrbBU+0iVgykPdl0Mr3BhHmJiQBOJxhoWpA4/v+VrKL638DqdO02dm:FMbBCtykPdNTPQBOJroWPvM18Dqd6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484086, "uuid": "0e8480c8-2806-4c55-a53e-8988edbab543", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484086, "uuid": "012a922d-fc94-4949-acbd-7de499c9e455", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484086, "uuid": "8ca6e0e7-9117-4960-b94b-aa813fe5a537", "value": "New Profits Distributions.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e74866f-38a0-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635502116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502116, "uuid": "3967df13-cf5f-497a-b5b6-64733f4348bc", "comment": "Malware payload (RemcosRAT)", "value": "8cb65ce38d3a5f90ddb485865aca8c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502116, "uuid": "62c7e2f8-2342-44a3-945d-0328f0498a17", "comment": "Malware payload (RemcosRAT)", "value": "a6ebeec300be5fbf0da778e99ab91f2af1470c5863784212a520cf5d378426e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502116, "uuid": "59b449c4-0992-47a3-ba35-fcecce9f36a6", "comment": "Malware payload (RemcosRAT)", "value": "7df8a25cf5d083bb9c1124d743d59f3532d5566d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502116, "uuid": "31963971-7d10-44aa-8bb3-a7ce7af8ff83", "comment": "Malware payload (RemcosRAT)", "value": "4bf8bdd7da3d0dfd2aa523fbc093c854f788ed4b54288b21b43ed559ea277c4283f657a27517964391b212478b8b9b76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502116, "uuid": "b49716b7-11f8-4838-9542-8df2ad35461a", "value": "T1C5258E5B3A901533C127967C4ED6EAAC4835BE013C14ED8AABE82F48FF7D65064943F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502116, "uuid": "2958d37f-c490-42ec-9e52-f3e555bbaa66", "value": "39a11c67fb91103b52a452de48d08bcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502116, "uuid": "27249717-d378-4fd8-8223-ae8613e28838", "value": "12288:FbjCH9eIuiFXM9JuI4QyB0U36URBowFD/wnRZ14LpjqayC94M0LdEegD:F49vFXbIylNdd/zjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635502116, "uuid": "186385e0-aec9-439a-aaa0-ec40153bce57", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635502116, "uuid": "0e897db1-8512-473e-a4c9-54c3a825f36f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502116, "uuid": "b81ea78a-6337-4b51-8e79-2bb7780f8523", "value": "Dringende RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8f24ee-3881-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489094, "uuid": "10176fd3-9e74-4003-8889-387efa2ac8ce", "comment": "Malware payload (Mirai)", "value": "640124c3f9a129564e6dd652b98f9a71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489094, "uuid": "503aaac4-7182-4e6e-bbf7-e583024973bc", "comment": "Malware payload (Mirai)", "value": "a718454ce67718802eea17173326cc68ccbece64a4416b4aa00fd9591382866f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489094, "uuid": "13a61cd2-0f95-4b2a-93eb-f351e2e890e8", "comment": "Malware payload (Mirai)", "value": "e7764328b276125b77ca0c9fb234d78c20aa6e58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489094, "uuid": "29f259db-cb7c-4640-b9ae-69173816d033", "comment": "Malware payload (Mirai)", "value": "c4648f4f218edcc0366342fe9d5a2b04c5d5e464fede3c2e49a140f97f440140b7582768a09d787472e17d6bcf48f490", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489094, "uuid": "3fdfaf0f-66f4-468f-b2ac-8eb247d3f9cc", "value": "T153B2D01AC0AE7EB4FED77E355941E2817BA15BDF3B618DC016C15A110722D2C1F9CAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489094, "uuid": "cc8f6e4d-a2f7-45db-882b-d72d942a4721", "value": "384:2A0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoNM4uVcqgw05VxJz:oApCdvwJr69VJoA8FZtxCo834uVcqgw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489094, "uuid": "3be6779c-4bd9-4986-91e8-cdd9613a461c", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489094, "uuid": "f2b44af5-1f8b-438b-9435-9ae439523df9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489094, "uuid": "7d2248c0-5be9-4fe5-8b60-f5e3941a0e08", "value": "640124c3f9a129564e6dd652b98f9a71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3aa626-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635530192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530192, "uuid": "b2f2aa34-16bb-4ff4-b89f-251e41a9bf7f", "comment": "Malware payload (AgentTesla)", "value": "30ed6ca87aec5a50ec756331f4fd75bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530192, "uuid": "6f45e641-703d-4b25-8d28-1222ed7a489b", "comment": "Malware payload (AgentTesla)", "value": "a740871b977faf4c7158d82cecda551928ac5dcc39fbb84a32ae575b184af39a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530192, "uuid": "4ef7f5b2-45a7-4976-bb56-3e03a6b55509", "comment": "Malware payload (AgentTesla)", "value": "0f850507dc8f0cfca06de8bdcd27008e010b0547", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530192, "uuid": "202c5943-1582-4a87-949d-ee48175c31a1", "comment": "Malware payload (AgentTesla)", "value": "174440a79f0a818d5af42fd80b0a150ee5ea9dcc954b245c9503a6a2308290a409035fe2e6dd5381466bb6408b9d9308", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530192, "uuid": "67f747ea-6918-437f-b895-89f1047540e2", "value": "T168E4CF32BF48BDC9539E2D83E0095A191DF25B27CBA256CCF7C1164728AEE1CDF16588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530192, "uuid": "2e1abf16-4e97-4c85-be68-6bc9c205cc40", "value": "12288:nLGMGDOwYMf6p4TYKGGo6bnzsuMF3uKGq+uFueVCt:nLGZk6bnopsUbVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530192, "uuid": "6805399a-7f63-4cbc-9f67-3bac0cf6dcaf", "value": 666139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530192, "uuid": "bc523015-c5d8-421b-b01d-fb61e685d793", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530192, "uuid": "5ab6190f-0d41-4740-9ffd-ce359cb95054", "value": "inquiry.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f8ccc7-3909-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635547271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547271, "uuid": "51e03c7f-5869-460c-b928-9860f151bab5", "comment": "Malware payload (RaccoonStealer)", "value": "9657fc4d30726a375b6aedb3ad295692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547271, "uuid": "a724b75a-f3d3-49f8-982b-2d551c755692", "comment": "Malware payload (RaccoonStealer)", "value": "a78b0179e39e58f6b2a8470e17ced2491eff99f3776be3c83a0679132c3c81e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547271, "uuid": "ee3027fb-dd26-4fe2-b33e-5738f7b05846", "comment": "Malware payload (RaccoonStealer)", "value": "52a4027dd73168ede38d34651414dfa58a099079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547271, "uuid": "6734e9da-4303-4b9c-82a4-e499e64c22b7", "comment": "Malware payload (RaccoonStealer)", "value": "ec76a144a92e838ccee3747f30a57d2427294105b5993d6625078209099c288082d8c72482468af78f2583755cb890d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547271, "uuid": "315cccd2-171e-4795-bd02-1b640c68fc30", "value": "T116D4E000A6A1C035F4B612F85A7A9369BA3F7DB0676844CF17D526EE4734AE1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547271, "uuid": "416c3b42-e300-494b-aeb8-fef52af99194", "value": "518d84bc9a231f5bb2827b0550b9f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547271, "uuid": "e2664841-3963-46f2-adf7-a06f1284565b", "value": "12288:Ub7sTmpLeG0K8sPu4w/Vp4/sMsxhB1XkExFgjn/plSl5DkwH:673eG0VslA4fihjNxFg7C5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635547271, "uuid": "4f552d88-0ee3-4a72-b5de-cd320a2db186", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635547271, "uuid": "e86a1d37-c4b1-40c5-afb9-e3ec0648714c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547271, "uuid": "85e667a1-6783-44d5-ab4c-c1c510902aa8", "value": "9657fc4d30726a375b6aedb3ad295692.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05a1deb-3875-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635483866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483866, "uuid": "13f3d303-36db-4478-b140-7f00ee097974", "comment": "Malware payload (Loki)", "value": "c1b49b0ce85aba993644c87d3fda8d44", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483866, "uuid": "4004c5c4-5810-4d54-a551-88e586381d24", "comment": "Malware payload (Loki)", "value": "a7b0a2f566c148c7312277e90895de644bc844276c2b81c6fbf97defd5ba7cf0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483866, "uuid": "74c54c09-699d-46b1-9c01-0f147f2c78cd", "comment": "Malware payload (Loki)", "value": "5dee578419f9041690ed800e346e8414a18d0e4f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483866, "uuid": "4da7f62e-f1f6-4999-a81c-1ba87fa3c88e", "comment": "Malware payload (Loki)", "value": "06ab2eabd7f011d0124fd68472b9f3e8f0949333b3d970320e341e845e82230387f6f61f1232226cfda091a5e3fbce8c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483866, "uuid": "a4522182-18dd-49be-9b8c-c15a6e96df9d", "value": "T1D6A4F1CE60860231C2774EBE3BF8491A2A659E1D6F70474E21C1B5FAB13ED72816758F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483866, "uuid": "1f9ed0d1-7dc3-41d0-bf7e-5ca14889c616", "value": "6144:iMtA3XwwnopZBdu2a+7shTwj8fRR82kQkb5yyC23OfTjmc7fWTBEX6sLTQyTbAJv:kgwobBdza+7fjUkQkb5epfWTBKAJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483866, "uuid": "164c141d-2ffb-4997-9e0e-114479f21156", "value": 451688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483866, "uuid": "be085bc7-1047-446d-b8d7-fd5f22ca215a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483866, "uuid": "db024821-b90a-4327-9e7a-d964e9263979", "value": "USD75,905.00.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f624cdc0-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635530369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530369, "uuid": "eb3518e6-46d5-4865-82e8-e53516085713", "comment": "Malware payload (Mirai)", "value": "f751d81eebc71e9d24d269e2b58fb3c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530369, "uuid": "12bde485-7bf4-4a7a-a4a0-f1dd235b167c", "comment": "Malware payload (Mirai)", "value": "a91d19a114e9250dc52038a0a229e4dd8d717d3024c582a2c9e9aab16f1bee91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530369, "uuid": "3ae87999-d410-4e9e-963b-eb13b761b31a", "comment": "Malware payload (Mirai)", "value": "de5f8bdeefcd5cbf873ec06db92a59e4f6d804c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530369, "uuid": "46246e67-e9b9-4fb3-a1fa-3b29044a2da5", "comment": "Malware payload (Mirai)", "value": "3fdaf268808040a05502c5db3cff798183fbb3c0dbfd0c267b15fc5bc7b67747bf04971c3693836cd9b6d8424b696a4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530369, "uuid": "b22d0208-9ba9-4835-9757-92b4bca9c5e9", "value": "T11263BEB1D059AEC4C9488338B4E29D391B13FA0556672EF19AC689FA1007DFCF61A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530369, "uuid": "923ac7c3-3061-4d09-99f6-495ef5574176", "value": "1536:9ardVBl5wtvOM/CBAVvx8vYKNAy+hh3u0/MNRHQCMp:9Mhl5alaBmJ8sJTv/CRHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530369, "uuid": "a611b21b-5d77-4c5c-885e-f60f174587ad", "value": 73288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530369, "uuid": "42ce1006-ee2a-40db-b64c-8dd5d2618a57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530369, "uuid": "0a810b42-6334-4dc0-a0fc-a82cd7ebe327", "value": "f751d81eebc71e9d24d269e2b58fb3c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f7c668-38e0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635529945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529945, "uuid": "d2229843-78f8-4d35-9a32-51d41b14b47e", "comment": "Malware payload (Mirai)", "value": "a4ad43b7bfd28cff046be4f1b02233b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529945, "uuid": "e332e609-20a9-438f-a0c5-5bcee79f13e5", "comment": "Malware payload (Mirai)", "value": "a93d39f04590854589af5139d26d848981a4ad09486a596679846232199758ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529945, "uuid": "be2964b3-d5be-42ec-a976-ac01ac172c62", "comment": "Malware payload (Mirai)", "value": "4fcb37e7325abbba0fa37b7b91d90589dc5c6392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529945, "uuid": "63a21cba-e3a7-445c-8470-bd3ba9635ab5", "comment": "Malware payload (Mirai)", "value": "e3a29f06125cb5781728d84039ccfcf1da918c155b1fabb14dd0fd6bd8098a8df2f2803a9fe4d2032af2a74f2ffa44fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529945, "uuid": "d9d03757-ab74-4fd0-9524-9ab5022f66a1", "value": "T1E543F1F2B216C512CA528F748E304480BFDE4F3975F7756614C4B5E62AE1C11A9ED6C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529945, "uuid": "48b54689-d120-4671-aeb6-43cf90cf6531", "value": "768:QyZaCMBa+XWt3C1mRmXiiVYEJRfr9RVGFr3z9q3UELlcdP9Hrl4XGtCTG:QyhMtpCAi9EThRVGFWLlcdPJ+2t4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635529945, "uuid": "2d0182c1-83bb-44a8-a5ac-4e4a4ad234b3", "value": 55708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635529945, "uuid": "91b11f62-92b8-4515-9897-c70f51c9a797", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529945, "uuid": "2c1ba7bb-18f2-4e3e-8bfe-0ea4a4a57a27", "value": "a4ad43b7bfd28cff046be4f1b02233b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139df2d5-389f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635501642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501642, "uuid": "7f623beb-3503-42a2-95eb-bda86580e1a9", "comment": "Malware payload", "value": "5c0d2ff19d880321641a6f3561052889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501642, "uuid": "d78106b0-8a28-4d6e-b7a2-745ce88a8c73", "comment": "Malware payload", "value": "a9431563de4e84d5d231fff8382087131368a29066f7711fdbfee0f70f37fe99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501642, "uuid": "66911637-99a2-40d9-b623-7d84e378641f", "comment": "Malware payload", "value": "ded48325bbac381279c3979c70b453f32cc7b257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501642, "uuid": "e36b995d-32fd-4207-b8a6-503bc5cc94bb", "comment": "Malware payload", "value": "5314b273d849fae3273099b1df8660573badef7fa80747094279c00c065e6a035416f397340f05cd08c74a65fb3d01a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501642, "uuid": "3ff08a85-78e3-49a8-9d6c-5001311199f2", "value": "T11535E122F5C68036C2B337B19E7EF76A963D79360336D19727C82D315EA04416B2A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501642, "uuid": "6295199d-a9fa-4e8f-bf9c-1c24b6df35ff", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501642, "uuid": "7783280a-9d7d-4547-a3de-39d65308de80", "value": "24576:5RmJkcoQricOIQxiZY1iaqU0S9rGm+3IvZZLyQ:WJZoQrbTFZY1iaqU0S9CanLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501642, "uuid": "b2caa455-4fba-40eb-be0d-7220352b4470", "value": 1152423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501642, "uuid": "348bcbb2-3a2e-4751-abb3-2bb05714c3d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501642, "uuid": "62bd8518-74ed-435c-8617-0dd2113e76d2", "value": "loda2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3e3cb9-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635530194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530194, "uuid": "dd3272e1-e1b5-45a4-8e06-ba3be9754f64", "comment": "Malware payload (AgentTesla)", "value": "889c09cef3b3b0dfbb9b5b3090409d8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530194, "uuid": "a67484a8-349d-470d-bc1d-3c84efe7aa59", "comment": "Malware payload (AgentTesla)", "value": "a9da2bd0acb71f33e35271568d357cd8c2fd7ca86638e519ee7f051aabc5ab23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530194, "uuid": "64287349-19a9-4d96-a683-21fb165d72ae", "comment": "Malware payload (AgentTesla)", "value": "22de522fed519140a0239da410c0d6df3873ceed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530194, "uuid": "6764bb50-98bd-406a-bd21-6fcbaa18542b", "comment": "Malware payload (AgentTesla)", "value": "542dc4e2c13eb358bf3ce9ba5c6e4328c803d60e5e4621c6da2547f30ed150d48db860eba6307744171afcd7fe4f43cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530194, "uuid": "891cc52f-6e44-40b5-8945-72e557b81a8f", "value": "T157F0DF5FF41F77D70A21B893F1F7D224992085021BA8C67D926293CD8B654763B2217E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530194, "uuid": "ca29ee58-4b9d-45d0-8b2f-089e829e4a68", "value": "12:SCw9wCJhIgmVeljehfMWUBAzdqsH3wkMCXg0TC:9wtrp+fMWPnwUQcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530194, "uuid": "12e15684-8564-435a-96a9-f50082e864b3", "value": 439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530194, "uuid": "6b109b5a-e4b9-4b81-8339-af77ca24535a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530194, "uuid": "3f917cdd-a60d-4510-a225-27ba90da5c49", "value": "FA2991_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08769857-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635526534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526534, "uuid": "ca00c2a7-c813-4422-929d-d21d7fc06704", "comment": "Malware payload (Mirai)", "value": "8cabe056074f8221b40bfc54fbf37452", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526534, "uuid": "b78e5420-709e-45d0-9d9f-79faea9efddb", "comment": "Malware payload (Mirai)", "value": "aa02514ca88e9d74b2c1dc5a4760fda16ca9be61f464f4572eea32c6d43723c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526534, "uuid": "0d3eafc7-c8c4-4542-b882-3193ee4d9d38", "comment": "Malware payload (Mirai)", "value": "f8a569e164fb35e04261727c29018da5d18cf266", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526534, "uuid": "409c3491-e836-46e7-b962-8f270dbc2101", "comment": "Malware payload (Mirai)", "value": "b0ef9f2f56de2105a9ad8ba7a4f2512df4b9902dfc2e08576be8b0f5af7e78294fdb60659073e3a7761302b06e25f1bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526534, "uuid": "4aafe218-9bee-42f4-831e-38c36709a96f", "value": "T14343D695B883892AC5D813BBBA7E11CD332477E9D2CF7213D8205B647ACA51F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526534, "uuid": "12a3e4db-7ea9-49c2-87a4-7bfe3973e9f5", "value": "1536:g+fvbLL29g7OCk6A2jGI4V33xq3nJiqQzeNyl1v7nnn:3LL29SO36tKIwHxq3JiqHIlZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526534, "uuid": "4e10cc08-7f93-415d-9221-fcc8ce15a853", "value": 55308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526534, "uuid": "6da904af-e873-406a-a6aa-03b831968082", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526534, "uuid": "1959f7f7-5df9-4d04-a4ec-b050db544298", "value": "8cabe056074f8221b40bfc54fbf37452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750ca5a9-38e2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635530581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530581, "uuid": "f25c8089-d516-4e2a-831d-1e06d7f830be", "comment": "Malware payload (RedLineStealer)", "value": "c37da57ccbd85e61cdc441d7df39a325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530581, "uuid": "3946d29e-ded4-42c2-aa73-7fc20bd72d35", "comment": "Malware payload (RedLineStealer)", "value": "adafe67d5bac77ed683f6ab2f4aa4352706446eff1ed4b1efde9add51a5e1249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530581, "uuid": "cb93ddd1-27ef-4696-b3d2-f203382118cd", "comment": "Malware payload (RedLineStealer)", "value": "55642244d35db089dd5232c870175aacf7f9cc61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530581, "uuid": "e35cd35a-71c8-4de9-950b-332212c36ea7", "comment": "Malware payload (RedLineStealer)", "value": "eb09d4d61ea6f461b7ad38b5143277ef10ac3ff34094316b2ba3fc3e423a0fadf7438fc8b2cfcd9fea34aa19fc5c17e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530581, "uuid": "4acff1c0-499f-4634-9bde-db20440e47a2", "value": "T1A343D046FE9C74E7E75D03BCA495EA2107A9D86841A9CBEFFC4C52C16EC63910927307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530581, "uuid": "0301a86c-a385-46da-bc3b-1c44798d938a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530581, "uuid": "4aa58b54-c6cb-45b5-83e3-37cca4ce3738", "value": "1536:BqfspnLJ9rgbyGkjueuiVxiydHesLKgI5TLrDE:QELJ9QijV/VxiyKRVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530581, "uuid": "75c15322-9c77-4623-af2b-6cd1383a0e54", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530581, "uuid": "101bd4c8-916b-4846-8263-cdbc5a86f83d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530581, "uuid": "7e6838b7-697d-4d91-9490-a061649ccbcd", "value": "55642244d35db089dd5232c870175aacf7f9cc61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732acdb3-3877-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635484622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484622, "uuid": "216c79fc-5421-48d1-a02b-1417237c4f16", "comment": "Malware payload (RaccoonStealer)", "value": "18d69a4c78f2eff5ebf8ae923c16a574", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484622, "uuid": "bb9393dd-b867-46e4-80f4-4f727208f460", "comment": "Malware payload (RaccoonStealer)", "value": "aed2ef2307581edfdc8ebb2342ff7b10e383a91b17512dcb4a2f49d1344af27d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484622, "uuid": "1f79ebf6-7cb8-4ead-9669-f7fd06eaad90", "comment": "Malware payload (RaccoonStealer)", "value": "a37fd9bb8b87d452c4ab40cfb6e5c03b604b4fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484622, "uuid": "b2375a17-c755-4e01-8d55-fe6ddf843621", "comment": "Malware payload (RaccoonStealer)", "value": "d2aba932744a58f5c9e681d63c6b1b1f072b071bdd3f8f25f034dbc70bce1ed9d18e9d9e3097340dfd653cd9cf7c3737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484622, "uuid": "d3cb5676-7657-4ee9-8090-78a2ea4a6b43", "value": "T19D748C10B6A1C035F1F212F859BA9369B93F79B1AB7890CF12D516EE4674AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484622, "uuid": "4c95e758-268b-4ef1-bf41-47c15af9ba3f", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484622, "uuid": "8fc51d0c-064f-428f-a345-480f138b1d71", "value": "3072:aEGBNZy006UXWSJrLNbulgm9Aqk4620Fysq2WT2e7/pUvCpKIFxFRTEOk7M+YgRV:taUpm9AL2cysq2s2eyvKVvEr7tRCUat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484622, "uuid": "08aef898-a0a9-46bf-86c0-adb0e6408ef4", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484622, "uuid": "c2e786e1-59a2-4ee2-999a-a8f22de9e12a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484622, "uuid": "6892617b-861c-41cf-9637-c003a91c97b6", "value": "18d69a4c78f2eff5ebf8ae923c16a574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18ff7b1-3874-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635483492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483492, "uuid": "4019aa05-c69a-4f68-8d16-aacbfba2e1df", "comment": "Malware payload (RaccoonStealer)", "value": "18370a35c714c090f4ea74f5bb1b86a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483492, "uuid": "b594bfd5-1841-45c3-8f73-9653a2e15fb6", "comment": "Malware payload (RaccoonStealer)", "value": "aede380a58d25d6e615abe110a8e9cf7d55d557a78e8e39a088592d852f4270c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483492, "uuid": "5e80b495-9848-448a-af79-46a761d857f3", "comment": "Malware payload (RaccoonStealer)", "value": "be4bca3bf12cb1222a9072ba99ee99c523736354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483492, "uuid": "935e85e0-3afb-48e7-ae89-5707ffd66f4c", "comment": "Malware payload (RaccoonStealer)", "value": "ff85e9d5953682e675a80b26b1593d02f4aeca5882133f6d12e40bd2e61e15b88cf0fb77e3a9ca5619b2e7275aba3d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483492, "uuid": "f690a21b-c0fa-4b16-9142-a46742afec40", "value": "T17ED4E010A6E2C035F1F712F85976A368B93F3AA16B3490CF52D526EA47746E4EC31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483492, "uuid": "ae03c103-4511-4e79-a2d0-f147f63c677a", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483492, "uuid": "9423a635-89df-41db-9172-0c83dd30150b", "value": "12288:65gUJkGn91RIaJg1lE++VKEtNThOGDXMYvat:WOgDRIaJg1lEllsev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483492, "uuid": "940d76bd-4877-4cc7-bef5-5b88df28bd1b", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483492, "uuid": "f2ba72ad-f6d3-4b91-8349-903c6da0c50d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483492, "uuid": "65c34fe2-f8b4-47b5-b67f-56d64a11a186", "value": "18370a35c714c090f4ea74f5bb1b86a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a02f13a-38ea-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635534053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635534053, "uuid": "bdc11f0a-4ed3-43ee-a872-e909d2f5579a", "comment": "Malware payload", "value": "99715802ac102615e878b70092f9ce11", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635534053, "uuid": "e85e89be-a1d7-4681-859e-cca1fa2390d2", "comment": "Malware payload", "value": "afb43d1988553bf4fe7f4d9e4422b7c39651259de1ed558628b67cb340aac398", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635534053, "uuid": "8d163535-5f7e-4883-992b-357885283b81", "comment": "Malware payload", "value": "167b213a49bd6d67a4bac25ad312f5b4873b0c82", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635534053, "uuid": "d0595219-57ee-4bc1-8a4b-6d249b7ba172", "comment": "Malware payload", "value": "f3694d4f427f8d305aaa8b0db1d144a3f507faca96735578326247b63a8acbe2aebf16791a53e8a30304391c3c747cf8", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635534053, "uuid": "8b8fdc40-ba8f-469f-b811-712bb0696447", "value": "T10BA2567EF59B0E48AE57D6A8161A7BA5064DF01C72C444E237BCDB387A4C9178B22D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635534053, "uuid": "cdb8e602-bbef-48f6-8361-20e48ff0a721", "value": "384:tYBZbkaMN7/miL3tgqO4rYtmdVYDSK9y227BMXkE/e0jk2a:tq2p7RtgqOJHl27BAkE2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635534053, "uuid": "2897fbb7-49a5-417d-b072-5bbf51efebad", "value": 23021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635534053, "uuid": "f06a75f6-edc7-4cca-a075-1efabac5f107", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635534053, "uuid": "5d895294-2b7c-40db-89b2-05fe66940776", "value": "99715802ac102615e878b70092f9ce11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8321b557-38e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635533182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533182, "uuid": "c3b2ad27-6e52-47fb-afef-300218263649", "comment": "Malware payload", "value": "781932d5e3cf1b9e902ee2ea8c48f572", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533182, "uuid": "329ef8b2-d800-4ee3-86c8-c8f1bd75ffee", "comment": "Malware payload", "value": "afbae06f0ec7939e039a47b7579a98f269eca1be5625e7343267cf4bbb0d5709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533182, "uuid": "e8f5f861-bca4-4e99-b642-3fb434985fab", "comment": "Malware payload", "value": "70a244d771d7cfa61b2fa3d2a0ac386ea2bf0393", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533182, "uuid": "88109add-4bdf-40c0-baaf-c8312d0f4cf6", "comment": "Malware payload", "value": "0e0ee31276e7a6013e85ec120550abb04f98bdc3957bcfb8cdd3866624cbde5d383c8fd16e575b32c08c518002728037", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533182, "uuid": "2962d13f-abae-43d5-9449-151e80d0f70a", "value": "T1413412113AC142FBD8524BB12E37D3F4D3F296184132B7CBAB158F7B1A18BC2945A65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533182, "uuid": "45cce09a-be55-4ac9-a679-ac21d6fc48ae", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533182, "uuid": "9f00a702-ad0e-4ebc-9e8f-008b8a63e4e3", "value": "6144:wBlL/c42BI/9n/DNlCeLwfyYMgKoul0D8nPEAq8G:Ce4X9/bCn0kul0D8nJq8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533182, "uuid": "47d7d455-a1e9-47f1-b17e-7a9ead624d5a", "value": 240040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533182, "uuid": "dbcdcc00-61d8-4947-b6fc-94a923003be5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533182, "uuid": "e654cd1e-d22d-4a25-b96e-c61e2304b1c5", "value": "781932d5e3cf1b9e902ee2ea8c48f572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb368c23-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635484394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484394, "uuid": "b3880814-5401-4f1f-b23c-38d4af37cf3a", "comment": "Malware payload (SnakeKeylogger)", "value": "321bfe330a10dc1f615e5c9d69218c57", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484394, "uuid": "0bed143e-1d04-42ac-bcf3-733627ab15a8", "comment": "Malware payload (SnakeKeylogger)", "value": "b062dff5d70847fbec0f252db14092f1e28a45f9069d0e1b26632222da2e2741", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484394, "uuid": "084bb874-a7e7-4d6f-9546-f9ac3c93079c", "comment": "Malware payload (SnakeKeylogger)", "value": "903accc35e9abd4994a5e36aa0165ac65396a107", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484394, "uuid": "e8396347-8e63-44ef-8081-a63b0c22f18d", "comment": "Malware payload (SnakeKeylogger)", "value": "ab1c91882524486d3120a2f9dda54335ddf90a808596ce3d8039cd49195fcad9e3f8dcd9f16b99a170999e7ba98ad31a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484394, "uuid": "e7f03465-2ae2-40cb-8f47-2b625784b49a", "value": "T10FD42392B1D4DF9BE41B66391CC3D09C7E18FC889E6DD20B3A45BB5F4EB97268102819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484394, "uuid": "a80c9f58-d2e9-447d-8599-193dcd487335", "value": "12288:TbqTtukI4DLk+N76BI7G+eDYYQgc6gID6ijVAm5vbZ82NHKLtO2:nmukI6Y+N7uDgl6gI9VAm5vzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484394, "uuid": "6745422e-e4d9-4d29-b13b-5566695ffbe5", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484394, "uuid": "aabaa28d-667a-4eaa-a339-f6dd1969a642", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484394, "uuid": "eae1ade9-cd81-444e-a304-81f5f05eec5c", "value": "PO10976 B86b0mDlYqpH2306105pdf.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a16aca-38b0-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635509238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509238, "uuid": "5eb9a4d6-f897-41ef-bfd8-d062aa520cd7", "comment": "Malware payload (RaccoonStealer)", "value": "a0bc297d8eaad37f1b145d108786e993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509238, "uuid": "031119ed-82a7-4ad9-96bf-c775ea017f4e", "comment": "Malware payload (RaccoonStealer)", "value": "b06b803c1a654849e7b0310b0b590ca574568ab9eba41858e8caaff5dbbeacba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509238, "uuid": "8187afb7-ffc6-4e45-96b5-aba49870b115", "comment": "Malware payload (RaccoonStealer)", "value": "ac6858536f64ec7113f1cd10b248430da8510db8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509238, "uuid": "e3684ee9-d521-4fa9-aa6f-58ba887ea64e", "comment": "Malware payload (RaccoonStealer)", "value": "446cc284d761acbb2ed1323ccebed07d5c3b1739b9e4147c5123d174b1d41b24167816f7a11e69ce55c60bba14ea35cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509238, "uuid": "89e55ac7-2f02-4056-8c4a-21786ee1adc6", "value": "T171748D00A7A1C035F5F612F859B69369B93E79B1AB7490CF12D526EE8634AE0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509238, "uuid": "b620bbfc-a570-494b-ac92-2d77c3d41936", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509238, "uuid": "a92ba0e7-6aec-4ade-b322-3335e84e5a35", "value": "3072:rwrBNjy106UX1gBXf8fVzu3kkGwSQ46yyZ4AX/cpM0p2a4sqOD06zWusdImyJLiT:0VT1fVzBnKyyH/cKy4sqOIwyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635509238, "uuid": "dd28269f-c7bf-4221-b0d0-ebc4041a4800", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635509238, "uuid": "73345d0a-17f5-4d17-867f-7f5ff305e2c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509238, "uuid": "abda5c28-1152-420b-b528-6512a9e5f92a", "value": "a0bc297d8eaad37f1b145d108786e993.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3539e50-3890-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635495440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495440, "uuid": "fb3517c0-95e1-4ffe-9b23-2d120993f3bc", "comment": "Malware payload (RaccoonStealer)", "value": "25db6eeef8a5af271f9a59078d5c8e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495440, "uuid": "5defb558-4423-48f8-90d7-a3470c6c0e27", "comment": "Malware payload (RaccoonStealer)", "value": "b08f0e4dad45693b7203619c1f56a3d995fc63f9f95465fe8f22761752b99afe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495440, "uuid": "7b06d2da-0b7d-4e7c-8e36-6f46506ff9dc", "comment": "Malware payload (RaccoonStealer)", "value": "b3d62fb1954dbb5ab7d28a3711565ebb3df1db4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495440, "uuid": "f64fac4f-ed20-4cc8-a591-dbee0baff1c0", "comment": "Malware payload (RaccoonStealer)", "value": "9d672d1f24823c34656875ab1d629a46ff08831d8ace2b913ab959b66b86150b9ad3703c44f2713e2b3e051da2fc0c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495440, "uuid": "592f22e7-fec5-4860-baae-c14fdf4e9110", "value": "T1D8D4DF10A6A1C030F1F652F49AB6A368793F3AE1677494CF23D526EE4A749E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495440, "uuid": "16f45c7e-c6a0-4e33-a7af-8b6b4339c0e0", "value": "8554f137e95e1371295faad9355adee2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495440, "uuid": "290d531e-f670-4b0e-a983-0b4fca66a20c", "value": "12288:G+Jsn4LmI5RqC1n5+PQm0f7HOa29FS4K5kJqUsU:9JsCIC15430ypG4VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635495440, "uuid": "ccb6180b-9ee4-4067-bf4a-26ec52e1bd5a", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635495440, "uuid": "863ff85a-1fbd-4e41-8809-59f6493d3999", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495440, "uuid": "f3f2d7b4-6159-4d07-b557-f5ea8e921193", "value": "25db6eeef8a5af271f9a59078d5c8e33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33c82ee-390c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635548751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548751, "uuid": "e2a78e94-741b-4ba1-b059-ade5ce4edf96", "comment": "Malware payload (RaccoonStealer)", "value": "2b5a293ea89bcb1c139989505fd3b5ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548751, "uuid": "1dacccce-d031-4a90-886a-9be57a2fc7d8", "comment": "Malware payload (RaccoonStealer)", "value": "b0dd5858056c0f3b57748faeadbb2d64cc104c5e7139a79f5413c8b161fa73a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548751, "uuid": "16c1b9d3-9794-4118-b9e4-7ed67af3bd1d", "comment": "Malware payload (RaccoonStealer)", "value": "cb84cceb14c46015d4f1ee1dab78a6da9df16fef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548751, "uuid": "94624454-2e4d-4789-a71a-14a9a525de96", "comment": "Malware payload (RaccoonStealer)", "value": "7de0b8cc5958105f3dd96a44c947265f2b9c041e202ae0d580fba84bd98a259ed0f1a4d48b94e287807d2227bf83ff79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548751, "uuid": "ef2abdfc-fc7e-4546-b431-d246847c947a", "value": "T1EAA4013437BDC032D1A752709975C7A82E3AB9025574A28B3754362D3F70E8C6EE636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548751, "uuid": "3cc02c13-e704-4521-8f8a-f01d7a436ba0", "value": "c698dff9877941757d23fcd110965bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548751, "uuid": "c215a38b-da7f-46ac-b83f-b1f45495813e", "value": "12288:pZ3FS9j1yfHIn6MUmm/E2hDOBc7TlGn7fWGwxvmIunn:yjsPIn6MxxuDemwn7f8xvmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635548751, "uuid": "1a28a33b-814f-4a24-b083-3b519b9f6206", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635548751, "uuid": "5265568c-8a5c-4d2c-82a1-88793fd24846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548751, "uuid": "39f5f22c-052c-41c4-a766-a367dfa21ead", "value": "2b5a293ea89bcb1c139989505fd3b5ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d464fc-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485264, "uuid": "72a8a8fc-873a-43e7-9826-14e5cc11b846", "comment": "Malware payload (RaccoonStealer)", "value": "a0b45ceeda5b3d0194ed874a23acefe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485264, "uuid": "18ce9064-8af9-4895-8187-ea905d1c13f8", "comment": "Malware payload (RaccoonStealer)", "value": "b13da4ae4b27bcab31fb81bcae4ea2c3ef94d64a0cb154401a6db3b58c65a062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485264, "uuid": "7e594f86-3640-478b-86b5-0494ce3af40e", "comment": "Malware payload (RaccoonStealer)", "value": "845c0ea9ec07e2a1b271ba2ae57c085c52bce623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485264, "uuid": "c4937698-1949-4b6d-866c-d19c4e7dd326", "comment": "Malware payload (RaccoonStealer)", "value": "c0a6eb6096e369b978475beb32e385c4fca3d174123aea9f863a77be1440135b1420ed59657b1f8c21bb3151a2c259e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485264, "uuid": "c6c21613-4ff7-412e-94b1-3a27e0f0979a", "value": "T1DDD4E010A6A1C032F1F312F84A769269B53F79B1AB3490CF63D52AEE46746E0ED31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485264, "uuid": "9d847a3d-ff41-444b-8ba1-58a31c5272a4", "value": "389a11aacbf687c9e251b78d996c02d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485264, "uuid": "a61cf528-9378-4660-a5c9-7d99fc9de4ba", "value": "12288:gZ0j6o4RGjKEfsoTep3UDW8VoFd95zA39xGyiTSPSQr:Mu6kPfpTK8WFz1A3Gh7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485264, "uuid": "dc2e944e-978e-4ef4-9f6e-3d3805f5ee38", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485264, "uuid": "b7256c33-7cba-4fab-9ede-b7c405e5e26c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485264, "uuid": "cfedd964-63be-41cb-b431-9da445dd58ce", "value": "a0b45ceeda5b3d0194ed874a23acefe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8c3b49-38a1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635502813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502813, "uuid": "e5169b6d-f45a-4521-b4eb-b991132d876c", "comment": "Malware payload (AgentTesla)", "value": "ac9ad994586c611b84e339803019e2f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502813, "uuid": "ff98ffd8-bd2e-4f19-9dcd-21e9379ffbb3", "comment": "Malware payload (AgentTesla)", "value": "b1475691581251cb5132bbd003a2e2cb473c89ba7800198cf635c69623c20ac2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502813, "uuid": "c8c1a76e-e47d-411b-94cb-15b5afc72e7e", "comment": "Malware payload (AgentTesla)", "value": "d01c8ca8dcf7f6a75ae2c4f783b280f49c64db38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502813, "uuid": "b55f2cd6-6112-4c58-9746-7be1cbb53c66", "comment": "Malware payload (AgentTesla)", "value": "04a09d7fe5a2c603b25acafb8517aca7d8c13291a98932d874736c75e7af0563d0841d6a413ec800f471b7ba7a52c360", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502813, "uuid": "b95f638c-4b39-4e24-a901-78dae690ffbc", "value": "T136D49E48B210B1BEF816897285D73C60DD18A8A6020AC642977F275F7F3F5D68F0D5EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502813, "uuid": "8581b20b-ba96-467c-af29-45e744c0c531", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502813, "uuid": "856a0c45-e569-4a8f-ae27-8b23d9d2a9c2", "value": "12288:x93KaQ8s/jjfPcOimwfjiR8VLdZb9Y5vRuv:ubj6fjJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635502813, "uuid": "6abb1ca0-4316-420e-94de-af68049b3d71", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635502813, "uuid": "59402eb1-16c2-49f3-974b-7f65747c0f85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502813, "uuid": "ad760a25-2d87-45a9-8db4-1015ab710aea", "value": "orden de compra.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66395ab-388e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635494667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494667, "uuid": "ec4c90ef-fcf9-40a3-a623-bb8c1919867d", "comment": "Malware payload", "value": "6d5d924bd4841e59596179d14e80e8ec", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494667, "uuid": "4358a6e1-55cc-42b4-99dd-f78a101afbe4", "comment": "Malware payload", "value": "b1aa7d31c18a0c9e427c5947799d7f4e97c620c9ba9fdae2bacb50550b09efd6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494667, "uuid": "99fcf038-f6c6-46ca-acd7-7a81568e114c", "comment": "Malware payload", "value": "d642045045a1e801c42758d5142b2519e4ff2478", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494667, "uuid": "504990b6-11d3-426b-b0a6-f7ba8e05cf5f", "comment": "Malware payload", "value": "07cd78c2fc6abad2dbc7badc641c86591943c7db15172d6811b8c6be3aba55a0791a0f27f0fa2276e927c655712104d3", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494667, "uuid": "a02372de-f3b3-4193-91d1-595cd3d8539b", "value": "T1C674D1B9D63A7BDAC58DC630A51F85F24005FE366D723C88DE89300A6237B701F9A756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494667, "uuid": "55018c67-3316-45f6-a3fd-d2f105f061b2", "value": "6144:iMQJ8Bi41otbQHMLK/u7FYcLoEjr6Skd0ArqDT+rsyzGds7i:DWMzqtbQHaKG7FMEjr6Sk23+rB7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494667, "uuid": "12058715-0f25-444e-8209-17bbc17f300e", "value": 367992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494667, "uuid": "350e3508-967a-49dd-b815-bf0343564d64", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494667, "uuid": "38ef2d53-674e-4fdd-8f85-57b9e2cf6cbe", "value": "MT103USD.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed82b668-38a7-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635505443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505443, "uuid": "d340ef21-0367-4ac1-8117-b7f4ef48fbe3", "comment": "Malware payload (SnakeKeylogger)", "value": "daad3703fd4ac1c3dbe72dec893632de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505443, "uuid": "720c64bb-586d-4e72-bfd3-ab9164932365", "comment": "Malware payload (SnakeKeylogger)", "value": "b1b81c897704d639d1b77a5dbbe64e3ef7062e92124520ad0855a2d7f3d0c0d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505443, "uuid": "54f26a68-c360-4f47-a091-ccc1fe73e6aa", "comment": "Malware payload (SnakeKeylogger)", "value": "a3378e0ead1a7471544074c11bec5673fd1994fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635505443, "uuid": "509fe281-92eb-411a-b0cc-4bb59fc3ac50", "comment": "Malware payload (SnakeKeylogger)", "value": "053461b7d85935be6aee0669b07d8190461ceae97d33928a71b76df0eac1e7c73eecfdd11f9632bd7172d90f4e39ba74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505443, "uuid": "c9353b69-6c4a-4601-8ed2-91f6d576b050", "value": "T16674E105A33DCB6BE1BD43BD40A3062513F6E8673262FB854FD674C62823B825E45DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505443, "uuid": "a90a5638-442f-4682-b812-0628b6fdb43d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505443, "uuid": "781d3006-413a-425f-be65-a3c24ba00aa7", "value": "6144:klfZxGqB614b47d6f4Gz4K6TCFWZ1BVQiNrFuqpDtv8G4mLBliDluuU0pNcM3rHh:klfZxfoBJrFuktvXtIBuu95Hq9k7/DqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635505443, "uuid": "743d9d32-e995-4f8f-966e-eb20fcefa0f6", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635505443, "uuid": "50d4f4e0-be20-42b5-9d10-98eaf3e45575", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635505443, "uuid": "efa51bfa-70cc-4bf5-a4be-fffa7f1e677c", "value": "PO202102900010 #QUoTE - 115892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24eea13b-3893-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635496517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496517, "uuid": "3eb5f189-2e9f-45a6-a416-637ac45d7c92", "comment": "Malware payload (Formbook)", "value": "5273a14914db4656593872056f2ced12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496517, "uuid": "88f8b341-ebd9-4baa-b89d-e2f6c391a41b", "comment": "Malware payload (Formbook)", "value": "b2663af445ff18476795d3462841a45488a9f2fd53c92d0c798e2e24892e10ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496517, "uuid": "18a2febf-2b58-4338-af86-244680df5ec6", "comment": "Malware payload (Formbook)", "value": "eb3a6c58a92fd83bc94a61d758f43cb6895b04f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496517, "uuid": "11873149-c20a-48de-aae7-67e8578518f4", "comment": "Malware payload (Formbook)", "value": "14e058b510320f7341fec46c0b261dc12e96b7de05a3498bfd7cc559cd5c8da41cd0667b9c9ba8639a7dadb760003e44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496517, "uuid": "f66c3050-053a-4efc-bd69-4468ce10cd5a", "value": "T1ADB4BE3D7E099A73D2B6C235E4EE0106F3ACA58732329E0A15D7274C654BB533A963CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496517, "uuid": "984811c8-c4f1-4d30-91f6-2023744626f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496517, "uuid": "ca256e82-92bf-481d-8b85-07529c6172d6", "value": "12288:m0ZSD/e3bUmyXtX53Q9Ny7T+jL4o1xrxuD9D3a8Z:IDwmA9U3yL/sD9DK8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635496517, "uuid": "b0104341-405a-449e-81ab-9b4e4c52ffe1", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635496517, "uuid": "e4546012-cf4f-4d6c-8fa3-49a6cfb03753", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496517, "uuid": "485e6e72-58a3-483f-aa4d-41d4089beb07", "value": "5273a14914db4656593872056f2ced12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bb3f8b-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1635494993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494993, "uuid": "5d6e53e5-c724-455d-9c67-ae3f7989a544", "comment": "Malware payload (BazaLoader)", "value": "cd3e23cddeb92b7397eaf960da34c237", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494993, "uuid": "c536a2ab-985a-43a2-ae66-54ac4a906730", "comment": "Malware payload (BazaLoader)", "value": "b2a4b60dd0c7e9dfa6d88e9badad810ff74c5f42054b7af22e95fb5553d67331", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494993, "uuid": "e3b5e7ec-b1e4-4104-bfdb-37dde0779957", "comment": "Malware payload (BazaLoader)", "value": "7be37d84635e448781d82fb3225d1537e4a71f52", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494993, "uuid": "374b6954-4d8d-45a3-a4a6-75b84b74e50e", "comment": "Malware payload (BazaLoader)", "value": "f5095d7e412ee0d6ea094d05edabe1ff0eddaa2e53233a8fb79fe52e917785c70f642f118a31e2524190c72954418efc", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494993, "uuid": "41fcaf75-b4e7-4c3e-86c6-d4a7407a729c", "value": "T1E7D3DF42EDADA763FC045970DCB6B1CBD529347747B0469E2B3AD2A41F13641E82BE38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494993, "uuid": "28176980-57d3-4f24-9456-857e5ecbba1f", "value": "ad3ffaf0584336c12d7303af68597f29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494993, "uuid": "5b78afff-ce18-423f-864c-d357f1668334", "value": "3072:bKfk4isEZeMyM0BsEkxyzPZzihfXSO5vNFYVtZakBLj8fMTcE1B:mfk4isfNM+XOyzP1ihff3FYVT3JzTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494993, "uuid": "d50e4aa3-6bd7-409d-ae6a-eaa5c1411293", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494993, "uuid": "c468b485-9b97-4dbb-b908-a218a034c857", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494993, "uuid": "3e7aa1d7-50d3-4838-a91a-8a8181ec2f4d", "value": "cd3e23cddeb92b7397eaf960da34c237.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94732322-38e7-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635532782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532782, "uuid": "3f9c43b6-f4ec-4a1c-9bf3-d1db7c936cce", "comment": "Malware payload (ArkeiStealer)", "value": "c6329b58f43aabd2b9ea545afb22dda9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532782, "uuid": "5c8f4fcd-33ff-4e52-95a6-a8d7f1964dba", "comment": "Malware payload (ArkeiStealer)", "value": "b35ef6b865bf13b12e702b62c7ee383d17094a6d91a1bbf0b0f0b9b7e80a50d4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532782, "uuid": "9e35a6da-f845-4064-97d7-4acbf1b89234", "comment": "Malware payload (ArkeiStealer)", "value": "b399e762737210d96f1a198d42b4ea3f21ef413c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532782, "uuid": "2c7fc1ae-2ff9-461e-a705-d454a69d3926", "comment": "Malware payload (ArkeiStealer)", "value": "5fe1dcf22752ac600b63099699a01c9c760e9bb7bcf1b5ce49f2e94451dd51bc110a0e61f3afacac43cd79c08a9da4d2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532782, "uuid": "e9c13b1d-5c30-4061-8024-b395e6d1c540", "value": "T1D9748C10A7A1C034F5F212F859BA9369B93E3AB1AB7490CF13D516EE4634AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532782, "uuid": "c6926efd-87ba-4441-8517-36adcb34fa16", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532782, "uuid": "ea739b7c-d6a9-463c-8caa-43b70f0a699f", "value": "6144:4BVSq0HEjw32LvyCqz8WfgWq0KRcLMgfDf:A8wjw32yCqz8WfgWq4Qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532782, "uuid": "8bf1e908-3b70-4801-a37d-ef3300e77d41", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532782, "uuid": "86b5ec70-030f-4998-aa0b-3028b6187fdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532782, "uuid": "4977142c-0a4c-44de-8751-c97d8cd5fbd5", "value": "c6329b58f43aabd2b9ea545afb22dda9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3727eb49-38aa-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635506426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506426, "uuid": "afa8e021-a6ea-4b37-bbb7-a33daf6e02ee", "comment": "Malware payload (AgentTesla)", "value": "3ae2ded9c3b9ae4df12be4b743173150", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506426, "uuid": "802c955e-8ff7-4891-a72b-ecb12c5a0422", "comment": "Malware payload (AgentTesla)", "value": "b36c69058f05d2c4811ad739cbf96b28ad0089c26466036a171a04837f6cb848", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506426, "uuid": "4eb6d544-d50c-47a1-89d9-603af929bb27", "comment": "Malware payload (AgentTesla)", "value": "3807ad7312e56a1197182d585304587edde24e59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506426, "uuid": "2b6f89f8-b103-4b94-8637-027ce808e299", "comment": "Malware payload (AgentTesla)", "value": "6c4f2300dc06107c5f92f3d48bfab940c580e116747dc050875b5b49afcf22deddbfdd9e0530a6deca15caa5963dc096", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506426, "uuid": "a0002c1e-603e-4143-9681-ed57f0fbdfc4", "value": "T166C4AE9D7654B6AFC45BCE76C9A41C20AA606477030BE303A49725ED9E0EBDB8F141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506426, "uuid": "a8ea5028-d259-4092-a7f8-13b2ad567beb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506426, "uuid": "2b6c9686-3687-4a1c-8813-323b9c6c411e", "value": "12288:FEXNMzRI2XpQqjuTG9G1LvILIMoBAeivTAnzdn8uGOPI1qH2PoX8SWg/I62O:KXNMKYrjKSaAeoEJnq5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635506426, "uuid": "39685123-dfc4-4f28-a48c-e0bc7cc06c68", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635506426, "uuid": "4812425e-e9ce-4de7-91a5-c6704aefee15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506426, "uuid": "f6e808db-3183-4cd9-9f5e-85fa00f0dfbd", "value": "cotizaci\u00f3n.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20774e5c-3883-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489637, "uuid": "12b2b8f6-33cb-453d-98bd-f5948e01f41c", "comment": "Malware payload (Mirai)", "value": "e26d0af421c46e8ec0e745a7cbf3ed2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489637, "uuid": "2e64203c-d2f2-415b-b386-6b01f1d2e7a1", "comment": "Malware payload (Mirai)", "value": "b3dff5ab47e7cfac75486b92bdabc12cba9791ad9fe6b1a03eb7b4306dfc7550", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489637, "uuid": "98e6beb0-8792-460f-a473-af6f32fca743", "comment": "Malware payload (Mirai)", "value": "0b985307fbd4b7530d4ccee4cd42df8b844c7279", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489637, "uuid": "4235dcda-f387-4392-884f-8327c170df7a", "comment": "Malware payload (Mirai)", "value": "1a3ac625d5c572350aaa819a7e7b9783494d15b1d0ee81c05f5a85b6afe4a6a2e1a4729f3d0ef8f9a3e33f9396db7e9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489637, "uuid": "d3f9c2cc-2d86-4667-a3e0-e87275ddb210", "value": "T1F523F2432093AA03E4345CFA84728DCDB55AA6BDB1BE77A725090D154C35DA3ACB18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489637, "uuid": "83d3d08d-9d17-4ae7-9c3c-1b1faf12b535", "value": "768:vK7y1XGO1LCNgukEkvwtqPnH7u83nc0iF39q3UELWt/iw+kvBGg6+fYtrBHD:H12O1LCNguovDPH7TcrELWhiw+kvBGgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489637, "uuid": "ae166009-d117-4bd7-8147-70d895ed0818", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489637, "uuid": "ea8a1de1-69da-4853-b98f-79fc34354f7b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489637, "uuid": "7c3a0581-81f7-485e-a27c-88d763e77286", "value": "e26d0af421c46e8ec0e745a7cbf3ed2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89f9c39-38dc-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635528118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635528118, "uuid": "4b152767-8256-4e1f-b1b2-a933753d5de7", "comment": "Malware payload (RaccoonStealer)", "value": "dbebc6262451ddbbb9c42f2a88eee120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635528118, "uuid": "5a747c45-0843-4a14-a4d2-5339662eaf10", "comment": "Malware payload (RaccoonStealer)", "value": "b4dc9e2e8a50e0f1aa1ab6ec6d55f3835329cd80a85b799dd474242a0897dd2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635528118, "uuid": "e4bd809f-6f3c-4672-9d60-f8b218af6c87", "comment": "Malware payload (RaccoonStealer)", "value": "8473d180117e908fb455e305b75bd76f292b44df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635528118, "uuid": "91c8478f-205f-4b50-8961-f861cb5df8a7", "comment": "Malware payload (RaccoonStealer)", "value": "90dc8664c727b9d0f1bb16ec60d05eb9817a5ed94f867b9c002e658fcc565b1dfdddf6f074f8fc180ca92d04c2c5096a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635528118, "uuid": "bff4248c-7419-436a-b1c8-308f52c05e00", "value": "T173D4D00167A1C034F4B612F88E7A92A9A53F7EB16B7484CF12D526EE47746E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635528118, "uuid": "7c36b9a6-61be-4505-bc0f-95b310b97ae0", "value": "4649591756a77695954d3f167e28cc87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635528118, "uuid": "757a8a0d-a7ba-42df-8502-ceb90c848d03", "value": "12288:hKe3uBWNN2FZHZUQpbqwtX5igcjUP5BJnRaJ7PPOwfQ0kaVx:0fBWr2FZHZL+wJ5i0PTet3Hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635528118, "uuid": "5d0139b4-d746-46c4-b6ae-17e8d3b94aff", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635528118, "uuid": "396b8781-ed97-46bd-ab2a-fd2b4607448b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635528118, "uuid": "5f1bf43b-47d1-4791-8961-dd5876e5c059", "value": "dbebc6262451ddbbb9c42f2a88eee120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033c60dc-3891-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635495601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495601, "uuid": "77047177-f5be-4f09-9c06-f761bb41a20b", "comment": "Malware payload (AgentTesla)", "value": "8c934a9984abd8bced41be2531e44ddb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495601, "uuid": "98e56515-7d63-4ec1-a695-9c74cbb64008", "comment": "Malware payload (AgentTesla)", "value": "b56efd78b3e3a8c64d04bed08ca3243c87f4f36ebd4a2674a30fa87b7aa7f5c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495601, "uuid": "bcb87ccd-71cb-4aae-be93-6952cc5ce57e", "comment": "Malware payload (AgentTesla)", "value": "55d7ba97b9db8a5dc58f1788cc71080b18827cf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495601, "uuid": "7d57208e-d822-45a7-a9bf-3361fa511119", "comment": "Malware payload (AgentTesla)", "value": "0b2b233df809ebc32d51b9ffbe8bd12c2b0dddc63adc6b188713ee231ef0d3e738b00849298bd22213992a61c87c5bab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495601, "uuid": "f1553771-57fb-436c-b4f5-7d6b60d8b759", "value": "T1B094F154A3798B2FE5BC47BC80D3126453F6982337A2F7854FE638D61973BC14910AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495601, "uuid": "885db442-cef2-47fb-b69a-4eb1979bbdcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495601, "uuid": "dc1210b0-5875-4951-9932-04387b077154", "value": "12288:ulfZxp6BW8P/90gpe1L/vRJ4+F0bZ9up45hNiBQ:ulfZxpWdpe1L/s59uql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635495601, "uuid": "f8d0106e-ad08-4196-9537-e76337d81baf", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635495601, "uuid": "88592a99-f2ef-4970-93ef-911e2d44beca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495601, "uuid": "0f9b664b-8e2e-4c51-a952-5fac8255e1ea", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123b7736-38be-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635514954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514954, "uuid": "6d3a10fb-6965-4a69-9ff0-fa98cb1b78fd", "comment": "Malware payload (RaccoonStealer)", "value": "1ed53f8c9a03a7d833c665f4f5b21fe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514954, "uuid": "2fb5eb3e-5286-47ed-a84f-93e4f1d2cc8f", "comment": "Malware payload (RaccoonStealer)", "value": "b57a5b8c5bdb6f8bc619260754370022458c1d25da455e553dac5a783804b59c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514954, "uuid": "e593ab2d-a43c-4929-9ced-14cb912d9da0", "comment": "Malware payload (RaccoonStealer)", "value": "7950a8c6f4076f0c79b000f2a7297ba315f8f354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514954, "uuid": "3806d905-75b7-4180-9f0b-98d17e3ca13b", "comment": "Malware payload (RaccoonStealer)", "value": "fff300a7374f7caf7233912ebcae083df7b1747fe7d29d37e45753145c3f35b8973625ef029ea615f2586aa2f9fc0b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514954, "uuid": "4211ba8e-772f-4575-9ef5-b42ee35cc81b", "value": "T108D4E100B7A1C034F1B662F85AB59669793F3AA1AB7890CF13D526EA57749E0FC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514954, "uuid": "078be1b1-41c7-42bd-897b-89906cf94dc0", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514954, "uuid": "67394786-02c4-4899-b3c1-6f22cfc0d137", "value": "12288:07D8ChA/KGWZLw/CGzWNsDmkPxV601H+ILsqgUxiRu6:qDzhAiVi/CoesDmkPxV6I4dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635514954, "uuid": "18bf772c-925a-4bab-b50c-3edb49c75880", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635514954, "uuid": "7a3da52d-bc0a-472d-9aa3-f378c0217697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514954, "uuid": "39266c4e-8c41-4847-9fd0-31732a73aadb", "value": "1ed53f8c9a03a7d833c665f4f5b21fe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f7f372-3877-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635484699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484699, "uuid": "c7918040-bf79-4200-bb65-a5f0fa6c4dd7", "comment": "Malware payload (Smoke Loader)", "value": "273666abfda64b3ad4ce0b43cc8862c1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484699, "uuid": "8152fcb8-3745-4386-a3a8-5c71f1c8c270", "comment": "Malware payload (Smoke Loader)", "value": "b71c739fea2e0befe20eeaf814f5ffcb90277ac825cb6328adce7c3985ea7883", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484699, "uuid": "7e6b546d-4fd1-4bef-9fab-5ae8b9476517", "comment": "Malware payload (Smoke Loader)", "value": "dc9079b8bb05def65e32ef7c2b9a83bd4707e36b", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484699, "uuid": "086737b5-965a-48ef-856a-1122335cae13", "comment": "Malware payload (Smoke Loader)", "value": "9e90199cc4ca49a56c691802cb6accfb75ea7dca0ecb4c176efdcf9d7f312d274c5b39573b446523d481c84d36386b18", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484699, "uuid": "de49ad78-e189-4e3f-8622-9d01c2c2086b", "value": "T10A049DF036B9D871C463393148219AE16D2BBC61DA2099473374339D1FBAECC9AE535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484699, "uuid": "23da0e96-6e47-4341-93ff-732a9ac1c4d2", "value": "5ec7965957c5433534918911424a4e5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484699, "uuid": "d1060bab-47ba-4586-8209-40be8987a3cb", "value": "3072:TWGh8tP5puvIJfCL0N4xhnYoWsGC9NkptWrxpzbgqruXhspVggjcGkNIVqI:iG0P5cvIJfOEgeopGCAuzbgwu6L7ITsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484699, "uuid": "ef01d276-d0b3-47ed-8e29-df40a782e8d1", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484699, "uuid": "64cf795f-7c19-43b1-8499-5a7e3a6394cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484699, "uuid": "ffc0a8a7-f420-4747-969a-7a882781e855", "value": "273666abfda64b3ad4ce0b43cc8862c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f9a79c-38d3-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635524268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524268, "uuid": "340087a3-6098-47ef-af78-f2c8d64ebeb2", "comment": "Malware payload (AsyncRAT)", "value": "4c2634725187d2ccebaaaf92b231a1f0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524268, "uuid": "1b09a723-3787-49ae-9e20-b0b9cc2e2aad", "comment": "Malware payload (AsyncRAT)", "value": "b7f3d1dd2aa804eb498480b7a3b03ea003efb665005e844e51be5b8ab9dc8e79", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524268, "uuid": "bcf89c1b-fbc1-482a-8a61-098912d1283c", "comment": "Malware payload (AsyncRAT)", "value": "597b626b2324b12353e84263b3bf838e2ca4d187", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524268, "uuid": "6f26b787-cc28-4eb1-a7a8-078c7c1a8cc8", "comment": "Malware payload (AsyncRAT)", "value": "fbbf3f83e8b3e09c630a7a5fbf0152f20ff4f42a8d9feaab01056a4c5958047a60e8fc3ef9d17f5180e47af11dc8d9f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524268, "uuid": "bb802c7a-3935-446a-b9c2-ad26cbff1ebb", "value": "T180232B0037E8C12BF2BE5F786CF26105867AF1637603D98A1CC455DB5623BC69A425FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524268, "uuid": "9f4513a0-c424-4f66-b35a-21a5a15a61b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524268, "uuid": "24c1f2ea-2273-4554-bc7f-219944bcc1e4", "value": "768:XuGs1THwoPNWUtmT1MHmo2qzbo3p5tByBlPIJzjb9gX3iXL1R2sCepBDZPx:XuGs1THb01m2Uo551J3bqXSf2u3dPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635524268, "uuid": "1bed86cf-cc75-4bd6-81dc-157f7e1d5294", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635524268, "uuid": "adad64a9-0f0e-4eec-955f-bacec1794160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524268, "uuid": "f0a2cf3a-1b0a-4cb3-a726-0b6e5d8c8eb3", "value": "4c2634725187d2ccebaaaf92b231a1f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be86ff35-38d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635526410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526410, "uuid": "cd656e80-102d-49e0-bae1-640d97d6835a", "comment": "Malware payload (AgentTesla)", "value": "67e51e7632efde149a3ed473ddc9acf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526410, "uuid": "2a20d3db-4edc-406c-862e-a31258022c6a", "comment": "Malware payload (AgentTesla)", "value": "b80b82d35a5d2a7f4c2d71d915f0f3e8cd7f8da274d110ee9203aac0d4b0c241", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526410, "uuid": "f705164c-3a02-49ea-9ac4-09587a1e0a5d", "comment": "Malware payload (AgentTesla)", "value": "27773b1884aa0afb1a94da2795ca2b8170a683be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526410, "uuid": "975880de-30e0-4aed-8366-31d9893ef32b", "comment": "Malware payload (AgentTesla)", "value": "3fab751b64ba4827c0a202b308d27f2caa80b7c8530988e95f39d54f080c28e8188ba5097d665efdbff072c05d877d08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526410, "uuid": "0f5dbcf3-d9ed-4b5c-814c-7bd031442cdb", "value": "T161A4F1012245A326EA8626BBF9E4ED59C7C57F14B3A46951FEF231A34C3EE1C0D1349B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526410, "uuid": "bd02652f-d153-422b-b79f-d93027e931dc", "value": "12288:X6qjRMyVxozAN4ebj+W9H6xVZRHl4sz8uGRJ:reuezAVPZaxVbgnRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526410, "uuid": "659f51c8-30e6-4532-a285-342e61f1927a", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526410, "uuid": "9e986458-4b59-43d9-b948-c3f3186c95b9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526410, "uuid": "8f16bfac-b8bc-456c-beff-ac1ab3147a70", "value": "agreement.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87706ba1-38e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635532760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532760, "uuid": "d256c428-4c0d-4872-b675-e8a8fae49667", "comment": "Malware payload (Formbook)", "value": "f0f18e49bee30cc334ae1bc55b97aaa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532760, "uuid": "c3953087-68d0-4473-aa41-bbfd22e6cd07", "comment": "Malware payload (Formbook)", "value": "b89374513ef2e5bd74a6922fc049df5d7037136f47c0fa67c6587ea363513958", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532760, "uuid": "0e133f74-3c8d-4dfe-bd68-fb07144e6e23", "comment": "Malware payload (Formbook)", "value": "c27b144816fc67b618b592c36b8455bffd080b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532760, "uuid": "3164b44e-319e-4fab-9cd0-b113fdbb5318", "comment": "Malware payload (Formbook)", "value": "b82f856fe32d3748af5be6ef0f14e293df4e8b501aa2ed04a2ed9d928bc0a16a42bf6009ee96ee74b4ebd505c680bb37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532760, "uuid": "1ec9d0b6-9e5d-4f2c-ac9c-1b4e6d616187", "value": "T1FD94F1456379CB2AE1BC07B840A3126453F298637261FB558FD634EB2933BC25E11EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532760, "uuid": "594a1640-37e2-4f3b-9eb4-2f105f73240f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532760, "uuid": "ac09c5ca-5697-4404-ae74-3ee4c05ba8e3", "value": "12288:5lfZxqwBUUnc0NQ6VBK5IRA89XjJzZuZ2B:5lfZxqGnNkcA6XxcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532760, "uuid": "227db5e8-0170-4388-a403-145f0e2362fe", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532760, "uuid": "e4cb7833-1499-4544-bcda-aa95bc627842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532760, "uuid": "8f9840e1-0898-437e-a7a9-ae7177d9dbc2", "value": "f0f18e49bee30cc334ae1bc55b97aaa6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c152a961-38c4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635517824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517824, "uuid": "e615acd3-23e3-4f8d-8fac-a8aa70d16119", "comment": "Malware payload (Formbook)", "value": "e9ab93defc1a6f061aa6dc3faaca9d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517824, "uuid": "9670a4a8-445c-405c-83fe-70e232b46eba", "comment": "Malware payload (Formbook)", "value": "b92f3037abad18b18f70493663e11bce7eaa0c077682be6f375b8bc8d65dee46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517824, "uuid": "7d291a24-a08a-4c37-9f4c-b4e65e4c7fc3", "comment": "Malware payload (Formbook)", "value": "88c6b9f4944849827f182d53aca0993477ee7143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635517824, "uuid": "793d16d1-0514-4420-b0e4-63ae6f6aea82", "comment": "Malware payload (Formbook)", "value": "4c7548418843e21fa457338187725ad2270186374da03bb382f6cf36f7f3ddf6ee3512fd030187639d4298c3d3f5685a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517824, "uuid": "c3747350-7305-449a-a5c3-99c53d42b3e2", "value": "T11984E044A3398BAEE5BC03BD80A31A2813F6AC2676B1F3554FEA34D51973BC20D15E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517824, "uuid": "4f5c6a82-a565-4d1e-b45c-d1ee0293cfb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517824, "uuid": "a5700b48-d3cf-4afd-adfa-25882ed8c7b0", "value": "12288:mlfZxj4BisBX0QK0PhljPvjGYH6nSMp+nQc:mlfZxj8m8DvqYH6nb+nQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635517824, "uuid": "99c19769-99ac-4b27-875a-f9c34493c617", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635517824, "uuid": "50afb008-501c-4314-962d-a42ab050002b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635517824, "uuid": "04eadf77-b32f-4545-899f-e3f13da5ca7b", "value": "19292021 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfedc3d-38f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635538619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538619, "uuid": "033fdb2a-d2a3-498c-b097-82af87d7f856", "comment": "Malware payload (Formbook)", "value": "bbcc7ec5a4f78cad98c07a3bd3eecfb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538619, "uuid": "ec2d60a5-edbc-495f-a361-0a805ffe0b5f", "comment": "Malware payload (Formbook)", "value": "b94f5b293f83458293e899d5a76ca936cc4ea5d79913e3792cc25f08fda1a147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538619, "uuid": "9060f1f2-8270-478c-8f4b-d7b5f04f3111", "comment": "Malware payload (Formbook)", "value": "10fe623ccd6b14cc30d1cd3ef191a08cabfa2ae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635538619, "uuid": "f0e504ee-d82d-4d6b-9469-b719680db2b1", "comment": "Malware payload (Formbook)", "value": "6cbbe2e3a7baca21c6563b33c67073828082e5885253ddb1ff580eba6c7ae85c9095803504103baf965b371421b48857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538619, "uuid": "d4e1b43d-7267-495d-90ef-5ebf3c682bab", "value": "T16CD4C03212A29E89DF7B1FB488E169D00EE57CD75B3ED60BEDC5C46A21F2520CD12B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538619, "uuid": "906ac07b-f7ad-4f4a-b681-709b54da41e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538619, "uuid": "a21571e1-a932-424e-b080-7b4b5caa15b9", "value": "12288:yBzapqJFTPm2GtTx50SIHsbetWnwDpO3xWCit7HSe67:y+qYtn0SWqPnwDp0WB79g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635538619, "uuid": "706bbc98-dff3-479a-9743-92ac56b29312", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635538619, "uuid": "366bc08c-1e8c-4a1b-b855-01cc38eed111", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635538619, "uuid": "1723093d-ab9e-41fa-85b5-1792825f011b", "value": "Payment_swift advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86bf709-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485624, "uuid": "4d3caba0-6a7d-4b3f-b28e-e40f02cd003c", "comment": "Malware payload (RaccoonStealer)", "value": "e9b47adee723301b4310cd687bb422ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485624, "uuid": "2c9b0c20-1231-4237-9b27-9888b8b92713", "comment": "Malware payload (RaccoonStealer)", "value": "ba4c47ef28d74d86e56945e5d9fe41a780707e828290e05d93b23ba9f0a6abef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485624, "uuid": "7c168dcc-27eb-4b08-a20f-7213d724b249", "comment": "Malware payload (RaccoonStealer)", "value": "b76b240ffa831d3c03a14860d63655fc089b0a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485624, "uuid": "6afe5d7d-27fd-4f30-9926-e8e43310b9b2", "comment": "Malware payload (RaccoonStealer)", "value": "c600d3245afc456f3b2339237ccf4a790aff2d416afba8e88449af68323c53e99316b3403d441552449d6ea8a8a9f17a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485624, "uuid": "434e5517-ae81-480d-986d-2b1324c69e25", "value": "T159D4D010A6A1C034F6F311F889B59269B53F3AB1A77490DF22D52AEE4674AE1FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485624, "uuid": "95c73455-dbd3-490b-ae27-d07d5965189b", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485624, "uuid": "26a397f3-1f2b-4b6a-a3d2-980c198ac1b9", "value": "12288:FxdtVeQuHBazBmjLToXItORaVE7ldB7Rx0sFho9e6T:ndzeh7oXI2kgNUs8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485624, "uuid": "18c16171-c21a-4613-907b-216a87cef90b", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485624, "uuid": "f24f25ed-5470-42d0-a050-0c1ffcf8c046", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485624, "uuid": "61f6eefa-30bf-4b90-b314-f00b4a6264e4", "value": "e9b47adee723301b4310cd687bb422ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58484cc1-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635494885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494885, "uuid": "fb4d83df-adc5-4741-a325-cbab5c0de054", "comment": "Malware payload (DanaBot)", "value": "e89bd687b7a33144bcbec0c467783439", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494885, "uuid": "3fe4d163-8aba-4f5b-a502-22b12cc85a66", "comment": "Malware payload (DanaBot)", "value": "bb2e7b341aa7b7c75e148ca1b4eff2997626655e1d06329598d5a2c3be91f18a", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494885, "uuid": "775abb22-ded9-4896-94a5-a13e4c0ec2d0", "comment": "Malware payload (DanaBot)", "value": "d7f2810c65c58847696f0c18e5fb304a7f106f8d", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494885, "uuid": "e2946b69-71c5-4c04-8c30-8f6436ca552c", "comment": "Malware payload (DanaBot)", "value": "8bfdfde30880897d0b8b5b6fd624f06236956e3596f245ca96ceb2574e9eb599ca2688a412496924a7b1c6db52e1bebe", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494885, "uuid": "2a075278-a923-4c51-8b96-dcc1d7aa9af6", "value": "T192C54C2033B69812F273133598F3D0E09ED8BD6299B4AD4B70C23B5F049F6D29A5975E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494885, "uuid": "c6c7fa8d-bd9c-406f-aae3-2f7fcc9c7d63", "value": "c333dd14729fed1bd2b9dd15a112d68d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494885, "uuid": "aab39f64-a67f-4db1-86e8-8ff7bee7a1da", "value": "49152:qgZziYT3//Yjt2Z/fZMdzUAOC5n+LlrxFTGWcKq:q0ziYToB2Z/f6AAOGarxFTGjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494885, "uuid": "e71ffacf-b712-4ad9-847c-a2784e95870b", "value": 2588672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494885, "uuid": "a18e054a-2347-4e5d-8a79-c6fa3f604939", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494885, "uuid": "eaefb3da-cc85-4690-8183-3851d3532fd8", "value": "e89bd687b7a33144bcbec0c467783439.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b4753e-38ba-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635513426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513426, "uuid": "bca01a44-581d-4870-a1cd-6b90d62a0a2d", "comment": "Malware payload (AgentTesla)", "value": "f33dd854d4f93ccc6dc4302b62d7976e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513426, "uuid": "ded759ad-6148-41c1-bdb7-bccf1e06265f", "comment": "Malware payload (AgentTesla)", "value": "bc316b9670025dd47a54cf5d9e3e31c8ab4855a6f67ec2498848b5c6aa1b7553", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513426, "uuid": "4f20f9cd-c35b-4744-b9b7-048168549e3d", "comment": "Malware payload (AgentTesla)", "value": "5e6171af81c1154b32ca4c3292fa34b5aa99a272", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513426, "uuid": "4a77f963-f8f4-4fff-8beb-6a63a0da9057", "comment": "Malware payload (AgentTesla)", "value": "02409ff8938c4af7a96bb6de1654c9ee309cdb908037c82c563bb76e6fc9dd0230ad5d3f68529a12159df30e819d8158", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513426, "uuid": "f6bb6086-765a-49fd-9b5f-2f33f23b404f", "value": "T1B6B4CF3262D6AE9AEFBF2FF9483021441EF57C179B3DD24DAD5A009626F2950CE10F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513426, "uuid": "5ba34af0-6f22-4dc2-a43e-e995faf43163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513426, "uuid": "b3496763-c057-43b1-810c-468f990fb397", "value": "12288:VI5ccqJFTPnAUthJaQPIiqD1tLQJQiQT1cpQylo:VI5FqsUoiIiqTQJVp5lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635513426, "uuid": "4cf09ff2-2870-46da-8311-e3ab5d4c318e", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635513426, "uuid": "60a7ba5b-692c-4480-9c03-c486decf41f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513426, "uuid": "7b1e1654-9733-4c43-8c6b-0a12f7b7676e", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc84046-38e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635532606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532606, "uuid": "b149afc1-fc76-4a13-8671-1ccf5ef7ded5", "comment": "Malware payload (Smoke Loader)", "value": "7ed3c01b8793f3572c7c0892fab3b339", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532606, "uuid": "8a214c43-0da5-4659-b33c-611e8a81e280", "comment": "Malware payload (Smoke Loader)", "value": "bd12cd27c1ce9f7c43ad069b21aca05d6510216d317371939b05429cdc850074", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532606, "uuid": "a034a210-56ed-4846-975b-089961e7c80a", "comment": "Malware payload (Smoke Loader)", "value": "e1a1716a5ecd14cd34bd26045ea7a53918d08b35", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532606, "uuid": "d61b0386-d85d-435a-9cff-d3a30388592a", "comment": "Malware payload (Smoke Loader)", "value": "faad9dd529abbeb3d8d874e95f71dba55a0310a3c0faedd222b7ebe2f285dea3ec155315951c0431a5dae313fbc32db7", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532606, "uuid": "da5df4a8-4cc3-488d-9a72-ba53b53d163c", "value": "T1B4748C10A6A1C434F5F312F849B6A36AB93F79B2AB7490CF12D516ED4674AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532606, "uuid": "3b61967a-c3fa-4d0a-9c91-6c301c7f43a7", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532606, "uuid": "4d97c167-b03a-43d8-b773-a9aa7205cf2f", "value": "6144:QMJh8mslUVKvg7P7Q7bC8eYEbDCJ0hgm6yQOy3I:Qa/syKvs7Q7G8eYEbGJ0htX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532606, "uuid": "8a9aa256-daff-40bd-8113-46b467c8b5e8", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532606, "uuid": "63e787c8-f160-49de-8a81-80f65edcd56b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532606, "uuid": "4d62f72b-05af-4c73-b8e0-73f7d278001c", "value": "7ed3c01b8793f3572c7c0892fab3b339.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a88a0e-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635530178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530178, "uuid": "c9e6caf6-8d54-4385-81f7-9fcb153646a5", "comment": "Malware payload", "value": "23a0de8e78bed20d6c9b8dea0336784f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530178, "uuid": "0765d59e-55e5-4c29-817d-166f703c0008", "comment": "Malware payload", "value": "bd44bf588db7b761ab49a54298a9eac804ecac0fce55683469f48b128bb0c5d0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530178, "uuid": "7fada57f-573e-48cb-a6f6-49307710de7f", "comment": "Malware payload", "value": "e852ec5f20184bf91d0555faa91980d05545d955", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530178, "uuid": "1ed1ab80-e64f-49c3-8988-098ad7415709", "comment": "Malware payload", "value": "a5fcc81fd164e8a8502566960c3760b4d2b26603e11dfcdec2b8908a5d6b5ecc6020fd0236bfae1430ab0054f2bf3626", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530178, "uuid": "44caffb0-5817-4d3c-8e52-3fcbc4cdd18a", "value": "T159143B403F544A67125EF2BFB1420D4DD73A3050D7ACCCCA558FAD46CBADA20ED5A8AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530178, "uuid": "034c97de-6f67-4df7-8412-b268c2388eb0", "value": "384:X18JI76xhU76xxDurLiA4bUbx0mYPLZkW4pU3LDQwkeT9HddT8+OetUYwt+8U3xc:4TPa6QFmnWYSgzQu54mHDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530178, "uuid": "cd6be9f0-9074-4212-8cdd-be181c434a9b", "value": 201048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530178, "uuid": "20249a41-e65f-4642-9b88-5de4d18c3498", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530178, "uuid": "19aac3a4-43bc-48fe-8d02-2a0f5397a0d1", "value": "ProductCatalogue-PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57e76a3-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635484304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484304, "uuid": "551c6841-5529-4a8a-b20d-0e57a9f6920e", "comment": "Malware payload (AsyncRAT)", "value": "6ada9636b309c11e3c93f425ab32a473", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484304, "uuid": "f40af25d-e266-4364-90e8-3a2511f9000c", "comment": "Malware payload (AsyncRAT)", "value": "bdcaf31f882353b75031d1d7353085ff529612bec3a62e462fa3086d2a79bb85", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484304, "uuid": "d4c4a00a-b7eb-4323-89d2-a259c73a6650", "comment": "Malware payload (AsyncRAT)", "value": "1cb0b1c6657437a1e37546e62c660456e7355cde", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484304, "uuid": "219ffa9c-bd32-4b87-95e4-822918513fb6", "comment": "Malware payload (AsyncRAT)", "value": "2b73ab9ee5bb9fc83080b9ee0c7ba09642a13833a0e5244f695e6a1aa520401fe4577e375073a0a5a9795265f4e96e41", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484304, "uuid": "879a5594-9fcd-455b-9493-a8f9902e5b2c", "value": "T1B1F0220FF42BEAD70A217A53F0E6A13D853440C207A0CA7C8127438D4B214753E291BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484304, "uuid": "449f1895-5cce-41c5-85ee-73847eb21d0c", "value": "12:TaVLMUVb9wCJhIgmVeljehfMWUBAzdqsH3wbhCXg0TC:mV4UvXrp+fMWPnwoQcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484304, "uuid": "489e178f-5784-42d5-a822-dce7baed318d", "value": 504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484304, "uuid": "27d4be8b-0ede-4e75-bac6-60e5668d8282", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484304, "uuid": "77866564-9552-4204-98b5-c79963d7497b", "value": "Waybill.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6bf5a7-38f7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635539509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539509, "uuid": "0d9c624f-43bb-4f14-a013-5a9eee5bc1f4", "comment": "Malware payload", "value": "d3b0102e6632be81ce158c909f583412", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539509, "uuid": "ae09a6c1-531f-42b8-8817-5d3a9a22d6ec", "comment": "Malware payload", "value": "bdf3d5f4f1b7c90dfc526340e917da9e188f04238e772049b2a97b4f88f711e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539509, "uuid": "b4beb4b9-88eb-443d-820e-173b2a5ba1b1", "comment": "Malware payload", "value": "10bd0f1d3122d6575e882ba8f025eb11b0a95b61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539509, "uuid": "d0b302c0-604a-460d-837f-005ad54fd334", "comment": "Malware payload", "value": "59fe47077a9a3dcdf8f02f94ec628f83fd26bdb9ea86c3da2b6d49833a2dc99cd1096327b2102382e287e6075bc9703a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539509, "uuid": "493cecc6-f1f9-463e-b8fb-473173f651a9", "value": "T149B54A62F89655E5C0FEE0304D4652A9BAB0B96903303BF71F8497690736BE4AF7E311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539509, "uuid": "58fa3cb6-f8e0-4826-b7d9-fd7677b758c9", "value": "49152:oBWlwme8nhvmR52bzPOA1nsRTuIQflLQn+MJ3m+02D1:YmeQhvmS/R1nsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635539509, "uuid": "5154f5a5-d107-45f6-a9ad-0e715efb2dba", "value": 2494464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635539509, "uuid": "90ee72bb-b523-4252-8660-700c51bcda77", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539509, "uuid": "0bd55ed5-e2e2-4933-a84a-fc9179fb760b", "value": "Filecoder.Hive_freebsd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c139c58c-38b1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635509664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509664, "uuid": "7fc78b5a-18c3-4bcf-aabb-95d66edc79ea", "comment": "Malware payload (AgentTesla)", "value": "dd7a88f2b3a527b05bfb685f9ff9146b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509664, "uuid": "9eb40afa-b1f7-485e-8daf-9ba8028be046", "comment": "Malware payload (AgentTesla)", "value": "be6157458d598a0684178959aee54ce584664129da467bcec6c18da558d2a8a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509664, "uuid": "612bea40-481d-4f28-b4af-bc2656a65fea", "comment": "Malware payload (AgentTesla)", "value": "ba6318c1694f84afacbb0fe3a428d1ea1e12fc4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509664, "uuid": "12dc32cc-a644-44e4-b68a-bda94c0f9073", "comment": "Malware payload (AgentTesla)", "value": "e3022817e70cc5fdc177a7aef1b76fbce79818941faccb23f644dbe53b3dab295e9d2c14c7aff4b17ff76d58fc6b9c65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509664, "uuid": "52d0002f-b5d9-459b-bd9b-b4389df7a928", "value": "T198A4234A16FADC996D5D44DA31180A5DAB32B3708484FECF6EBD0E7B3BC08A1493365D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509664, "uuid": "c4c44c5c-85ad-4a2b-bce0-ecba39958c49", "value": "6144:dNHkvoHxCJjrKhE2czM6cKpxGpx+S0tsTxO9NVNnnsGRamLyGUJws+NfnUdNN0/0:DkvoHgltfMiN7nsMavtJwedcsWjaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635509664, "uuid": "c6e1503a-a37f-4be9-b28c-fe9169339feb", "value": 463271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635509664, "uuid": "a6875051-8252-4234-a25f-26caae0f7886", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509664, "uuid": "3b3c29da-5473-4b80-86cb-83c5c3c34710", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce93931-38e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635533225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533225, "uuid": "3426426a-cb52-4666-b3ed-33feb6221d6b", "comment": "Malware payload", "value": "b03fb365db983dd0e80bfe4166781e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533225, "uuid": "358667fd-845a-4052-89e3-cf9d4ecaf5b9", "comment": "Malware payload", "value": "be6f833816e4dd59791654e138d793e1bfb6bfe016f34ae63b9b3e2f6106fc55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533225, "uuid": "64c3c56e-259e-45e3-9d6d-57899e9f865d", "comment": "Malware payload", "value": "bf9b3a82272c333eb2ffdd1191b76b0a50199a8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533225, "uuid": "16778159-f2fb-42e0-a93c-80d6cc6fd9b2", "comment": "Malware payload", "value": "24a7bd9e6f2cb907610f37276a5bb6fd39016d7178e4f5053ed560e0948baf136a3adca28db6dd9d3b9c8ba070f0359e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533225, "uuid": "ceca3f95-94e9-4de3-b28e-70a6901428bb", "value": "T15BC49C00235791D5C4FA03B806698354C7657FE1F9E3AF2E798336AAEA722C076453E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533225, "uuid": "92d97286-7014-4f8b-af82-79152ba5ba8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533225, "uuid": "3e23d427-4ead-47fe-a2ff-a8135147dbfd", "value": "12288:LQUw5lIhYdb6WOreXllJIuOGtVGzZMmXQ:ZQlIhYIWOref57tkzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533225, "uuid": "14c797f7-858b-43c7-b32c-aee3605120e2", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533225, "uuid": "0cbfa527-5e82-4342-82cc-413d169ebe4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533225, "uuid": "7eee5176-5a2f-4f0e-a449-9870fa385898", "value": "b03fb365db983dd0e80bfe4166781e5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcf4b45-38dc-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635527831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527831, "uuid": "3c9e09ed-94b2-4e83-901e-f7180a35c247", "comment": "Malware payload (AgentTesla)", "value": "7751398b09e98d11592168e5898cb1cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527831, "uuid": "2e2814cd-ed2e-430a-b058-0e8c5d582358", "comment": "Malware payload (AgentTesla)", "value": "bedd7a999dd6cb36bcaede8fca958227a230ce2862e7404b5e62ddd3203f3bec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527831, "uuid": "07b70462-e570-4058-a2f0-facdd8c650c8", "comment": "Malware payload (AgentTesla)", "value": "61120693e5ea78e117045549cc04b9151f99e954", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527831, "uuid": "9eb7e0f1-ff06-44e0-985b-dbb72473ae25", "comment": "Malware payload (AgentTesla)", "value": "276661e8c1937fb2b85cb02ee6509ee540bd34f549008ec07ec7786dbf8c11f46c89e7a32cc1a589f708d0717424cad4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527831, "uuid": "6e4d269b-0901-4212-ae6a-3b709b87410e", "value": "T19AF4E1325392AE9DEFBE1FF4982221404FF5BC536A3DD20B6DCA01A916F7950CD50B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527831, "uuid": "f7858a08-4a2d-43bd-b947-10fc03d86b9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527831, "uuid": "edc14ab9-e00f-49e6-8bf2-7c0ac34b877d", "value": "12288:uaoq6n1qJFTPB+dk8UmJuKrAoanLk29ndv9k/5iEdXfB3Xjnad/+M5zhFOdln:9od1qt+OTJKwn7nv+5iuXfBj7ezHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635527831, "uuid": "8fa035f2-eac5-4055-8e0c-f9817375e703", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635527831, "uuid": "a4612f61-4341-4b35-b2d4-41821b9f5afc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527831, "uuid": "09e88316-1398-4265-9174-28a5958b0128", "value": "Q.2021.03.17 PFP...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d83b745-38b3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635510329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510329, "uuid": "4732a5c1-2c3b-4c57-af33-b0c6aa25ad0d", "comment": "Malware payload (AgentTesla)", "value": "a5e13bcf11e66291744217d9699be073", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510329, "uuid": "3ffb69d1-7ac4-4b68-b04b-1bbd06f5da25", "comment": "Malware payload (AgentTesla)", "value": "bf47b1cef6852ce946299fdb067942a6dc7873503b2b3c3d2b7eaaed2beeb52f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510329, "uuid": "48e98513-b287-4129-8003-7245ed9f6196", "comment": "Malware payload (AgentTesla)", "value": "285d940d712393b42c52e167d5ffdeee91ab873c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510329, "uuid": "5c948b5a-a519-49b9-9149-c603bb94a204", "comment": "Malware payload (AgentTesla)", "value": "464be248cb7674799aac5075288995162e1b8f213fe5f3a863dd3e0b6ab7f76a3bba8511e64e8217d24fb3449ce96b1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510329, "uuid": "1aca87b8-cd64-4943-b43f-f2ad8270fe05", "value": "T144842339E9C1DC4A1895B704312CEFB92C12D2C51B34D6A6CD2E85FD4BBC8FA53205AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510329, "uuid": "3cbde0b6-ccb9-4614-b734-613e61d79843", "value": "6144:oXnWHhmSULKIMDjAHhVADfA8RapJXflIwMjLmSLuMMJQdRwDiy9RJNq6Cc:o3Ws/LK6hVADIC0XG/jKLH+dcS6Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635510329, "uuid": "fc83a47b-9a17-468b-b736-00029ab195ab", "value": 372739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635510329, "uuid": "480bc8a9-82ed-4651-ad9a-42b1084f4a7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510329, "uuid": "ca5efaaa-6e40-4d51-ae0b-357f6b793c60", "value": "Details OF Payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db05781-38f6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635539240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539240, "uuid": "714e87be-e1f8-4bf6-bbf5-3e17c0c2f6e5", "comment": "Malware payload", "value": "f27bb2f94b96d532e6ba900cab2527fd", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539240, "uuid": "61b5ed34-6a8d-4b80-828f-9e726edf8eff", "comment": "Malware payload", "value": "bfbc1c27a73c33e375eeea164dc876c23bca1fbc0051bb48d3ed3e50df6fa0e8", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539240, "uuid": "e93252e5-12f4-4b37-86ec-96297753c5ca", "comment": "Malware payload", "value": "35f3986dfb731124ffa78862991a37154e162d02", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539240, "uuid": "296ee58a-6af5-43a5-8608-e941370b1e69", "comment": "Malware payload", "value": "afa9968f5b29cda333ed1360102e0aaa748e9b2dcd835fa0451f8a827dd4be46864c1830d74b21073eb02eda62aab462", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539240, "uuid": "1516da52-0fc0-4792-857f-de98439931c0", "value": "T1AD54E65E85C5654FFDA2CC38AFC8F296C197B7388DB9D2F36CB690311C28195A857223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539240, "uuid": "3333abf5-be6c-46d5-825e-36b1d609c1c9", "value": "1d30df1e5b7623c4b3e7485c04815cbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539240, "uuid": "a38a3c10-dac8-4e2d-aaba-a5426f7a469f", "value": "6144:2xUQ2UKZQGbM6Pum96gGco3ZQ++r2Ce/CUE:A2UKZQeM6PzogGcopQ++yV6UE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635539240, "uuid": "0f8ab272-56b5-4b0b-8cb4-b5291315c548", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635539240, "uuid": "262f5d23-a6a8-4ec3-9a08-0532aecfa99b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539240, "uuid": "e4bb39a1-8965-4fdf-bed6-200a500cfe49", "value": "oldmystat3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b30cfeb-38d2-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1635523612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523612, "uuid": "278f633d-e085-432a-a7c1-3b9c1503782e", "comment": "Malware payload (NetWire)", "value": "a4a8a89ce20e6f60d67140336e0a53cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523612, "uuid": "13458bf8-ffae-4e1d-9c4e-27d347cf93a2", "comment": "Malware payload (NetWire)", "value": "bffb4b88ef53beb49ba2af08212870b203a29c7fcd1c8f02e0a905e71a8af6df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523612, "uuid": "56bf0ce2-8372-43e2-abe4-b2ffac507f84", "comment": "Malware payload (NetWire)", "value": "f8dd44e59ac4592637ceb48a386ecb7cb53b3d42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523612, "uuid": "782f3185-cacc-4ea8-8aca-6db06f0bedb8", "comment": "Malware payload (NetWire)", "value": "f85b366c92bc77cba3f5e94a6a941fe1ecb548c8eb46edefc2bd6a301a6ff5d55db196d65b947fc75ae20a04eaa05242", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523612, "uuid": "172375e9-004c-4441-91dd-20a010ac6dcf", "value": "T1CA83127FA1B5BE42F05649B98FE9A9307E8D00DE41E18A08B43F43EEBB0015CAB57517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523612, "uuid": "7d382dbf-132e-45ac-94cf-f1c9a71ac6f9", "value": "2f3c5da38e687ed8e68cd2b55dbd54f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523612, "uuid": "800ee673-5467-4cb4-b310-4a887e9affe8", "value": "1536:ORC2p2bHgBjEAKsQHzIRiuoSL6EWCOSSUnEy9ZjBiVcUvnZjgf2c:O8bAuAfuIlHGEXTUqAcUBUuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635523612, "uuid": "dc41c9c6-358c-40df-8ed8-5d8b49a135d4", "value": 84440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635523612, "uuid": "a382b5d0-f991-4e1f-98bf-58b1906732be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523612, "uuid": "bd801723-0cfa-4445-9d9c-9f18e315e3d8", "value": "a4a8a89ce20e6f60d67140336e0a53cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e3a30a-38fa-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635540968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540968, "uuid": "2f7bd7cb-fc42-4a6f-a3e9-cafc8f21642a", "comment": "Malware payload (NanoCore)", "value": "bc9a97d3fa4fe78518563424e9922bdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540968, "uuid": "a2e97341-2427-46b1-8446-51f63628bcd5", "comment": "Malware payload (NanoCore)", "value": "c03005da40fab995feb7ab61994ce2421b206164e8a72192be8f3835cc2a5a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540968, "uuid": "48e98317-4a62-4d1d-9d12-c98486e1be03", "comment": "Malware payload (NanoCore)", "value": "1cfb0d2b29a772f7124c9291ab621bff356ad0f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540968, "uuid": "f8bfa244-c478-42ff-bf26-3694148810e0", "comment": "Malware payload (NanoCore)", "value": "d8b5eb42f9da82c3cc7b2288703c7729409e0e295748e88476d5b56235d995eb35b100a2b0dc981cf16118bae600f620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540968, "uuid": "30a17209-83df-43e8-85a3-13872cde95df", "value": "T1991512017BD18873E43329325A35AB246D3D7D202F259A6FB3E4296DCE310D16639BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540968, "uuid": "1a33afd7-109d-4609-92bc-b6cf56c93be7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540968, "uuid": "272f9900-1bf1-42d2-a1a8-dfc0e821cbab", "value": "12288:iQnk3GDYKGcblwtX+t4Y8P9pyhc3EuLfWd1X1TMtLoYZofwFTIaBojiaeDGs1Zd1:2AOcZwXY9hvubO1X1TMJIoL6i1hFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635540968, "uuid": "4dda5d3e-322b-4fc9-9499-39ff59dd4ebf", "value": 951336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635540968, "uuid": "a2eed6fd-c738-441e-8f1f-fb48c80f815e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540968, "uuid": "a3835e54-d98a-49fe-aa17-9cb3d0682186", "value": "PAYMENT-SWIFTCOPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf59ab91-388e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635494655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494655, "uuid": "e7072e03-83ad-4cc6-b530-cec476bf8c18", "comment": "Malware payload (Formbook)", "value": "44e50536f1d63ee7db4228446f5ae99f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494655, "uuid": "feb74a13-2b6b-406d-97b2-0fa73a868a0c", "comment": "Malware payload (Formbook)", "value": "c0945280218aa1fd2ed370b1331f7393d2b2313e27be7bfd523017dd324a10be", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494655, "uuid": "165876eb-2c7f-4566-8a82-39aa0056565e", "comment": "Malware payload (Formbook)", "value": "c40de858890f7297e50b0b2dd0644dbb482b7055", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494655, "uuid": "1dfaef71-3663-4148-972b-aed939f5bc08", "comment": "Malware payload (Formbook)", "value": "9992ed34c5c08c9416524b1b7348adc47d4be2bac68b3277f45c215d1b3b3cd3f12f262f31132f56c4470b9a13a0c87a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494655, "uuid": "b6556271-8892-4abc-8ea0-659bf55d39b0", "value": "T1D1A4E1281E601EEBE82672791B69B9180901FD52C3335F87C023BB3563BE594BAD09D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494655, "uuid": "82c2c518-3b71-4c65-a526-cc8f64993374", "value": "12288:wUXEZ7cykqAu5YYW6J2/c4yroBRSg7AnAvn/HOpmW/VE:wx4b52J/zr+RScAnAP/4VE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494655, "uuid": "75af1942-cf67-48ea-859d-93f807367ede", "value": 452104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494655, "uuid": "f5de2958-b39d-414e-a1d4-ee7239476d4a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494655, "uuid": "30eaba9c-b22e-4818-94cf-55daa696b006", "value": "Packing List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf0748a-3866-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635477419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635477419, "uuid": "0c41f6b9-0c6d-46fb-aaf4-cfd9fba2dc84", "comment": "Malware payload (AsyncRAT)", "value": "25442e649bc504cedd9a5cfb51801c10", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635477419, "uuid": "879b7a54-998c-4389-98e3-a0889150c08f", "comment": "Malware payload (AsyncRAT)", "value": "c18747e7433fe0aa7dc25dbac1b2788d5c0412ea5bbead7f395dbfe43a727470", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635477419, "uuid": "37e05452-21f0-4e13-aaa1-c91e2a6f3f6d", "comment": "Malware payload (AsyncRAT)", "value": "ff7de7643c31a0392d8eb3f2c95deaad4610cf51", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635477419, "uuid": "579f5cd0-8716-41bd-9213-aa284493e778", "comment": "Malware payload (AsyncRAT)", "value": "155e55b770d36b32dff1e5c75c7df3c648e4b3c0d34c7423f5540181fc00841dd5b6dbcd2b96ecb0fa28e3c20b2acbf5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635477419, "uuid": "db3adc6d-94f7-42e5-b3ce-296e74bcf710", "value": "T12774BE0167E59A17D7BE4FB614B300105FB1B8AB7D22D74F2EC820CA197BB850A51F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635477419, "uuid": "85d04ee3-f0c5-4199-b3f3-85be7cd3bacc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635477419, "uuid": "4e23cabb-61b1-4d8b-a874-db670824c9f5", "value": "6144:wwPY7yzPVLBCU/pucQWs/4dJ1rf4t6t7ShoaQ/0EEA4jue6QKZ2OF8pRI/:wwPY7Utl5QWsaH4tWk20EEA4KezBpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635477419, "uuid": "05f91a21-91bc-4526-89a4-4156970929c0", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635477419, "uuid": "79adeb01-cbe8-4909-8cb8-13f8b45d41a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635477419, "uuid": "41c8c564-ef8e-40d0-84c0-ba3dd6bf6cea", "value": "PO_Contract_ANR07152112_20210715181907__110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab024579-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635526806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526806, "uuid": "d9fc9593-5a81-4c1c-be86-3b699ac0e282", "comment": "Malware payload (Mirai)", "value": "cebbc18b7d1fe3e0fbc8cb925611ec41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526806, "uuid": "48dff3cd-26a4-421c-970b-57461c534430", "comment": "Malware payload (Mirai)", "value": "c22246d2d3dcf8101ac8c14bad175a57f65f5dab52395a63c7e13c11faf7e0ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526806, "uuid": "1ace6106-20dc-4bd1-8e94-bee634bb62b3", "comment": "Malware payload (Mirai)", "value": "85cb49a509ad91f39114b9400bfb5074f63dc4f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526806, "uuid": "e902dfd0-2475-4b6c-8b02-dc3ffa353027", "comment": "Malware payload (Mirai)", "value": "8e38032732f986251dc1ebd695961608007cb62626ad0c86a22cd242071ac096c4f891ff676bf764dc2a3486aee1f97b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526806, "uuid": "d3de1251-effb-4414-ae5e-2529a290fca7", "value": "T1FA735B4272280B57D5930AB02D3F5BE143BFEAD024E0B684695FDB669636E772046FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526806, "uuid": "661f84f9-f1bc-4ef5-a359-5e8c5cf553e2", "value": "768:zJowP2HbzRyEOHCFmONm4cC1sD6CoEDJ8H3IJW2Vf/ox5vwaCLMHyeHwsD5CSs95:9owPIzoC1sD6LkuIyx6aPsckISw0nvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526806, "uuid": "20caa5b7-885f-4a8b-a33a-817707271314", "value": 75704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526806, "uuid": "3168babe-44b1-42cc-a424-def9a69aa08f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526806, "uuid": "eb7d30d3-2669-410b-8566-aaf0b9aee8a8", "value": "cebbc18b7d1fe3e0fbc8cb925611ec41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d969d54f-38e9-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1635533756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533756, "uuid": "f5e30b9f-d77c-41f6-a1e2-24ee2acf2290", "comment": "Malware payload (BitRAT)", "value": "285dcdeb04d734b966c84a5607924818", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533756, "uuid": "d759e4d2-0e5e-4abf-9093-0380a4fbd3ef", "comment": "Malware payload (BitRAT)", "value": "c248bc78456cded97cf228eca53f878ef7b2a465eda411916e2b0a7ccd8a78ac", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533756, "uuid": "435d4750-c459-449a-ad3b-8c62d0f2c488", "comment": "Malware payload (BitRAT)", "value": "5776a19133f74c255b67307da7726d092662d7ed", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533756, "uuid": "b0899d52-4ce2-467d-bc64-302e78579d4b", "comment": "Malware payload (BitRAT)", "value": "7b506d911473d3ebf8305a500a7436328c47aee116bbe4ed23d317cbe279cc874fb239f4d850ab85dc69138eca6e36ef", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533756, "uuid": "8cc56d98-3021-4927-b8c0-ea2355d186a3", "value": "T1EF541200FB19E084C1D20AB3F65762D157A5EF21EA16E1CFAD92BBD22137BD70E5C249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533756, "uuid": "d6f83082-4aef-4ba1-ac3c-7da7c0be747c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533756, "uuid": "c7e16565-ffc2-4b99-b242-59dd797572c4", "value": "6144:sW/CENr92Z9atO0FiN6PI3qXEdcTPJx/PQ7zOdX1Xnc6BGb5PehHp2PxWRuIV:7/t2ZeGv3qUuJNCzOdX1JGb0hHY/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533756, "uuid": "033186eb-8b0f-4d14-9c79-6aa08a69cada", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533756, "uuid": "3ce45833-f73c-4d77-a340-4a39357420d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533756, "uuid": "3f94e88e-30fe-418a-9111-872809015aad", "value": "285dcdeb04d734b966c84a5607924818.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8753261d-388d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635494105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494105, "uuid": "709c7b1e-7305-444e-8df7-5d2b9fa36f86", "comment": "Malware payload (Formbook)", "value": "02be7f91d14bc87466f20caf24177c03", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494105, "uuid": "0a5377aa-0800-4b4e-89fd-d185f10a230b", "comment": "Malware payload (Formbook)", "value": "c2c9cb3c22b2f91e1d4c8f2df369592c49074f6094a91b80f79da0f54671cd83", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494105, "uuid": "5a9a3f39-9c84-4776-ac99-374d34ed11a4", "comment": "Malware payload (Formbook)", "value": "42e07aba2a184e70a8560fcce653f9528cfb7f25", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494105, "uuid": "16d0a21e-afdf-4ce2-9dbf-a55e0f8227bf", "comment": "Malware payload (Formbook)", "value": "62337999beb9ba58f6c2c6ca99090b1452bb39bb80af851bdbea90193b500d07c14252c3135bcd4130adeca557580a5b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494105, "uuid": "c482d412-7521-4c8b-a5ce-cdb7e1abdb90", "value": "T110A42379A4099CE653030D89CFC54BFB53A49839FBEAEEAE03501824DAA45FA51F143D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494105, "uuid": "8662d50f-ae6f-468d-a01f-872f30c78fd5", "value": "12288:jzmPg8oIICDrbrSVnr6FKW6ok38JUN74gAt1zYY+nTAb:nmP7VICD0oKWc8+N71At1eAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494105, "uuid": "67acc455-0069-4e85-93af-6b993b4a31ce", "value": 492242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494105, "uuid": "af250901-9137-4ee6-b2f6-95166df831e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494105, "uuid": "70836d72-2259-438a-9bc0-7ddd1e5e3cad", "value": "SWIFT COPY.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a71eda5-3875-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635483829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483829, "uuid": "b32f19c8-b228-4f32-af1b-408672a5d8e2", "comment": "Malware payload (AsyncRAT)", "value": "b0a0df688b278d6cb46a737d5e80999a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483829, "uuid": "7ee0d0a8-df3b-4139-a3bd-7a1677b54685", "comment": "Malware payload (AsyncRAT)", "value": "c2f18622d283e30b3512d724e53b40c3cfea9979a1866024ad5c23327972b11b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483829, "uuid": "c7bd1dbf-e343-4494-bd14-6f6dcf38ab4a", "comment": "Malware payload (AsyncRAT)", "value": "0616e5b625f1dd1e1f5abf5171bf156a79983dfd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483829, "uuid": "4066df2c-a712-4751-9244-a26d08306517", "comment": "Malware payload (AsyncRAT)", "value": "c0b36accb02fdc2fae7a2de49318bcc3c04527daba5fd7ede24f0c5a9b2e0315c0cf586a29be3aa1e28de7fb137fea97", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483829, "uuid": "017558ed-247c-4b54-9c4f-97babecdf3b1", "value": "T1A7734FC1C359ECB9F4293473B964E24C3B58AA1E91E9043E679DB14D347668320FBE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483829, "uuid": "f44999b0-e800-4262-8a4a-616dbc511630", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483829, "uuid": "b9333483-d89c-4a86-a5a9-72cec382ae13", "value": "768:jB04sms7y4O5EjpaPWfu/WYat7PTXDvt976xrXu5Me0:9sxOGBfu+YaZTXTt97KruM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483829, "uuid": "54895fbb-00a2-42d4-8f00-63571291c918", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483829, "uuid": "85b204bd-3f78-4b66-a91a-f3158bc849e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483829, "uuid": "df5633de-1f0c-4ac2-b372-bb16d2be3675", "value": "b0a0df688b278d6cb46a737d5e80999a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3317662-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635526793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526793, "uuid": "0db28c51-7761-4d85-b229-45c29d756958", "comment": "Malware payload (Mirai)", "value": "16744c9cf1bbbfaeade9f5977988b824", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526793, "uuid": "80666878-ce19-437f-b11f-40ed9486011b", "comment": "Malware payload (Mirai)", "value": "c3e4d04c1c08d349959481301566abced3fe338ea5090dd9d04eb215aee66a29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526793, "uuid": "7aa59825-d302-4003-a019-b116f96ec25e", "comment": "Malware payload (Mirai)", "value": "d058f2ed797a778e981f35d9103683f966535e0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526793, "uuid": "8d4673fa-8463-4fdc-9fd0-875c1d11b9b3", "comment": "Malware payload (Mirai)", "value": "d0d7b0809dd89bc53f56521789176ff492c7951f32396af59f82e941a1a9856cd32154de929edd704fc1b24adb395e0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526793, "uuid": "80ed247c-3529-4c4e-a5bf-5ff33c1427ee", "value": "T15843E862B8D26A2AC6D053BAF9AE558D332127E8D2EF3117CD211F117BC910F1DA3E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526793, "uuid": "214d1916-e857-4b5f-b09a-105b90aeb92a", "value": "1536:dmgmsccmoSlliQoPWzSJUbtDVhLo8AgmOoh+zCQN:dmgmszmEVe28VmrhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526793, "uuid": "e7ea2777-0448-43d0-95c7-c4a1ea34b26b", "value": 59576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526793, "uuid": "fe09cf16-f65c-4e9e-aa8a-650d697fad6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526793, "uuid": "d2fca1f5-3073-4255-a4a0-bfdf277237ca", "value": "16744c9cf1bbbfaeade9f5977988b824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec22afe9-38bb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635514031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514031, "uuid": "efbcce6b-7b76-4f34-b83b-5213813db2a0", "comment": "Malware payload (RedLineStealer)", "value": "b8d2d644a3ac5df8af9b3aff803f3347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514031, "uuid": "8c3dfbf4-95c5-494d-ae09-72be01c3bd67", "comment": "Malware payload (RedLineStealer)", "value": "c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514031, "uuid": "ee2c45f8-e903-456f-a5a4-5676cef94e99", "comment": "Malware payload (RedLineStealer)", "value": "062e29d59604956a4cffd64fc81cd1c3f72b0ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514031, "uuid": "cefa9c81-7bc4-4720-b911-0217430b178c", "comment": "Malware payload (RedLineStealer)", "value": "2ddbe31c3c179a14aaec28cd60c442d06f828c3e31bfb6599ea9b755db92e413d17f7e28cd18758494e6c0ffb3a764e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514031, "uuid": "1240d877-1009-404f-9814-cd2e774a28f1", "value": "T175747C00B7A1C034F5B212F859BA9279B93E7AB16B7494CF12E516EE4674AE0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514031, "uuid": "0ab37ea7-1c7d-4bfd-9d3f-fa9b2fd53a84", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514031, "uuid": "d24440b3-4c30-4ab9-90a5-eac5eec831e7", "value": "6144:NOTOeA4lwH4QNlDembw1wCuVB/cChQoyYtCv3ddx/W:NiOePwHjNlDePuVB/cChQoytjx/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635514031, "uuid": "a401b4e5-4224-4521-bb3b-dce2b2eec805", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635514031, "uuid": "8cae3ff0-7168-4439-a8c0-204576a24f6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514031, "uuid": "4bcd96fc-78f1-431d-88c0-b693e3b38283", "value": "b8d2d644a3ac5df8af9b3aff803f3347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0244917-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635530358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530358, "uuid": "a5589105-4f11-4b86-b956-3f380be177a1", "comment": "Malware payload (Mirai)", "value": "f0b0a882f505bcdc4d4052a5c0ebe77b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530358, "uuid": "bb8b75b5-d64a-41a9-aa7f-9adafcaffda8", "comment": "Malware payload (Mirai)", "value": "c49b523ad4866c7492c1df63eb98bb0da365d86e116d9a2737a31d5f0e3f758b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530358, "uuid": "e713db94-6c34-4f09-b51a-a5765bf96422", "comment": "Malware payload (Mirai)", "value": "d7ad40e7001c29f5f64fffc61fcdd2b1c03fd040", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530358, "uuid": "1630de1b-8f9f-446d-8722-262c00728fe3", "comment": "Malware payload (Mirai)", "value": "7e4e341d0507872f93c7c6ff8f2cd1de0a78bbe57878ed07f5accbc2008da3e59f185990cc4214ea9ff3461e369960c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530358, "uuid": "a22cbd9a-24d1-42a0-9d73-1cd1d255c2cf", "value": "T132132886BC92996AC6D0177AB62F118E3321B3E9C1CF3217CD245F0177C9A2F4D27A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530358, "uuid": "0f6159b8-e181-4b84-b651-976a44503822", "value": "768:Er2NsjOmtxjyUcgAd+nKjyxfEa7r85QwQSwl6R0oNcgSIqbIBNE5:e2aamtxTjo4ayxfEaMWwQSOOrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530358, "uuid": "b8307708-56dc-4085-871f-7853254b7958", "value": 44144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530358, "uuid": "34a601a1-4ce7-4174-bd94-44a56c5ba772", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530358, "uuid": "cf9a517e-b148-4cde-a59b-27ebcf110e1c", "value": "f0b0a882f505bcdc4d4052a5c0ebe77b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e651a259-38a1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635502854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502854, "uuid": "91b3cb84-2732-48de-a37a-9e71119beba0", "comment": "Malware payload (AgentTesla)", "value": "3c2280fe47b1d1d24871627704e92dd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502854, "uuid": "661b08ca-0113-41ba-ac31-c18b6f742a0b", "comment": "Malware payload (AgentTesla)", "value": "c4c447525182c270d5afcb163ec26b09813651c1b401b8e824dcedd231c27f91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502854, "uuid": "b84f8a96-3f2a-4b5d-a9ba-54371d20498f", "comment": "Malware payload (AgentTesla)", "value": "ecad40c4a083a411be3d0e9aeed4186f7492089b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502854, "uuid": "24f55c67-a921-4774-bab1-1d5acd85124a", "comment": "Malware payload (AgentTesla)", "value": "4086dc30f70c8d2848fb8fd59d07781391a66f55adc7d07265b68290256c5b0ed8aae27cb7590f072afa5ec53733a491", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502854, "uuid": "e15d959e-9d9a-4001-b42a-d332b29b5201", "value": "T13294E049633ACB6FE5BC03BD0093162507F1A8627272F7464FDA74D61923B825E05EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502854, "uuid": "ab855688-fb03-4baa-abcd-de93762196aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502854, "uuid": "4fa90d81-9374-4ea9-b1de-8166db3f0c37", "value": "12288:mlfZxCqBd9cUgYQkc4yjm/wh3S1GcV0XyuzqBdPRMvgbKFbZb:mlfZxCrOeDEwcoYVfbKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635502854, "uuid": "bc4b5493-7965-450e-b9aa-39974b0e4369", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635502854, "uuid": "4e15212d-fcc0-4615-955e-0f78ef59c3b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502854, "uuid": "237ac7e1-d04e-46c6-b597-e479eb125863", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906abe27-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635526762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526762, "uuid": "dbb3159c-625d-4edc-9a4e-11ff7ff5b6e1", "comment": "Malware payload (AveMariaRAT)", "value": "ecb7f9450d305c52cd6f5163bc96e671", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526762, "uuid": "4277c08f-3291-4795-a53d-027f2de93fdf", "comment": "Malware payload (AveMariaRAT)", "value": "c525be8a6505c9948facadf301e1b3a4f571fed4ee0e9fad88705b69c65685d7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526762, "uuid": "b9c7d1f7-6e54-47c3-95c2-c01a577652d0", "comment": "Malware payload (AveMariaRAT)", "value": "0e90b3dbd96f561ddef9f33835105e692030b34a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526762, "uuid": "50d5f457-f794-48a3-b219-5e5c81998ae4", "comment": "Malware payload (AveMariaRAT)", "value": "39863a7d47947650f8961eda41db949cef2c426145bed2a4313f1bd963107a0bb62ed4e37f7baa3e76256d2999ddb6bd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526762, "uuid": "0e34cfb2-e7d3-4ff8-94c8-a194ef138792", "value": "T136552A0AB348FF97D21E5E34D80F9D2883E19D676231F19F39C8BDD621A4B424A5F162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526762, "uuid": "d105d728-767c-4a95-82cd-26cc941f22e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526762, "uuid": "5b075831-2123-43d0-b868-4b49f168edcc", "value": "12288:CClFiUAGChjtjG1OlREwdZxjjr/T+x2/P4VgCXrmKsr3S5NTA7CJqwd+cj2y6P5Y:3Ept1EoP+xkaSC5dAMqOIT5fomzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526762, "uuid": "79474076-0fbb-49aa-884a-f8b3f5fbc576", "value": 1345024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526762, "uuid": "a9745661-1b11-4508-8a4d-a114eabd7e1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526762, "uuid": "41bda2e2-cb5b-42ad-b3e4-82e0d7e7b38a", "value": "Order291021PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67aebb7-3883-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635489996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489996, "uuid": "7dfc5fdf-cace-411b-986d-db6b27bcb10c", "comment": "Malware payload (Mirai)", "value": "19a64fd8453f5d71574f2bd0449b929e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489996, "uuid": "c7d6b809-df13-46ed-a937-f39e8d16470d", "comment": "Malware payload (Mirai)", "value": "c6ca66cfc84db3220cb4fd3868baa3d52e9d33a92a729eb5b68f3f920a697999", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489996, "uuid": "5ba310c6-6b54-4b45-863b-e2676be39718", "comment": "Malware payload (Mirai)", "value": "6794e7ccac682d1a828781ed690d9944c827b098", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489996, "uuid": "233e2690-25f3-43fb-98ec-7bccc46edbd9", "comment": "Malware payload (Mirai)", "value": "dba689137c0bcf3513e9abe54b696f0f2d9484dc8e9b79283b5054fd4797ee7a556f4bd2732266c6a1c0f83f0b173044", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489996, "uuid": "7f9c3d08-101b-486d-8d74-3e276f651bae", "value": "T126338DB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6699043EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489996, "uuid": "cf64a3ef-2bfe-4e1a-9f74-423bfba2e0e7", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvh:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489996, "uuid": "b9cfcf1a-4696-43cf-a8b3-8d0a8e171d10", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489996, "uuid": "1362e416-09c1-4187-8782-f9cf36798358", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489996, "uuid": "e48ec6ce-e3bb-4167-801e-9d7cdcd60464", "value": "19a64fd8453f5d71574f2bd0449b929e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9530c4d7-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1635485538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485538, "uuid": "dcf8bb0b-473e-4524-a992-8cc868a8be54", "comment": "Malware payload (DanaBot)", "value": "cdd0148296b5a112d2401d3923e92df5", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485538, "uuid": "76e42d28-93f9-4db2-bb8a-cca6c8990ae5", "comment": "Malware payload (DanaBot)", "value": "c7518bcebe1116c9972db08a2fe2461351e21cb65e7659cd806324364bfea2df", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485538, "uuid": "7568aaf9-adf1-45de-a8e2-adcde8335894", "comment": "Malware payload (DanaBot)", "value": "71adcf6712d3c73eee5ab27f7b3d69948943b558", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485538, "uuid": "816da3a5-cd86-4912-9e5e-c963f2853732", "comment": "Malware payload (DanaBot)", "value": "07d526356a8508883196da3a814baca00c15ad1674340aad44161835bc9df47d9cb7500041cc82a9ab38377b6a403e04", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485538, "uuid": "70d9065f-1224-467e-906f-9d4468ab1196", "value": "T167C54C2033B69812F273133598F3D0E09ED8BD6299B4AD4B70C23B5F049F6D29A5975E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485538, "uuid": "827c3196-5284-4f37-bb5b-19899633b4a6", "value": "b54d7636c9d54e7ee562c6b2af7354af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485538, "uuid": "30054247-3dee-4abb-9afc-993b7f46e559", "value": "49152:IgZziYTr//Ynt2Z/fZMdzUAOC5n+LlrxFTGWQKq:I0ziYTst2Z/f6AAOGarxFTG3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485538, "uuid": "aefa21f5-7729-44d9-92fe-c18b0c65cdfa", "value": 2588672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485538, "uuid": "64292bb5-e160-4be4-bd7b-58582e2298c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485538, "uuid": "0646c6c2-6366-4d69-9d5c-b061761d157e", "value": "cdd0148296b5a112d2401d3923e92df5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1a7558-3869-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635478461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635478461, "uuid": "9639d080-2faf-45c8-9c7b-3fd368875eb1", "comment": "Malware payload", "value": "2e50f342a110b0c7b1262aacb83a38a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635478461, "uuid": "8c44855d-c576-44c4-9d7f-c8008d57fc75", "comment": "Malware payload", "value": "c7fd84c45e42ab7df569c3c57b014bfb470621e18b16f9322a1ac2acadad9b91", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635478461, "uuid": "5d6545ff-8e3c-4505-a885-a81735306f2d", "comment": "Malware payload", "value": "e264c423ddbee952047b6111d99f89e0334e89bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635478461, "uuid": "4b546d27-1ba6-439b-b7d0-bb11eac20f77", "comment": "Malware payload", "value": "1a79e72b90fabb266d830a1f4c5c1f9055b3b8901ae14294f09dad833a85c15cd7b8219f050c3d8fd62837ed628fc21f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635478461, "uuid": "72854d92-a64c-41b3-a25e-113c204acb3e", "value": "T1BB825211A8D508960233C0956BB19F58FF659213C7138F0436FC6B939FB2E7AE943A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635478461, "uuid": "40b107ef-a941-493b-a531-e88e3d894cf4", "value": "192:ShDbPtzokndZ8T4Ml9PThJIhwVIhwVIhwVIhwVrBolXByhDPp/Ysb4i:cbpnibhhho2PpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635478461, "uuid": "fca022ca-2d01-4383-abd0-13bda654a3e4", "value": 18233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635478461, "uuid": "ded3c200-3e77-441f-b33e-848f4b1359c1", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635478461, "uuid": "8090fe9a-4a69-40e2-b81d-ecfc55fea509", "value": "new 25.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6d2713-3890-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635495593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495593, "uuid": "5d508c13-1fb4-4678-9aff-0e488153c139", "comment": "Malware payload (AgentTesla)", "value": "445d56e1b3add78d676d0526178e382a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495593, "uuid": "dbcaabb5-04e4-4d7e-b5e2-729160756549", "comment": "Malware payload (AgentTesla)", "value": "c8a3b48f0633372f7f0279bb69ab38779649b51181ad06d03f444a6cb2dd4d8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495593, "uuid": "c6649364-e43c-4d00-9938-32eae16005dd", "comment": "Malware payload (AgentTesla)", "value": "8f6878472eb591c4de28d7eafdc4a0ec93de8469", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495593, "uuid": "c79aeec8-e4b1-495b-9978-4e5a5c781177", "comment": "Malware payload (AgentTesla)", "value": "a7260aca2dd3203cb69c56c004beceec383e9fba18448f1997f0bbd36496e32feefadd0d7982d45803de7a04cd9d1eaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495593, "uuid": "71988bec-73f2-42d5-a31b-9510e28aa9df", "value": "T1858423A8EE439519EEE0AFE4E8EE20B4B45BCA007FD97CDB936109C448F5DD1442927D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495593, "uuid": "bf69bfdf-7957-49bd-b906-87fdebc53256", "value": "6144:jx944m4jnMbciPpeMTSHeP8J0839U6G4Vf4+wH8ZkbZdv7i3RHbuwVz4Bv4G8U:tjPwpefhNZRJ4+XkbZ9ulLkR0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635495593, "uuid": "b6458785-a514-4e8c-929a-40590a7029ac", "value": 392132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635495593, "uuid": "976f97d6-a974-4085-a7ba-4d0aaa39c551", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495593, "uuid": "f7eda3d8-d641-4ca6-8343-8252e900aac1", "value": "payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eaf3375-38d0-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635522786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522786, "uuid": "6a1b2879-59dd-4b22-b411-b90022ea9744", "comment": "Malware payload (NanoCore)", "value": "3ea7bd2fb52842ea458767db3b9a3189", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522786, "uuid": "f377bd72-6841-457c-9c03-c250b6fb6e74", "comment": "Malware payload (NanoCore)", "value": "c8c69f36f89061f4ce86b108c0ff12ade49d665eace2d60ba179a2341bd54c40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522786, "uuid": "bf29cf98-c59a-4e46-a3db-aaf2f2c0bd7b", "comment": "Malware payload (NanoCore)", "value": "a7e5bc074c3f2f318c5c38961d2d714b181f5aa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522786, "uuid": "c4e91555-18fb-4410-9f40-18f99af72842", "comment": "Malware payload (NanoCore)", "value": "1099e9ace1a144a8a9f9b1614db02863a48342e0efe0e8bb0571db19cc10c22181c5bdb061f80f6c524b7b87c6e4e3ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522786, "uuid": "0492b0e7-1e8c-47ab-807d-76c25434fa03", "value": "T15B14BF567BB98A2FE2DE897971121247833CC2E3A9D3F3DE18D454B68B623E406471D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522786, "uuid": "ac37d28b-09f6-4a6a-be6a-7735d93b6a90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522786, "uuid": "1b0bfe35-5d86-47c4-802c-32c9eb6d3552", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIn50EhIW0DJsuNRBIEEgmzSX:gLV6Bta6dtJmakIM5HEIGuNR5RXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635522786, "uuid": "e6b806e9-a55a-414f-adf8-a27feef58414", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635522786, "uuid": "0d0e97d7-5f0a-4097-9ed0-ce7da05b092a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522786, "uuid": "7aae68c1-3f0c-4793-a7a0-5c44af1694e7", "value": "3ea7bd2fb52842ea458767db3b9a3189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4891e816-38d0-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635522776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522776, "uuid": "d44271cc-c774-487b-bdc2-4b2127c0e48d", "comment": "Malware payload (AsyncRAT)", "value": "56d21a87c6fa6866a2eea06b1de91add", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522776, "uuid": "7d0ae191-0744-49ba-9b0b-ed5d3495507b", "comment": "Malware payload (AsyncRAT)", "value": "c8dec500839b3698755d9304442aa9f3516218b7c6340e2b1202dbe83089ab1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522776, "uuid": "f9952c55-7390-4851-85ae-e4ae0781ec3d", "comment": "Malware payload (AsyncRAT)", "value": "19be4776836f1a9507d7a3d5f0874c8d1743acd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635522776, "uuid": "a1ab8886-5777-425c-a260-7f86c8fc02c9", "comment": "Malware payload (AsyncRAT)", "value": "71b7fc650e661446847995d315c8e01dd4cb64aecc371aff76170e42d2912b7e4665179a6c480c4bf87be70799f65172", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522776, "uuid": "20ae2df2-96d7-4af7-bb0e-52048d0443c3", "value": "T177232B003BE88127F2BF4F78A8F22145867AB5736603D99A1CC455D75713FC68A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522776, "uuid": "204abe19-dcf3-44cb-8d12-4cd61e53bbe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522776, "uuid": "d78ed276-aee4-4126-a60f-cd52b4ace2cf", "value": "768:zuScq5TAYGTqWU8j+zmo2qLX4355tByx1PIUzjbOgX3iiGxyqC5d3KymKczom+Bn:zuScq5TA5c2g4p5VU3bxXSiuxCuL0Hdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635522776, "uuid": "9cebe09f-5691-4e74-a94a-81510851cd6b", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635522776, "uuid": "a58df5aa-e665-4b9f-8ca6-408fab3eaec4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635522776, "uuid": "f434e822-c45f-44be-be76-b050b6f4b38a", "value": "56d21a87c6fa6866a2eea06b1de91add", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe234f8-38e8-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635533284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533284, "uuid": "727fd624-de8a-4eef-a5e7-af9eb380b8a3", "comment": "Malware payload (Smoke Loader)", "value": "5dbeea7d44527a3a1c70dc248b0e7be3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533284, "uuid": "7ae54aa0-1477-4d34-8e75-66467c57c4a3", "comment": "Malware payload (Smoke Loader)", "value": "c9bd78ac59ce660def6f08864484f17d7eb2f75a31df8ae874cbef025974b7bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533284, "uuid": "d2a11b8f-d4c5-4479-8120-4459fafb326e", "comment": "Malware payload (Smoke Loader)", "value": "0c89ef97d6b439b68de6f09a12297e7b42d3b809", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533284, "uuid": "c3d3ca45-2400-4701-ba0d-c918146401fe", "comment": "Malware payload (Smoke Loader)", "value": "bcfdaf2d6ccddca4fa2844cd9df69bd0edbad4b9e37f54c9a3fbe6a33ade50dab808f728bc2b868a61dc9441c371c6fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533284, "uuid": "19bdd29f-2a99-4b3f-8396-f83a493596eb", "value": "T195748D10A7A1C034F4B212F8597A9369B93F7AB1AB7490CF53D526EE86746E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533284, "uuid": "c19b1d63-7e53-42e2-81c5-582aa6c2efc1", "value": "4649591756a77695954d3f167e28cc87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533284, "uuid": "bf49b12f-ae9e-4b5e-adea-b296b11a4474", "value": "6144:KSTMNZ2amDfEvOOfrch4Mc2U4Td0UpLV:KGMNZ4DCOOfrch4Mc2J1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533284, "uuid": "62e0c077-ceee-4e30-b1c0-01738c4ade5b", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533284, "uuid": "3986a6ec-11c6-4c9a-b7f8-927a89aa6a95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533284, "uuid": "95e2a466-0b9f-47dc-a40c-37a4b7e0bdf2", "value": "5dbeea7d44527a3a1c70dc248b0e7be3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63794472-3888-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635491897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491897, "uuid": "e86fd84e-cb12-42a1-9e31-de2fe4d516ba", "comment": "Malware payload (Loki)", "value": "6b4f5ec658c3a02715214ff6d7a77ce2", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491897, "uuid": "a0c73ff0-ca14-4464-a814-5ae4ee26642b", "comment": "Malware payload (Loki)", "value": "cc26df8fedfcf0ab9b2677672e5ff8b36b92d272584d88310d1151e7a727bae0", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491897, "uuid": "41491434-495f-4040-b6bf-feb6a74ad843", "comment": "Malware payload (Loki)", "value": "42d55699cb9a2bdee24ea3155237bce8762b80c5", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491897, "uuid": "ec5f9dbb-c996-4212-af84-14420d978917", "comment": "Malware payload (Loki)", "value": "11e202c1080f80e74a411bea65accd469519a2fb4d22dd6b30ab95bf764f3250a100006759be02bb72fbce00c47b4d18", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491897, "uuid": "7f708b2c-c8d1-441f-863e-c28b9dcad60b", "value": "T1A56423C9029E8F25383084397EDF8268B55FCAB7682136D7DEB1716D4CE650612CBD3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491897, "uuid": "a47471d6-bdf7-41a6-94cc-21d591983c83", "value": "6144:VRtmvCGaDIachzF58RPfdfgTldG4uuxMGkYTjb5qLm8nPMhIz2Bynkl:ZmMDIacFFWRntgRdxuoJn1UJKInnkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491897, "uuid": "aafd13fe-a9c7-4014-8da1-cef322bd0647", "value": 309457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491897, "uuid": "fcce4058-a40c-4ab6-8586-0f62ae693ff8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491897, "uuid": "be7338c3-7243-49c8-bff1-90859469ca6b", "value": "Orden de compra (po) 2112 #.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520f1308-387c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635486714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486714, "uuid": "0988e018-f3f0-400a-8325-82806b1ea58c", "comment": "Malware payload (AgentTesla)", "value": "fb2f1d09f4f2b11442ed4f1aef91420a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486714, "uuid": "9fa70a55-f443-44d8-a691-84908f5cdf91", "comment": "Malware payload (AgentTesla)", "value": "cc9bb2383da12cb95bda65cfaeaf4ac03e0e141e9f0654a57b8d2827fb825ad1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486714, "uuid": "f0eccdbe-a943-4dc6-b66c-84b2b2425663", "comment": "Malware payload (AgentTesla)", "value": "59019b52443dc824a6170f8c10b961132887dc5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486714, "uuid": "4151b025-0621-4cc4-8e12-52d673f97065", "comment": "Malware payload (AgentTesla)", "value": "5338808a06b873af2fde9e19eef0d84ed396e1ede15c53290c607c7cafa9978c88f85a4bf843388b0c8ac369d1b0d070", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486714, "uuid": "4e6fbe78-b314-438b-b8f0-24e644180c11", "value": "T152F4CF3372E1AAC9EB7A5FB45C21E1705F633D636624E11EA9D8BCCB32F91214C61E41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486714, "uuid": "53c645f7-c5aa-4fac-bde5-491e75b8abde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486714, "uuid": "8b778f30-b52c-4067-ad7e-eca427385d93", "value": "12288:B2KQ5ZcqJFTP8kKYaTLRf28En4Hs7QvzZvhCEvUOL+nzg++++4+++++++0+++++D:B2KQMqokKYaTd2Z4HKQV7jA8++++4++4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635486714, "uuid": "5745c024-1375-4120-8d18-bf097de8d365", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635486714, "uuid": "9ceaab93-b3bd-45ee-990d-4008b5d1efea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486714, "uuid": "51af3846-cb87-48fa-a43f-bd0687ab84da", "value": "URGENT REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cdb03d-38e0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635529917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529917, "uuid": "db7ce8d8-acac-4dba-b358-5d91d7e92233", "comment": "Malware payload (AgentTesla)", "value": "5ec9c96321e7a77109e6cb5ea58de9c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529917, "uuid": "ee5d2a63-8b98-45be-ad4c-09de96679f62", "comment": "Malware payload (AgentTesla)", "value": "cd7ca15cbf364010f205472f863773ae99f1474dcb846419973b476226832ff6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529917, "uuid": "228a8a01-52d3-4df6-8625-ef2c2309bebb", "comment": "Malware payload (AgentTesla)", "value": "9ca6eb4c719b2ab5aded85707ee1dc81ed803b34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529917, "uuid": "eab379c0-87d9-4869-85f1-79236bae5191", "comment": "Malware payload (AgentTesla)", "value": "fca875265249cdcf64eb302592f977756d1f1441a94e3bea39b722b156eb7bf78f0ab711f38080e909c72b085b5f4a69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529917, "uuid": "b5809bf8-2c8a-4c1e-b907-34c413b6a3e3", "value": "T1C4840101B314AB97D47C43B810A3906163F36855B630DE026EEA71EF2EB3B429D55FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529917, "uuid": "d6fe2b91-4582-4b1d-9672-b7e361f3eb07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529917, "uuid": "238f3ee6-014b-48ae-9345-4f8debf74284", "value": "12288:+LW8bQYQ+5VCHg0hcVJO07ds8w7yL+3UYI:fuI5mF7Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635529917, "uuid": "f5ea9f3b-92e0-468d-b83a-6407ab432835", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635529917, "uuid": "adedd67d-12cb-4d7b-a60b-3a190582279f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529917, "uuid": "8ebd4ea0-f97d-4bbb-8210-a367da0e3791", "value": "factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52fb3d7-38bb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635514019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514019, "uuid": "9e1e422f-9cf2-4a76-abe9-588da9529bb3", "comment": "Malware payload (Formbook)", "value": "fd8fe926ad1f112186731ecff083867a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514019, "uuid": "9337de7e-a618-4644-9d75-ab0239135883", "comment": "Malware payload (Formbook)", "value": "cd9c2941f474d97ebaf1b88641fa3153958c8936939b77e0a62fb19fa488b25f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514019, "uuid": "b25f76c1-b803-4620-af9a-20765a801a44", "comment": "Malware payload (Formbook)", "value": "c89aed5e187d24028e2716a5b5696af89a19c08c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635514019, "uuid": "7cb74633-c8e9-4736-82b1-7c739e337f83", "comment": "Malware payload (Formbook)", "value": "20fdf83b1c457e715b0017766c9acd56a536dbfcc6a491075712dfadd46a136a2549dd3ccf84182fc76055de4557bbac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514019, "uuid": "a37ef368-8e94-4def-92fc-7013c783c050", "value": "T1A0B4BF3D7E196A73D276C235E4DA0006F2AC66873232DE4B15D7234C654BB93399A3CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514019, "uuid": "098537ab-aeee-4812-a864-454ef4ae934c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514019, "uuid": "5ee8048b-c83e-4b16-a313-57c55d586aa8", "value": "12288:BikLk63bU8yXtX5kvBhth6AAxp/ki3JMsA8/:KOmk/thnopOsV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635514019, "uuid": "7855048d-7f8b-4a29-971f-fa501c021e63", "value": 516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635514019, "uuid": "fc9645ee-1de6-44a9-8ff7-f92801f2abe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635514019, "uuid": "ee339ceb-087d-48a0-b711-6f3d9a53e828", "value": "fd8fe926ad1f112186731ecff083867a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ac004b-38a0-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635502343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502343, "uuid": "ec3a35f8-788e-4cfc-a03d-e887b5d26090", "comment": "Malware payload (AveMariaRAT)", "value": "3c300b540fc9aa7a498196f5bb47aa57", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502343, "uuid": "f3f5c928-d793-4c19-8bb1-1a526234ea35", "comment": "Malware payload (AveMariaRAT)", "value": "ce101044af5711028821771e3626df59a8e3505f20bcdd001e6727862f0d1286", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502343, "uuid": "d9268537-42d3-4d8e-921e-e660be4fcfa9", "comment": "Malware payload (AveMariaRAT)", "value": "b865e4dddf5ea4a4e7a121e27cc354b72f7df5ec", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635502343, "uuid": "94fa4d9c-95b6-4462-90ac-dadb488bf021", "comment": "Malware payload (AveMariaRAT)", "value": "b57900ff7ff5ff1d3b33a291da9d1cf6928e1434989aaabc0fb65bb7aabd10219a5d2fdfe7527f92a3c4bf682e2bf7fa", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502343, "uuid": "de7d54d6-6b76-43da-86b2-887201f6d477", "value": "T100641209412C0806D8D305F35F239D684A3A4D672DE4498B398DAD9C9F6F7ABDB73163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502343, "uuid": "e422b60a-26cd-4cb6-afe1-2ce7ff0b6a41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502343, "uuid": "296ce469-8114-4638-b9dd-6a1443697102", "value": "6144:1KpeT8XlkdWz0ppPtuLbfFNxBoQAoLCfBMByOHUDamY28:1Kp7mdWAtuffFNxBTrOfaByOHU5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635502343, "uuid": "5960fe26-c0e1-42e3-a5e6-324a990e52f6", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635502343, "uuid": "4485f87b-d6f6-4fa9-a8d9-10d80c434f6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635502343, "uuid": "3fdb76c5-cbce-4fc0-b09e-806f71603978", "value": "Payment Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf83371f-38b4-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635510976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510976, "uuid": "47f2b2e9-3bb5-4532-ac2d-4b67826c972a", "comment": "Malware payload (Loki)", "value": "f423597222898a097d30adbc3d168a87", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510976, "uuid": "ddb505cd-8451-4020-84ed-5027904b6c61", "comment": "Malware payload (Loki)", "value": "ce8ca35bad6b0e2c5aeefed0b34b09dff56fdce32d14246c011d9401bc6e3ba2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510976, "uuid": "d0caa6b8-6a1a-48bd-858f-990035b56b01", "comment": "Malware payload (Loki)", "value": "e199e53576397ee7296e3b0f5ad3cee1ca147e06", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510976, "uuid": "53277728-30b6-46f5-88a4-b029a95ce862", "comment": "Malware payload (Loki)", "value": "4e79c64fe4ede0b8499eb39fe6f1a66a22bcc7ac93d174da17380960f661eb02279c28ee51520f770827e8e9f3161950", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510976, "uuid": "19cd934c-8a9b-45f0-a287-7b4659d0590e", "value": "T13C451217CC139E93E56AC3BCFF470CBE5B0D2A08E59273FA21701D9E6B146560E8B169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510976, "uuid": "8b3c8a7c-70d9-4d66-9409-6d3e7bfdaa91", "value": "24576:255oRnbSj9MHjjAi5hyIjZ5RtA81w+mx3/2pWqi4mtVO:S5yn+jIAi5/Z5Qsk3/2X/0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635510976, "uuid": "9ca7f5de-cdf2-492f-ab0f-cfde3720dc87", "value": 1165341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635510976, "uuid": "c9427129-c5fe-49ef-bf40-658d942e1baf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510976, "uuid": "17db3ce3-96f5-421a-b9a2-51a2dc33781e", "value": "0022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be564554-38f8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635540153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540153, "uuid": "11b0b1e6-d4de-425c-b803-f5c6c23e2f68", "comment": "Malware payload", "value": "088e80a24debb252fdf1355384bfab8e", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540153, "uuid": "22cbd649-0197-4c20-98bb-90b79e559dd3", "comment": "Malware payload", "value": "cf7df6863ec2d98c6ebf48de6219956d012bb2a6dd1af9eb9502ffecd7c75b72", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540153, "uuid": "cc98e8ab-2fb9-451f-a4f7-003f1b4f7982", "comment": "Malware payload", "value": "e659b18c190a802062e58a6af01b675f3a9a2518", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540153, "uuid": "56e8f5fa-f4b8-413d-8887-15e78b126bc1", "comment": "Malware payload", "value": "b00c84b7dfcf1a20af960e82665bbb697ec717d1a169c4b89b0384427c85589ee60ae57ef364f8971c32570cdcc4fdc3", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540153, "uuid": "79db53a1-bda2-4fb1-9e32-793ea71f99e3", "value": "T16AB243BEF59B0E489E46D679051ABBA5064CF51C728444E237BCDB383B5C91B8B22D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540153, "uuid": "50996f1d-29ca-4561-9e10-1772376655fa", "value": "384:vRdQnHNkspOlwHicccv4IZKr1I7OeVJVRHc4GjvB1XUY/4Z7Zv4serOg9B:vR+ntkspJ4IZKr1SejvBbgnwfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635540153, "uuid": "62ac5297-383e-47e7-b9fe-372d06ef56a6", "value": 25073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635540153, "uuid": "c9df2ea1-47b3-4ec4-bc9f-68a612764414", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540153, "uuid": "e2e6e080-d402-4b59-b08d-54715776b934", "value": "088e80a24debb252fdf1355384bfab8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2928e9-38f9-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635540660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540660, "uuid": "feaae2d4-f417-41da-b496-87c2654eaa4b", "comment": "Malware payload (RaccoonStealer)", "value": "05f6a0e8f711fabbbb97a544f92fc25c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540660, "uuid": "90ac1495-1b49-443d-b4d2-1fbe1e3b09fc", "comment": "Malware payload (RaccoonStealer)", "value": "cfa7b4b4fc55791d6fe487f6945550af8b4e76b7642c417498ad519131c70e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540660, "uuid": "4cef638d-8e1f-4f0d-b3a9-00a0312d974c", "comment": "Malware payload (RaccoonStealer)", "value": "cb3f23c411a215093e77b532b9a4bc7c8a50b326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540660, "uuid": "81e9f041-8263-4d73-9ad3-d3dd65a7817a", "comment": "Malware payload (RaccoonStealer)", "value": "cb62b3d8fa5b12e1fe8e388cf72bed6cc81420f28be6f7790eabe479f5e86dcf50b993b02b92536bca28222c2e29f6f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540660, "uuid": "7532e171-3162-4804-8f63-c3034b8f284f", "value": "T199D4D000A6A0C035F5B662F9497AA268B93F7EA16B3454CF17D616EE4770AE0FC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540660, "uuid": "c48dbd46-df85-4b0a-8a2f-076c06fbfa24", "value": "518d84bc9a231f5bb2827b0550b9f86c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540660, "uuid": "f213c961-ae0c-4dac-830f-0521be9e86d4", "value": "12288:uKyhfDDIqy8V4RVZBhrMAi61KGY73rxAlITWa/c6SK4kM8:OZ5Ra3ZBhgqUZ7xAGTph4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635540660, "uuid": "5d45b98d-6154-465c-b558-872c7207eceb", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635540660, "uuid": "b70830c5-319f-4f2a-b674-0dcf22665090", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540660, "uuid": "bad29177-c05e-43fc-9c7f-45a67647e8f6", "value": "05f6a0e8f711fabbbb97a544f92fc25c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e893c34-38da-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635527215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527215, "uuid": "1fb0ce31-d339-48d2-8aa3-5d345f19360a", "comment": "Malware payload (Mirai)", "value": "2e9a1b60a7be6a8259340ae7ec41fffa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527215, "uuid": "2ceb8245-25fc-4587-b897-43f7aa64d391", "comment": "Malware payload (Mirai)", "value": "cfd32f3e2de9abd7e05e8055091997994a062ea187a2e86cfd82bc8eb43a5123", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527215, "uuid": "d2c3761d-0a4f-440a-9ba4-42fd536c5241", "comment": "Malware payload (Mirai)", "value": "91571ed5fc8f3dba4d4be6f600191c653c8082ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527215, "uuid": "aa953672-3b5f-40b9-91e6-70863f269eb4", "comment": "Malware payload (Mirai)", "value": "1cf0933aa3b503ac70451c3ee7d11f77b03f9f49d5f426d2d344a99c338dfd57f57f0e67701ee39083ac10f46b2225b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527215, "uuid": "c9660a68-f083-48b1-bca8-fd438af30050", "value": "T101A3D715BF210FB7E85BCD3719B92B05198C654B22E97B367A34D818F64B21F29E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527215, "uuid": "84466af8-f8fc-4f06-976a-350e4c335f43", "value": "1536:0T+h2EiDWyS8gKoGWewUHBb1PQh6R/S8ZB+KZ0oApR7qD:0T+h2EiDWyaoWJaB5cQB+Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635527215, "uuid": "ade788b5-378a-4e6e-afb1-065ca78b82a2", "value": 101688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635527215, "uuid": "a38a38e3-22fe-4fa8-a6b0-8930a82f8c6b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527215, "uuid": "84272db8-38d6-42ff-a5a7-0a9ea0a26158", "value": "2e9a1b60a7be6a8259340ae7ec41fffa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490db092-3888-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635491853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491853, "uuid": "80b65e09-1a2f-423e-aa33-0cb44756e78a", "comment": "Malware payload (Mirai)", "value": "5a1e1a7b781e9c5e5f2876d3a6176c08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491853, "uuid": "e00a13cf-0faf-4f09-8c59-ac7ecc1cc304", "comment": "Malware payload (Mirai)", "value": "d1019d1c2582bf3e72ed7f43afb18aa3f41822cedef38bc102d286a82b3acd47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491853, "uuid": "c09f8957-2ed3-403a-ab11-98003dcd5aa7", "comment": "Malware payload (Mirai)", "value": "567a9abcc6a9544c3af0bd5df7ca609cd358ce43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491853, "uuid": "5d6a1b90-346d-4f38-aebb-041e6127ccb5", "comment": "Malware payload (Mirai)", "value": "2950dec1aeb71e878b52a5d51a3aef6901f67945770afbe21b5e2271fe54f2149891bc48dab34cd81734e7b75e559cb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491853, "uuid": "30b74f79-48eb-46c7-a3a9-2086940542f0", "value": "T187239757F5F34B92EACE21F6FA4D314AB61747A8F2FD6213EE201E9076C285B09518C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491853, "uuid": "2f498f3a-4457-4b12-ab85-0f8e1e86e207", "value": "768:GGn7TzrMk3oXC5gl5L0vQGP550TU5DJmPfMVO3i0IUr7a0x1V2dKR:GGn7Xgf0oGR5QYInMYi0I27a0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491853, "uuid": "f433ec0f-e609-40cc-9b7a-f9600ccf6678", "value": 48532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491853, "uuid": "6f5dd912-f28d-479c-afbf-b611d77ed25c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491853, "uuid": "4869bf63-af8e-4aca-90f9-8fc7552a46ee", "value": "5a1e1a7b781e9c5e5f2876d3a6176c08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a1618e-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635530339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530339, "uuid": "04aee78c-2591-4d70-a10f-ee7619e7af6a", "comment": "Malware payload (Mirai)", "value": "23fa87ba91d8635fc008b040929d6cd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530339, "uuid": "e3ae93a2-0dac-42af-8a33-fdde7324f420", "comment": "Malware payload (Mirai)", "value": "d2da9bbce68926b242286635215e81e1098eb2400e7f4034d3efcc310f4a0709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530339, "uuid": "1321b9b2-8135-435f-81ae-d45bf59d265d", "comment": "Malware payload (Mirai)", "value": "9256afba06247a1cebafccd8b33f8f92771d59be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530339, "uuid": "ca16ef4a-0fe3-4040-bab4-2428b56d8e32", "comment": "Malware payload (Mirai)", "value": "de97f33138989e1b52d13ebb3d62e6a7214facd826be921e4483b233e491affab4e2dc081305ab7a6db941b95816c32a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530339, "uuid": "a8d77522-ed3e-4a5b-8182-0399c891e8a8", "value": "T1F0331881BC919A13CAC423B6FA2E01CD372563A9E2DF3207DE216F1177CA92F0D67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530339, "uuid": "019ef83b-4b99-4018-aff3-3ed983ad625d", "value": "768:qwQhosc6moXSWmfZ9hcQrhpnwexESfq7ZAoOeXKYBNOS9J1y+vM9:yhosc6QWCZ9hcQVB2SS7Z1b9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530339, "uuid": "14eea553-d2eb-428b-91c1-f681804613bf", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530339, "uuid": "b92f4de8-400e-4ab6-9fc3-37c671695057", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530339, "uuid": "554dbd5d-f945-4fd7-9625-108327f6d175", "value": "23fa87ba91d8635fc008b040929d6cd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc44f922-38b7-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635512233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512233, "uuid": "35ac814a-9b59-4da1-8856-dba61c308cb4", "comment": "Malware payload (RaccoonStealer)", "value": "da03b7d9d8e759c4b49e6b081a960650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512233, "uuid": "db6d23f0-2077-4b1c-bcd1-21762685045e", "comment": "Malware payload (RaccoonStealer)", "value": "d5e1f06165385be3568c0311f6093f29c16805e6264bf127af3b6a83e62c7ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512233, "uuid": "92ed9795-7642-435f-9ed2-2f57f6881045", "comment": "Malware payload (RaccoonStealer)", "value": "0f5303445c948d6365d9fd613538d4fc57d9f209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635512233, "uuid": "6d1190ec-19d8-453e-a6c9-d31432b1f3c6", "comment": "Malware payload (RaccoonStealer)", "value": "579ae8bc5ea950ec9e46bd1afad70c6c1a7b99390eae63b9dcd44059715bc3fe4cbee0db2373cc2ffa3fd04a088dd0f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512233, "uuid": "c2c4188a-9eba-4f1c-ac1b-22d7de4798d3", "value": "T18FD4E000A6A1C035F5B212F85976A3A9B53E7EB1577490CF23E916FE4A74AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512233, "uuid": "781b036c-410d-470b-aae5-fef3298ef75e", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512233, "uuid": "a5a993d7-dc4a-4fca-ae4e-a88ccd7312db", "value": "12288:d2RzzJVZggncs6Ui3/BVg88ygNKwOGbkWpb:kdJVWgncs6Us1Rsjky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635512233, "uuid": "722aba6b-f931-4f9a-bc08-539ea2c8bb98", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635512233, "uuid": "f6c22df6-0f59-43d4-a2b3-7978ac5b2935", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635512233, "uuid": "10b9bcc2-1618-4b3f-9532-3d86644f74b6", "value": "da03b7d9d8e759c4b49e6b081a960650.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d210ba9f-389c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635500673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500673, "uuid": "3deec0c8-7083-4459-bb98-ac3905e15704", "comment": "Malware payload", "value": "586518f6054788504976f594264f3f8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500673, "uuid": "b19b44ee-9e8e-4c0b-9112-d90e7c0ac46e", "comment": "Malware payload", "value": "d709d8fac6adc8d4c114a426d9e75559dcf8555c055daf845ed197a1c03d4833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500673, "uuid": "c9179c0a-3bfa-461e-a577-d49e54218e7e", "comment": "Malware payload", "value": "963e1c8e6664240a6640fe6f53af30f8d2a2ffbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500673, "uuid": "b82e4381-20ce-44d5-b38f-07cff4925349", "comment": "Malware payload", "value": "6695b8ec526c2b228f165c634e7290a7050c3658c63bdc12afdbbf7a857caf97320de9d4c22345b25784112e6c12f390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500673, "uuid": "5943fd13-40af-43a0-9946-e7e7e18796b6", "value": "T1B6F53394BF02EDBCC21F07F47E8FE10EF01A45370E2DA9E4642E645A92B3A637755264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500673, "uuid": "0ae9030e-52d3-43e5-b6d0-1a5b18959b52", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500673, "uuid": "0d3f0a44-a29d-4c95-b3d1-db18393a0009", "value": "98304:ERyNaswQKq9ZsaHZ65yIauvHrUBzKOJ2x+/:my8sVKq9+ssyIaqHrUwOJ2x+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635500673, "uuid": "93afda0c-4993-4503-9fcb-930437ea8c4c", "value": 3650048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635500673, "uuid": "498c4bae-88bc-4a5c-8b42-a9f563fce1fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500673, "uuid": "ab387af6-d5c8-4b15-b6d8-846c844e4025", "value": "586518f6054788504976f594264f3f8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d09f597-38b3-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635510274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510274, "uuid": "6fc616b7-9724-4e61-980e-a02c8ccdefb7", "comment": "Malware payload (AsyncRAT)", "value": "59a60d464d1a53db32c8f9d1851e861b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510274, "uuid": "1f7dc75a-204a-4416-80fd-ae6277469b8d", "comment": "Malware payload (AsyncRAT)", "value": "d845c164a62d42c00550da72c49c92296d6e73e6aca723915c0a0ebbd5b494cc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510274, "uuid": "c6d187b7-6be5-44b5-be1e-ba4a80148657", "comment": "Malware payload (AsyncRAT)", "value": "33ed4fa55a5a6e2ac4689360dcce5420de49c1b2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510274, "uuid": "c185ec7d-cac0-4da8-95ab-2ff905df7166", "comment": "Malware payload (AsyncRAT)", "value": "fd231884ded136860babf8a852bdad90ebaeabd018f89e063165d8447c0c0eecbefb86ad510b314f258fd7c908f8c107", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510274, "uuid": "689b2503-1ae6-4deb-99ed-f6b43e4ff077", "value": "T14844CF456339CB2BE0BC07BD50A3062547F6AC337262F7555FE934DA2937B824E01AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510274, "uuid": "1ce7a70b-f794-41a6-b0db-f3e985a0bb3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510274, "uuid": "f8155fd9-dfc3-4ed6-a82b-0f493f581c1c", "value": "6144:vlfZxgkv614b47d6f4Gz4K6TCFWZ1B80d/v5KqmQ9l/arHpJ6zaTemQ51myt1iSz:vlfZxHWBVv5K5Qr/Snu+oQC7lmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635510274, "uuid": "28747844-7326-4020-87e6-7d8c326d12f1", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635510274, "uuid": "5671189b-2af8-4289-a1bf-9e4121c61abe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510274, "uuid": "1af1c920-e58d-4f98-9089-d46ff153cfcf", "value": "PO_Contract_ANR07152112_20210715181907__110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f393b33e-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485267, "uuid": "2099a901-8459-4ba4-a8e9-562fefe47ba8", "comment": "Malware payload (RaccoonStealer)", "value": "8a4e6119140c151c7726b999f3e6e026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485267, "uuid": "8f51ca09-7904-4b3a-9381-66bc02feeb29", "comment": "Malware payload (RaccoonStealer)", "value": "dac00e60859b7a56f943ca7ccf8d33f0686a2b35ad76acd7327e494228991b98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485267, "uuid": "1195dfa3-7932-48c0-8cee-d1b08677394c", "comment": "Malware payload (RaccoonStealer)", "value": "03c2ea8b5c00d6637ecf9c1e8a43e775af3b78e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485267, "uuid": "eb019fac-ef82-4fd1-a70f-290c1470ab87", "comment": "Malware payload (RaccoonStealer)", "value": "bbbce338c5a39209be847d5eac3266b994853c306734ab28370245cc5bfd2903d09ceb7802c827c7ec42519bc8bdc320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485267, "uuid": "11b96554-6ff1-477e-afaf-9cc627231e0b", "value": "T1E9D4E000B7A1C031F5F222B44A7A9268B63F79E1A73495CF23E516EA5A349F0ED31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485267, "uuid": "bbf7de0c-dc5a-4a9e-a969-17359be86991", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485267, "uuid": "9234af4c-3229-473e-a021-3819ab84009c", "value": "12288:D7RHenpy7OLRfBcQH3rNko7Biy8ayqkG1F40YbEr:HREy7OXXrNk88H7KYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485267, "uuid": "2d8ffa03-a75f-4dd8-860c-568d836c8b9c", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485267, "uuid": "a735241f-febd-4ee9-a10d-0eb5b086a6f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485267, "uuid": "468e7f82-ac8e-4545-9400-cebfbac6b388", "value": "8a4e6119140c151c7726b999f3e6e026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d6744c-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635530051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530051, "uuid": "dbd6ddc7-8487-44d1-afac-65b6cea7273e", "comment": "Malware payload (AgentTesla)", "value": "7ce137ebd391e1d3ee57822c2a551d45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530051, "uuid": "73fa9e6f-6c7b-4bd7-8b7d-f867ba945f81", "comment": "Malware payload (AgentTesla)", "value": "db1411f1bebbcdbf5ad38e9d165595c5738190ab69d133065355e96db551d7a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530051, "uuid": "51e79a37-33a1-4710-8b08-8a1f162615d6", "comment": "Malware payload (AgentTesla)", "value": "91237733b866ac0307efacff6f5c53cb59e8c87e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530051, "uuid": "dd81b9d4-8d51-473e-bfa2-836c79465e34", "comment": "Malware payload (AgentTesla)", "value": "9fe9a8d8a4a3a77584a61ed43aeec33047b82e977347c4308ea2c5dde5dadf4bbebe95f059ffbdf5b31ab32b8e08a734", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530051, "uuid": "d1d57559-190a-4813-a005-35434a2c222f", "value": "T1A4940259933D8B6FE47C07B84053126647F2986772B2FB454FDA38D71A23B824E04EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530051, "uuid": "d979f257-3e0d-4714-b069-76050d94075c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530051, "uuid": "e9a9c4ef-2a5b-463e-bb07-b0196c93700e", "value": "12288:MlfZxm+BqhL3cQ4T31PW3BamRhbZJ1VdEk7ueHjtRO3srR:MlfZxm3C31examRhLdhpZWsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530051, "uuid": "c433299e-e9fb-46fd-b9a4-cd027cab19cd", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530051, "uuid": "03946af3-14f9-48a2-9a9a-cac49191d294", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530051, "uuid": "0f403456-fb09-4972-a470-e305b62f3abe", "value": "FedEx 530791478763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9807f32-386f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635481358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481358, "uuid": "cbc76bd3-4fa3-4e92-af31-d7e10fb2b41b", "comment": "Malware payload (RedLineStealer)", "value": "901f642e07984b9cb4b75cc6465e0634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481358, "uuid": "e3536152-793e-482f-9b9d-694e0450fe47", "comment": "Malware payload (RedLineStealer)", "value": "dd10ef9559b48786f2adc8bb5a2c9e3614cbb9d75a8c2910ccec119b27cbb849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481358, "uuid": "dc29bbb8-6962-47b9-9a6e-f5d813c0fa4b", "comment": "Malware payload (RedLineStealer)", "value": "70bd902f5987c93a36f90677233f062ded4ec8ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635481358, "uuid": "3fee80ff-6892-4201-a8d7-57ddde99b289", "comment": "Malware payload (RedLineStealer)", "value": "7cc6b3ab38820745edad788ce78a67994820bc5f01a0831456731c86324f242dfe354288b0e95c57f5211d0c8e13cc5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481358, "uuid": "95621a20-e3fd-4a1e-a38d-f7d6062dcf91", "value": "T1B1948D00EA91C039F5F722F489B99368B53E7EE15B1460CB52D42AEE5735AE1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481358, "uuid": "4cc91fba-2f2e-4f98-b298-e504306d93d9", "value": "0c6b1d4d54028c748ea55e055102c87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481358, "uuid": "187054e7-c0e3-4d77-b67c-9795634fb148", "value": "12288:K9PQWhqwDEELlpuBLxXiBFL/UGadE2euFBa1:a/5DEelpusDU62eQ41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635481358, "uuid": "485daf0b-0a50-49d6-8983-253f4204d976", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635481358, "uuid": "a2b8eb07-24a9-4a93-b2d0-ae3deef8bdb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635481358, "uuid": "6259a543-e386-40db-a6c7-9df018d879b4", "value": "901f642e07984b9cb4b75cc6465e0634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd327311-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485605, "uuid": "c5544afb-b71c-4d1f-a9c6-db505f78c981", "comment": "Malware payload (RaccoonStealer)", "value": "bea77e23eb4d133e196860b8294c2446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485605, "uuid": "2241af27-c72c-4092-98e4-8981396ec2d0", "comment": "Malware payload (RaccoonStealer)", "value": "dd3b7c750d4debae8a008400189657be324b956b23bcc781392b3b8548fe9ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485605, "uuid": "c088d233-81e8-400a-a4cd-30c533106a0b", "comment": "Malware payload (RaccoonStealer)", "value": "bacd7ac8e43d0e7f7edfd2be5110ae81a99d734b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485605, "uuid": "618f2254-cc12-4a9a-af6a-7ceccc9b3247", "comment": "Malware payload (RaccoonStealer)", "value": "f366e3b15af2f76f809e3dcc4ad9a2c48fc4b82a4aedbbb5a9e14564faea2cacd27d8757b5b5c6ab5533acb7ed96021a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485605, "uuid": "d8fbd414-09ef-44f4-ad84-a6175235532d", "value": "T122748D10A6A1C034F5F322F44AB992A9F53F7AA1AB3494CF13D51AEE46746E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485605, "uuid": "1b3829b5-78d6-48df-83f8-92b0c3b6869f", "value": "389a11aacbf687c9e251b78d996c02d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485605, "uuid": "1f659139-912e-4130-8086-2eeb90017ea8", "value": "6144:b7NgBviIhA45Rpg7lm4CooAvr7jNHfFAiQdE3dNjQ:bpLxISJTCBAvr79GiQ2N1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485605, "uuid": "850092d9-fd8f-48a6-96ed-c14e47c0c8d6", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485605, "uuid": "af85b37d-cde5-44af-a69c-32c749483acc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485605, "uuid": "864d5473-9294-4e1b-ab32-deae484f0e66", "value": "bea77e23eb4d133e196860b8294c2446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d3d972-3897-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635498285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498285, "uuid": "29b79162-eabd-4a48-9c38-135bbc034349", "comment": "Malware payload (AgentTesla)", "value": "94b4f5e0c1c9b81a28e1eb25863221dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498285, "uuid": "a01fba51-5162-466f-8046-cf0efd1d353a", "comment": "Malware payload (AgentTesla)", "value": "dd7883b402cfc1884a9875bd1c11ec83e4c884b2b66fd4b8caf0b25fb1ae2fe9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498285, "uuid": "d8d0afdc-dde8-4148-a350-c708d838213c", "comment": "Malware payload (AgentTesla)", "value": "876fb8fc24536d63d1ce0fca877872d1c55d49ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635498285, "uuid": "18880661-afad-45b4-a0f0-7655d402ed8e", "comment": "Malware payload (AgentTesla)", "value": "f905f7ff466a117bf3a6910cb28a846bfca3ed883bf93c1db089c3fe9fffe0906b2c259ddb0452f6589cf2a5c0208ec3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498285, "uuid": "a6b871d7-5d2d-49b9-95a8-655b19ae8d6a", "value": "T16394F1586338CB6EE5BC47B944A3167017F198227271FB054FD674DB2973F828E04AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498285, "uuid": "3aaeb51a-0e0d-4d56-8cd0-650fefe38ad2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498285, "uuid": "f31c3d26-9477-4aac-8bac-870aa98c7139", "value": "12288:dlfZxHOB9HhX9kQeVo2Wr/8Dx/HyPqQLGFnRtpCZ2LD:dlfZxHuVCsE/HyPqlFnRmZ2LD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635498285, "uuid": "42ad1956-4573-4e42-ab6a-e625018c1c39", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635498285, "uuid": "81b270ce-3d8d-4a18-acd1-21de0a7845b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635498285, "uuid": "6a75939a-0f88-4f5e-a8a5-ac8b69fad91a", "value": "Fiyat Talebi 20212910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21012d87-3882-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635489209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489209, "uuid": "3899095b-35bb-4b89-81ce-52f97708ef7d", "comment": "Malware payload (RedLineStealer)", "value": "abf8c9fdf9e7647697c313eaa8fa7fb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489209, "uuid": "6e3e5608-7a39-4ddd-b40e-1aeba9127984", "comment": "Malware payload (RedLineStealer)", "value": "dda9f8a277d9b743c445ccb286a1506d55f44777240e7e22916fd0901d1ddb74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489209, "uuid": "2eeae625-2bd1-4c0f-87ef-32b4ba0e70e4", "comment": "Malware payload (RedLineStealer)", "value": "746a4d4705368b61288c53d6ec815e4851e1f83d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489209, "uuid": "092e2021-51f1-4e23-90a7-4a8289740041", "comment": "Malware payload (RedLineStealer)", "value": "795523e6fe47626fe83a20d856dec98fa6bbddf9d6301094cc071ff84aa42fc4006b9c60ce1c855dc047567373b7a9b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489209, "uuid": "fa6d3bdd-4af5-4eae-a186-1f5b63e638ce", "value": "T10316231722E54045F0FEC539C827BDEA32F256768F80D87DB1E6AAC52B625E4D213E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489209, "uuid": "d7f2f8ef-3f1f-4c39-affa-d0321f023ea2", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489209, "uuid": "19f89483-ae32-4928-9410-185d9f51bf4b", "value": "98304:h5MNGK1BMD51NXin09ruE5QK03+GOdwtFB8ZFjYHD:jRvVi0hHQL+TitFBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489209, "uuid": "04400190-3e4f-44ca-a94b-f98276e9bf0a", "value": 4328960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489209, "uuid": "72f0294e-413c-40f7-ad8a-9d76a0fe4027", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489209, "uuid": "fb92ee71-ec78-4a0a-936b-14cb399103c4", "value": "abf8c9fdf9e7647697c313eaa8fa7fb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf8daa5-3888-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635491994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491994, "uuid": "25871b73-3520-4142-a73e-3f3e589fad84", "comment": "Malware payload (AgentTesla)", "value": "3e64aad856084e3baa86e6136e5174c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491994, "uuid": "7dff808c-72fd-4eb5-8178-b2cd61d5287c", "comment": "Malware payload (AgentTesla)", "value": "ddf65bfa899d00788e728d8a711cfc1ed4e3123561cb58549c7e504ddf405c99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491994, "uuid": "d62fa93e-8da2-4f10-9bfa-2dc80075cdbd", "comment": "Malware payload (AgentTesla)", "value": "051599fe867e95469b802ee0c51fa2e1d148ed10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491994, "uuid": "7b42f065-a20f-490f-9802-84fcbe509fe6", "comment": "Malware payload (AgentTesla)", "value": "b4633de64b9b2ac74f40be618d8355d270246ba8fef054b01b2756ec7f4cc18ad6e8c043cf5fa5039784f47a9760f384", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491994, "uuid": "c30e4338-c029-4450-953b-e1488e35e2e3", "value": "T1FBB4E00163F66A16D3794FB5147320105BB1B9677D22E30F5EC935EA28BEF880A81F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491994, "uuid": "0f244c36-0d16-4775-9257-9f159f0b2c98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491994, "uuid": "647bf545-16e6-40f1-9e78-d16d2494d69b", "value": "12288:3EDYELNP+QJG0g11D+8Gvf5I1S80/I/YTw0VA/:3eYELfGN1D7G5yS802YTdVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491994, "uuid": "52beb53a-65cc-4ee6-a997-d770f5f3a0e4", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491994, "uuid": "b8909702-47ac-499d-8684-afc6c2fbf6db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491994, "uuid": "eb8011bc-14b0-4549-afbf-820e5ab0050d", "value": "UPDATTED S O A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6c9b66-3888-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635491862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491862, "uuid": "a5df04a9-e6e0-4cc1-a4e3-aada4896c65a", "comment": "Malware payload (Mirai)", "value": "3ca11c21956b7c6a03ef4f48698c209e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491862, "uuid": "cc29eb8f-2647-484a-a2d2-2a77d69aa140", "comment": "Malware payload (Mirai)", "value": "ddfb21fd0f3589e3ecf1421d65941a8ff85e0e324e2b2149ce67e26727c5c97f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491862, "uuid": "baadcf28-6625-494a-b205-d7771bb125ce", "comment": "Malware payload (Mirai)", "value": "d26f991c4df35a746a324129f588601fc105fd18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491862, "uuid": "d1a36a31-e859-43c4-bd5e-085c1b85153c", "comment": "Malware payload (Mirai)", "value": "653b0d59b291a61f05978a65fe3fa7383210d2add4e3bd74b8863622d7ab60f161691ab9bd4aaa4e7c3f4cdd9adacd4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491862, "uuid": "7e1a7a66-e588-4646-9fa3-922a9ac80b79", "value": "T103030F1A39B35FEAFE5C52B0E6736E10E90CA3D536EC8182D65DC5853A6060F348BBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491862, "uuid": "869e2297-db09-4d9d-8fea-6bab49162775", "value": "768:nsILLLLLLLLiBnHd/lWMBYacrctZ2dqCUwr6ruD:Wbcdzr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491862, "uuid": "ddce881a-c3fd-4035-b3d3-f36174ca80e2", "value": 40824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491862, "uuid": "0d6313d3-a4b4-4cd0-b9f2-b3e1cdbab953", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491862, "uuid": "fb5140f5-4814-4054-8fc4-063b4d5dc73b", "value": "3ca11c21956b7c6a03ef4f48698c209e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2c24e8-38e0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635529949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529949, "uuid": "552a4b74-f2aa-440a-b91a-f212ce6afeaf", "comment": "Malware payload (Mirai)", "value": "10f371201ca220d8038c61715bc2ac77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529949, "uuid": "cb955d11-e013-481e-9e2a-f344a2997a05", "comment": "Malware payload (Mirai)", "value": "de358a895466801d9d05d892667037c162baa9e0a65fcb797cb571e11d3ff358", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529949, "uuid": "def44378-4dda-48c5-b97f-97b21e952262", "comment": "Malware payload (Mirai)", "value": "7150da77abe259370da79dbc1d53eb7e8afcf831", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529949, "uuid": "053549ee-d44d-495e-a1ae-491e2307e2eb", "comment": "Malware payload (Mirai)", "value": "ef976cbc869bc51fff4e55f7f936cb3314b48d5a288d8b60bc37cd63bb23e7a96fc2b3b062ca7eb94d7748bf65a3a5ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529949, "uuid": "3de5b6bb-0367-4fde-b1da-6bdf700f5eee", "value": "T149B39DDBB74B5651C86287F00BCB4BED3A2323119F27C9E7AD0E267D59391CE4A06391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529949, "uuid": "570e3ae4-175b-4b53-b3d5-d1c3db832401", "value": "1536:B/XuGhSzIB6MDSqnrdwigEu2O7j4IKvyyaogv/LWO:BfuGYIB9SCuDEu2vIKvyyaogvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635529949, "uuid": "e78c3382-1485-4044-96bf-ee54d4e8521f", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635529949, "uuid": "6f1cab0c-cc4d-4f82-a4e4-34151b55a84c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529949, "uuid": "4032bb72-94ab-4988-965b-2b822017e53c", "value": "10f371201ca220d8038c61715bc2ac77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e4f5ae-3910-11ec-843c-42010a9c0014", "comment": "Malware payload (1xxbot)", "timestamp": 1635550264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635550264, "uuid": "9d08a667-1987-4098-88bc-4ed41a7a986d", "comment": "Malware payload (1xxbot)", "value": "eb0cf6dfa15d7f0c633f9f9a097768d4", "object_relation": "md5", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635550264, "uuid": "d6fc0b6b-750b-462b-8667-501c489a9ed2", "comment": "Malware payload (1xxbot)", "value": "df3c5225425e9dbf6ce583dcca5fdf255872a051214a520074c29a82edc2fa7f", "object_relation": "sha256", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635550264, "uuid": "4ceebeea-a6d7-45d8-8be5-cdd1ae5a76a6", "comment": "Malware payload (1xxbot)", "value": "b4325a2fd0659df40bfcdfb88346f7f5d6d277dd", "object_relation": "sha1", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635550264, "uuid": "468a2737-b883-41e3-a325-0e47e4617e30", "comment": "Malware payload (1xxbot)", "value": "3b6d8b830ca38f30d40d42b1656a5fee372d2b35bf0b3a55e619a9b0b4a11ee464ef34ae1ac5a70501a5b5fd4a3a1b03", "object_relation": "sha3-384", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635550264, "uuid": "d73fb105-4fee-490a-9602-e939b6536415", "value": "T1B704AE3036EDC073C4A31E704861CAA51A3BBC216674954BB794672E5E70FCC6EE636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635550264, "uuid": "afd5b534-b416-40c0-aa27-78d715aa4c68", "value": "c698dff9877941757d23fcd110965bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635550264, "uuid": "5c3c1241-0830-45c3-8aa9-11b8f76353a5", "value": "3072:qff13fIWxYnb2krzCafKESUVFzBNG+zSjEmZbHo0rGcWrxpzbgqru:Wf1TxYKkrupc98jFJhCcuzbgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635550264, "uuid": "a5303d29-f61b-4c00-97ea-715a88c9d7e2", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635550264, "uuid": "c83751b4-e1c6-42f0-9a0f-b07f0f6fba8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635550264, "uuid": "6a07e51f-17c5-482e-80e9-a925516d8969", "value": "eb0cf6dfa15d7f0c633f9f9a097768d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bd9d82-38f1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635537218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635537218, "uuid": "e413d3db-b47b-496a-971d-001fea3c3faa", "comment": "Malware payload (Mirai)", "value": "a1392adfb115a3a4f7707bd8aed4558e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635537218, "uuid": "9a4a130a-7d16-4949-8482-a3ee7be41b4d", "comment": "Malware payload (Mirai)", "value": "df97660a49e34d0669b28d3d39dd0c85dcf3857dfb799cc43b988ee152e79789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635537218, "uuid": "40412f39-2c7d-4c8c-a71a-b0431a70923f", "comment": "Malware payload (Mirai)", "value": "ff5bdc320207ed5f031c1949282fc5ef1c37efcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635537218, "uuid": "bb801e9c-b0c5-4bdb-8b56-604a78307a3c", "comment": "Malware payload (Mirai)", "value": "b832bf9f38ea24924192b99ab5fa071f8266cd1b13eba18e8374aa4126fd22e21c0f616e23e1b5aaeb66313d0639a769", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635537218, "uuid": "0ece08f1-0b96-4b88-9889-4c5e5595f1d6", "value": "T1EE735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635537218, "uuid": "13263204-59bd-477b-a9a6-3d686705433a", "value": "1536:b/DYQYs1ZokODichsV15UzOHIt09bfsH18ruUGDKVQSi:zDhzUkODichspUzk40h0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635537218, "uuid": "c659bfa4-c339-4082-a169-5c0cab29f1f5", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635537218, "uuid": "7a230ab6-66b9-47ff-9abe-4bc86f470cb2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635537218, "uuid": "d60935ea-4ea9-491e-91f2-c2e5b53e0b2d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e829ee-38ef-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635536161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536161, "uuid": "77381f4d-ae4b-46a5-969f-d35ed65ea660", "comment": "Malware payload (RaccoonStealer)", "value": "c1eb42674c5e7180adefec71ee8b1d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536161, "uuid": "779fb4f2-b108-41f9-b79d-feb800cef64e", "comment": "Malware payload (RaccoonStealer)", "value": "dfc50de58c6339e624b60a7e6d5bccc20297656cd80183379fac54f11b3e6f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536161, "uuid": "b40a6744-1b35-408c-8afe-c03caaecc164", "comment": "Malware payload (RaccoonStealer)", "value": "4532f19a27443639d789f79231d127031aae2e29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536161, "uuid": "17ff14d0-effd-43cd-939a-4b3aaed5fadf", "comment": "Malware payload (RaccoonStealer)", "value": "fae4d32950e8a4ce5ed2e42f46e507282fdac25ddad2b0f44ebfaedc910b6cf4f5c576c05906d0d2f29d0ce3c232e0ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536161, "uuid": "f256dd03-43cc-4998-9a9b-6f5b44470ebf", "value": "T146D4E010A7A1C035F4B616F8897A53A8B93E79B16B3890CF13D51AFE5674AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536161, "uuid": "fb189ee9-5a04-43d6-af80-58917bda7cd3", "value": "5243e0b7a8cb0f582099146f832c26e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536161, "uuid": "858ed852-0ab1-4a20-bd1c-9517d1bfa4b3", "value": "12288:5sUIdOyImnTRTDjpz0e6LUDR+SiDkYj7:iD3ntTDjR0e6ogD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635536161, "uuid": "76593aac-c1fe-4657-870a-d6e87fed81cc", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635536161, "uuid": "da2301f0-4ad5-44ef-af36-a35267d01606", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536161, "uuid": "d31f0b78-bf44-4997-9240-bf1f98e0f2f0", "value": "c1eb42674c5e7180adefec71ee8b1d60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221ab15c-38d3-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635524000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524000, "uuid": "26425083-4e9f-4814-8a30-2e6a463c6e03", "comment": "Malware payload (NanoCore)", "value": "91639b335d38504c8bb1771dbd2b98ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524000, "uuid": "41ea27b0-5b20-4f2e-ad95-44cdef3ec1d3", "comment": "Malware payload (NanoCore)", "value": "dfdb008304c3c2a5ec1528fe113e26088b6118c27e27e5d456ff39d300076451", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524000, "uuid": "6b3974a3-6f74-4b0a-8456-a1c1c3d30462", "comment": "Malware payload (NanoCore)", "value": "dd251aa96202f5970b3bfbd2e1d1a492d3597864", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635524000, "uuid": "4acf18f0-e6a2-4f06-9892-4b1b14d2608e", "comment": "Malware payload (NanoCore)", "value": "1d41f34bcd02144d69c1f6511a0edcd27abc52d8bd22bb3e1f2db8020d25707b21270f305ff1787a50e044d2724c419d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524000, "uuid": "b51a9ba8-cca7-4445-8f8b-c5e30c50b0b4", "value": "T1E114CF2637A98A2FE2DE8579711242179378C2E398D3F3DE28D454B74F267E54A0B0D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524000, "uuid": "d7249872-3726-4e0c-8bbf-2de27ae4b860", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524000, "uuid": "1c001112-9e4d-4744-bbba-afb70f389ef5", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIJGcoMYVXH6Ezab1D8E5bxoK/4:wLV6Bta6dtJmakIM5Ncxc6F1rFoK/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635524000, "uuid": "95706873-6c38-49c6-8866-c6496cdcdcc2", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635524000, "uuid": "dec4844a-e990-4cbe-a9ea-66ffa5492f32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635524000, "uuid": "67c1c63a-70ab-45bc-8f23-fbd34056e7d9", "value": "91639b335d38504c8bb1771dbd2b98ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da17d284-387d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635487372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487372, "uuid": "af0fa0be-6344-4b91-9839-f92985c8839c", "comment": "Malware payload (RaccoonStealer)", "value": "b81ef3a698b72d8dbd7edfa28d592283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487372, "uuid": "7e917de1-27ec-4610-8c45-acc2921185a1", "comment": "Malware payload (RaccoonStealer)", "value": "e027ff78d56c5581cc1744eeb2215617af4f1b80ad2e6716b30bbcde5d82fc58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487372, "uuid": "84469a5c-40a9-4323-9b67-eab8ce08e88f", "comment": "Malware payload (RaccoonStealer)", "value": "c4ba81347f580d6dea7e296163c267b8be3f3a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635487372, "uuid": "c2ba79ae-71c3-4ef9-b2f5-0eb5d5e80d10", "comment": "Malware payload (RaccoonStealer)", "value": "825664c030091cf4ff43e0246546e135fda5ec4460aba6363437d458baf594725665f2928b3d21cf8f45313b94aa4114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487372, "uuid": "65e11861-b35b-4cfd-9281-18a8b052d582", "value": "T1C1D4E000A6B1C030F2F752F84AB692A8B93F3AA1677494CF22D516ED5774AE5EC31353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487372, "uuid": "64ff939d-904d-4bac-98d8-9822d462baa8", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487372, "uuid": "8b688a97-67d8-45a5-9b3f-7453b5d1ffe8", "value": "12288:CHAqZZsfZfzJwykFfJs8BB4n0T5Kd7YwDZR7IselYlon7:EbZqd2yGW8H40Ng9+s167", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635487372, "uuid": "c073913e-31e6-4a91-899b-013e965c1cc2", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635487372, "uuid": "9913a426-c684-4a93-9af8-73576d4c151f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635487372, "uuid": "a68ba34a-2556-4e4e-bc2c-f5c7d52368cf", "value": "b81ef3a698b72d8dbd7edfa28d592283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f869e27-389c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635500400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500400, "uuid": "930f6b4d-3143-4f20-8cd4-38b7edb1ff11", "comment": "Malware payload (Formbook)", "value": "91679f42cd3ba051b5c7ce37d45b222c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500400, "uuid": "a57d815a-414b-4f94-b159-6db7f0b8c567", "comment": "Malware payload (Formbook)", "value": "e059ab9141d67e0b2e9eb83d34ba88e480f7091bcd97b78466386a17b44a235e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500400, "uuid": "c0a8a2a7-c62c-47ad-b715-1be1293e8718", "comment": "Malware payload (Formbook)", "value": "decc607894a299033ed3ede115a3bce51d21020b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500400, "uuid": "248f55a5-f768-4736-80ae-a1c0763c3f26", "comment": "Malware payload (Formbook)", "value": "53fdda69990a3085c0473010c1545c53edd231022ac88b245ebdd748121ef9c6d215f0f33680455224013c4bed116755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500400, "uuid": "4bda518d-960d-4b70-835b-35e956264173", "value": "T101C4380C2EF4A39ECC567A317C5318385F225CF3AE26920E557230584AFA2B579D7DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500400, "uuid": "c5f1ab13-b1af-47ac-bc2e-42c5c7f45754", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500400, "uuid": "5a28619e-5682-429c-b067-1f5b57caed9c", "value": "12288:wurQb81U+mN55X7Yshg4IeIZcDAVnxPjbpWCORt:wX++IMinxXpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635500400, "uuid": "33d00c07-bcf7-4342-b4a6-071af42128d0", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635500400, "uuid": "ad0e1b46-c147-4855-a437-6f6a1c51cf58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500400, "uuid": "c8da07f7-0750-4f36-8300-2704a02e5ede", "value": "91679f42cd3ba051b5c7ce37d45b222c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d23513-3893-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635496510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496510, "uuid": "f9d73cd3-9623-4ad1-ab45-36755616905b", "comment": "Malware payload (AveMariaRAT)", "value": "b09c4c58f6aa6f8e254bc2dfba806166", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496510, "uuid": "ecd0d805-ea76-48d6-8c38-25a79c5c9374", "comment": "Malware payload (AveMariaRAT)", "value": "e07327f2a5d54106bd1e7e877281080c57b320daaf69594794ce59ff69ae3761", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496510, "uuid": "8f32b537-9420-4ff5-841f-a114996d20fb", "comment": "Malware payload (AveMariaRAT)", "value": "cfef2450b35d144f5e1034afb407f2fed0b83be8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496510, "uuid": "2043018e-1c8f-46a1-85b7-4c19599b8992", "comment": "Malware payload (AveMariaRAT)", "value": "937d045160a89b1eaf95a2c57f3d7d63b0e97a3f0dd6849c99828223d2e6eb80007c2485387e0fb70ad5894223e7e73d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496510, "uuid": "ad8c032b-70ac-4e5c-b8c8-5766f5069420", "value": "T1A024BEF132A9C771D5932A3048A586A0CE3A7C11EA31444B337427AD1FB6FCC5AE536E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496510, "uuid": "b24ce782-b692-44db-8495-b0600b8b5ea7", "value": "2b117a88efd5ad3db577a4f98b26ff8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496510, "uuid": "d2cfa56a-d1b9-446d-8c40-d8adb3825310", "value": "6144:EFY1gP9ieqlRjhrAVIB3uzbgwu6L7ITsq:QJP9ieWualunnn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635496510, "uuid": "d02a93a5-9624-4e0b-bfb5-6c65c2d599ad", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635496510, "uuid": "1fa8ed28-268c-40ff-938c-ba58f33fbf49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496510, "uuid": "a94587ba-bafc-421c-b6ef-a6f78e9b92cc", "value": "b09c4c58f6aa6f8e254bc2dfba806166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1489891-3876-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635484404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484404, "uuid": "5931dfeb-61ce-4c92-ad5f-37d683dc09f3", "comment": "Malware payload (ArkeiStealer)", "value": "cd847a8bcbd819705ed57355fcfd269c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484404, "uuid": "70b597cb-2eb8-4793-a837-4d97ddf78e29", "comment": "Malware payload (ArkeiStealer)", "value": "e0a642286227876154d27e399aab958ab958f2f2e528c4f4593e9d80c64a87c6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484404, "uuid": "707e7780-40b4-4cab-9095-facdfbb1bf4b", "comment": "Malware payload (ArkeiStealer)", "value": "cb55c01537fc8beea31d5f1728498e0f74f5a865", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484404, "uuid": "d1f3b018-911b-4c1c-862a-6ac670b8d3fe", "comment": "Malware payload (ArkeiStealer)", "value": "1483764e7ed01231d3175dffa6326ee0f58e2792d75063f874ec96e7f3f4ba4d889d9eca13159e54dca7b83210cbb61c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484404, "uuid": "79f5b119-7291-4dc2-ba3f-6c35d41e10cc", "value": "T15D438C01BA4AE815F399A0B02EC3C6D9773A7C8D9E92632B32517F5FFC759B04A11706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484404, "uuid": "e4686201-bcd7-4ee6-8da9-424578ddaf72", "value": "768:YAcUdkarMdzkx0EHG+Mo66b7Dt5cxJdo8rshTAy:YHikhRuzv6wD/cxHoIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484404, "uuid": "29f79646-0d3c-4745-9e53-f8cd2cdfa072", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484404, "uuid": "4174bc4a-61fb-4e72-87bf-d1d3bd588246", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484404, "uuid": "91b32601-437a-4ace-9e8f-58ff9473a7a9", "value": "Invoice- 876543456 Oil_Field_Swift_remmitance.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f119bd-38fc-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635541555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541555, "uuid": "e3c91a80-9cbe-4d95-a118-d772b7565c91", "comment": "Malware payload (RaccoonStealer)", "value": "1853e380fad30fa75165d4621d6132ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541555, "uuid": "24f2471c-f73a-47ff-89cb-eb9a925b741d", "comment": "Malware payload (RaccoonStealer)", "value": "e0ddefa2d8101c3602f8186aa02c5b770e928a162bc3483dc85f605a4e0d03a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541555, "uuid": "085a97ad-d829-4b71-86cc-b7e5809ddee6", "comment": "Malware payload (RaccoonStealer)", "value": "5f191f0200babefcbd32c5f3f7e16571640ed354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635541555, "uuid": "fdda4e66-3e22-492a-896f-7de2bdb98277", "comment": "Malware payload (RaccoonStealer)", "value": "750d41f039b2cfeea44fd1ecd0ab244dc36394d53512e49aa58c4b1fe35ef1999b4f801f3dc11ff1940fe10e443131f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541555, "uuid": "cde37482-0efa-4ef9-9f4f-7f714a6172c4", "value": "T197A401117B90C075E076957D4C32CA924B6A7DC7D97CC58B3B973A6E1E303C0AE2A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541555, "uuid": "73a59cb6-be38-4441-abd8-636ea31a124d", "value": "fa148d0c70a978454538a9c9c0513fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541555, "uuid": "c02b052c-8e22-4360-bec2-f5c13d4cdcff", "value": "12288:06oDTkR5CFSyXFYhlIxgvwgzSuZoAqvYNS:0tPXFYwxgvHSuZo6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635541555, "uuid": "3cb1898b-871f-475c-bc8a-58a2043530d8", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635541555, "uuid": "a6c26383-684a-45a8-946c-d9a1e3f885b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635541555, "uuid": "c0fad6bb-cffd-4712-951e-02c46d143714", "value": "1853e380fad30fa75165d4621d6132ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9c9771-38d9-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635526598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526598, "uuid": "dfcb5251-52af-4577-8e38-48b11a6f1cc9", "comment": "Malware payload (RaccoonStealer)", "value": "86fef607038bf301ddfad09f6a6fd8ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526598, "uuid": "8e9ed4e1-379d-4e61-b148-a1ef26d9be58", "comment": "Malware payload (RaccoonStealer)", "value": "e0f3355a3a3df9f9b64e6cd08e846060cab49b6e73cc27644b84bb4c964afa0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526598, "uuid": "911cd855-6f3a-434c-aa23-800f27b6a8c4", "comment": "Malware payload (RaccoonStealer)", "value": "f1f4eb389d227778d1ea2506222ca2b3af20f697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635526598, "uuid": "67468bf0-c930-43c2-8933-37992ecb67a0", "comment": "Malware payload (RaccoonStealer)", "value": "c1bd67f3da2a7723a0d0b975033438a2e969b39fc86c053b7ab6595d550a0453f14848d6623a6d2ff5eaf26c97f33c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526598, "uuid": "569ca43c-f84d-452c-b596-d1a53bb5e06d", "value": "T1F3D4D000A6A1C034F4F752F849B69768B93E7AA1673450CF63D916EE47786E0ED32327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526598, "uuid": "6fa87c85-cc65-48cf-858b-0dab3a3f5f46", "value": "4649591756a77695954d3f167e28cc87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526598, "uuid": "373a60ce-ac6d-4533-8378-f2d07bbe4d4d", "value": "12288:hWv9UNNlZrZfTfi5tEfqpuOj4OweGvU6xe:AGn7Z7qTLpUDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635526598, "uuid": "fb5dc626-f8eb-4162-8f5d-1799d2999799", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635526598, "uuid": "38672c4e-84c8-4c9a-8a8a-8bedd5b8ae1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635526598, "uuid": "63cff7c3-696b-4240-840e-b631a7f6ff43", "value": "86fef607038bf301ddfad09f6a6fd8ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcefb56-38d2-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635523640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523640, "uuid": "c70a145f-a374-4836-9602-959bee022b60", "comment": "Malware payload (AsyncRAT)", "value": "f691387cec5fbccb41d94050c4324237", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523640, "uuid": "b0b6c05c-df26-48e3-9ee1-8dbe9b829171", "comment": "Malware payload (AsyncRAT)", "value": "e38ee1e13952369e8f76013dbe732ce6c1dea21a43dc7306b69f629ed0232e7d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523640, "uuid": "a30a8a59-5177-48da-ad6b-3520a4b1a0a5", "comment": "Malware payload (AsyncRAT)", "value": "9b6bc46d3e0946f41af5122e7c1f5d1142b34411", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635523640, "uuid": "6775af08-1135-4873-a620-faafaed045dc", "comment": "Malware payload (AsyncRAT)", "value": "0b701b3084251ff1ab4cf248bd2aa1165e512bf9dded8a898293abbbaf18fdab01080cf811ebf15efee934dc5c824425", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523640, "uuid": "0df0b058-ff04-4ffd-a022-48d8ecd278c2", "value": "T155A4BF3362E2AE99EF7B0FB4982135004FF5BC576B3ED24BADCA016915E7940CD50B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523640, "uuid": "b1b4c148-4e43-4aa0-afff-2fadd2fd9204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523640, "uuid": "afb723dc-93f7-4ebf-a703-02c5cb5e6806", "value": "12288:lcj8PAJH1KqJFTP4D9AV6XXcPUz1w8c3No:ldIMqsDqV6XMc4do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635523640, "uuid": "2d08c41b-d9c0-4c96-bc79-24ef9c5a314b", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635523640, "uuid": "ba0ebd25-d31d-40dd-977a-2e97fb1bde85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635523640, "uuid": "c54e3b77-8966-4a55-b62c-5181823b8eb4", "value": "Statement of Account for OCTOBER 2021pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdb70b8-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635529982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529982, "uuid": "3766f997-1797-487c-8315-8c4f5540ae8e", "comment": "Malware payload (Loki)", "value": "2d84c31f7204880c4bdc3050c55e9713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529982, "uuid": "ba446876-fd29-4f0e-a8b4-6adff650b0da", "comment": "Malware payload (Loki)", "value": "e55e002c1aa73116f40522a48b98907b602fa263e66cf49967e8f87a6111110a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529982, "uuid": "b5430692-0895-4065-8081-ac5be14bc932", "comment": "Malware payload (Loki)", "value": "b69697ad7c29ab562b66e5a0b584fe2e5dbcb2bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529982, "uuid": "c5b78fe7-3626-4283-9bdd-bc1d8c9ac8d7", "comment": "Malware payload (Loki)", "value": "5e8ce073f78d2267a8c08ca264afb94d4e905c47358a397ce570ab76bfa5e3d341dc5d5206c0cbf0999f8ba63f77bb0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529982, "uuid": "4aeffb6a-f10f-45f3-a035-302c01d4de2e", "value": "T18A947CAC7250B9DFC85BCE7689981C70AA6064B6530BD303A42712EDDE0E697DF191F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529982, "uuid": "75a3e28e-0907-4ef1-99a1-1c564d672570", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529982, "uuid": "62e1f423-45d0-40e6-91ee-f1d5f7fee183", "value": "12288:/4HydsnICQCsAPQY6EqPCKVQqnpV45FVDm:/bSIvAYEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635529982, "uuid": "b160bd78-e99f-4666-ab6e-ed71653c1d1e", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635529982, "uuid": "226fbb2a-ae02-4084-9076-abe1df9be0dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529982, "uuid": "190f478c-bbbc-474d-bdb0-9ed13fee5c1a", "value": "factura_Zx3647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84eee28-387a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635486027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486027, "uuid": "f37aa7c0-4bdc-4399-9e3c-c75805509492", "comment": "Malware payload (AgentTesla)", "value": "bd612d670c33ca76c375d71dbbe06b2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486027, "uuid": "ec8284fd-e727-4f04-9d16-18c2fab8378a", "comment": "Malware payload (AgentTesla)", "value": "e5a90994bc116941466d1fe1f77701ef2d18fad30f2040837ad23e50947ac67d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486027, "uuid": "c3a3c25a-74c4-4d75-be57-9b3ea020c385", "comment": "Malware payload (AgentTesla)", "value": "8f48d5eaeded578f285631da4965e99360cc5e40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635486027, "uuid": "d000e9a7-83d0-47ec-9f24-fd2dba851b5d", "comment": "Malware payload (AgentTesla)", "value": "b829e115af7a15da658cf8acf4c71dd01f80fbc316a72d063210f6b05caefedd81d74cb77498392442889de715938c74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486027, "uuid": "a8c415a1-6760-44b9-8f22-5f9298d149ca", "value": "T193E43369A748CD0ACECC7A58FD52F41E1773BE6CE4C023914F3384ED852F0EA95A5266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486027, "uuid": "1d7ceee8-324d-4f14-be0f-8c0aa3193ec8", "value": "12288:LwaNkxJYgWBnrmU2r/9p/GVS+hzBQe2MPgDHKPYYDpmsnga7xNky+3M08VFMjj0M:8aNk3Ior/Xus+ZAMPIH1SpDnF7xad87U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635486027, "uuid": "19119e67-cd18-4346-a98b-d6ee593ab511", "value": 701715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635486027, "uuid": "6ef95f64-772b-4946-96f1-3576942deab2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635486027, "uuid": "00507133-573e-45f3-8a1c-6e982cf33a5a", "value": "invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd776e9-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635485256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485256, "uuid": "fede1c61-0b35-4aad-baeb-e9b39e748e0e", "comment": "Malware payload (RaccoonStealer)", "value": "4bc780e2f5a1910be5b630c05d4faac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485256, "uuid": "ad5d5c76-5019-4929-a38a-7a7c8d3132b1", "comment": "Malware payload (RaccoonStealer)", "value": "e7f0807d4e77d424c1b2a2d0dde3e70478e5a03b327dbff26b78ca43310bd10c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485256, "uuid": "45dfbc9f-0a28-4018-91e5-b92e44bdd8f3", "comment": "Malware payload (RaccoonStealer)", "value": "717f5fe9e659c75e0294f4fab94bf589ecb31a29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485256, "uuid": "3a4cc514-d768-40fb-9413-7a52b059ef76", "comment": "Malware payload (RaccoonStealer)", "value": "97af93cb10f7a3ef8b600d7e16b2a2eda3d36fd550cce6f6a3eee479d8b4a1a2cbe277913d9f4e87e7e4df071ce8a232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485256, "uuid": "7c126db0-fc43-4973-ad65-e2732c5f389d", "value": "T1E0D4E000B6A1C035F5F312B459B692A9B53F7DE16B3884CF12E916EA4678AE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485256, "uuid": "15fd43dc-daae-4df6-aab8-c1874fc0dc32", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485256, "uuid": "29d7c722-0d27-4b9e-912d-9ee789b45120", "value": "12288:DLTSPnx6OCPJTSi6rsTD6Nn0LU5cdGR2dYUnV:XMnixT36OL+wkSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485256, "uuid": "a6f055a8-e359-43d9-a1c4-b45ecad6875b", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485256, "uuid": "91372fae-29bf-4423-9d91-0cc8e85ec45b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485256, "uuid": "0920bce1-ffa2-4fb6-baba-88103d35101a", "value": "4bc780e2f5a1910be5b630c05d4faac3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cb3ca1-38e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635533235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533235, "uuid": "30c96b29-75f6-41c5-adf9-df32d5bac160", "comment": "Malware payload", "value": "36799b42a4cf333f7081fcfa4cac8291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533235, "uuid": "5606f936-4d1a-4d0c-93e2-e1ba13a12093", "comment": "Malware payload", "value": "e83ce530468ceacafc364791ce8de4cdc2b456cb0df25b93ac4055a99b031702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533235, "uuid": "23fc5a78-d1e1-4c1f-a8c0-4e51b17e7387", "comment": "Malware payload", "value": "3300f72501eb46cb3247605bb3c351a56851a72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635533235, "uuid": "23aa94d7-35cd-46a7-b78e-e1cb1b0d786e", "comment": "Malware payload", "value": "741e6368b55c2ad18bd1b6f519a0514e7a919907f29d107199cec925ef4a792c11cc0b9c345da70e6ad2fbae2f7c5dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533235, "uuid": "1b6611c0-c279-40b8-8289-81a91050c217", "value": "T13594F1486369CB6BE57C47BE0093063447FAE86273A1F7420FE674DA2923BC14E15DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533235, "uuid": "a9b86051-96be-4126-b347-cad321c34c81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533235, "uuid": "020bed15-e8ca-47d7-9d6a-8a036cc2eb16", "value": "12288:qlfZxbqBOSN4tQU3DaseaTpdwd9efo8EJfv:qlfZxb4c3DaseaTPCerav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635533235, "uuid": "e78147fe-ae16-4e94-b18d-232f81b1a90e", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635533235, "uuid": "e83da45e-35ba-4a24-be25-1f17b99b69b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635533235, "uuid": "632b6988-a654-4da8-9f04-37567ae23b3a", "value": "36799b42a4cf333f7081fcfa4cac8291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0673e871-390d-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1635548864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548864, "uuid": "7eaa2df7-e187-4575-a857-2918b44f4be9", "comment": "Malware payload (CoinMiner)", "value": "ea028928007630d59f74c3cb3f4d2e61", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548864, "uuid": "79cd978d-a491-451f-838e-d8b3ab6e2aa2", "comment": "Malware payload (CoinMiner)", "value": "e92c0bc11c0ddf4678d0882d854859b1a410e8c8e3e13accfa9ac339ad1d5269", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548864, "uuid": "6712dcab-1725-4b1e-8092-e2ac7fc25848", "comment": "Malware payload (CoinMiner)", "value": "6ba1fa3d0a5d5a61a6ae857e86648cb6f63133de", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635548864, "uuid": "5ef689f8-e005-4e0b-a147-1b0e35204eab", "comment": "Malware payload (CoinMiner)", "value": "26453d70565a69c217f7b4f5772f0aa5c784a0a4c9fcbbd1874cd4efa20679b66d6b33b1887f494f6724940d0c5caa3f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548864, "uuid": "be3bcd05-8254-4b09-9acd-432476f95ff2", "value": "T150A533BB5FBD3072EA61BDF907710B8868504258E35FBEC37C68889B376050E96D60C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548864, "uuid": "bb603850-74ca-49bd-8e6a-2cb464fe8982", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548864, "uuid": "1da60983-3999-4604-8469-d3b05a97ae54", "value": "49152:sbntTAHwo//2WVvTXEJR5TovQuCBPDh6bhiwv0O2Wx:stTAQ6/2Ws5EvTCBPVyhikt2Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635548864, "uuid": "b1daafd7-05f3-479a-8833-6d6c260b613d", "value": 2200576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635548864, "uuid": "766bda51-1798-4ad9-9c33-dcaaf3aa5ea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635548864, "uuid": "0098f474-d900-48ad-af25-2ad93402b7f3", "value": "ea028928007630d59f74c3cb3f4d2e61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d128bc5-38aa-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635506436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506436, "uuid": "b71c549a-8143-4ead-ac90-c63dfa43da85", "comment": "Malware payload (Loki)", "value": "4eca9ad029e51e378913376e9b1e3a56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506436, "uuid": "43bde569-d691-426a-9b61-5d9f11fa1b62", "comment": "Malware payload (Loki)", "value": "e9523f62177970ce7d70a44b499310ca51cfdd9d478237184a8743a70b4f0dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506436, "uuid": "c304d536-0881-4899-8aec-6324e958731d", "comment": "Malware payload (Loki)", "value": "213f9cd1fa7df5d0a85cf6d91614bfbbfbc232bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635506436, "uuid": "b7241d16-1a50-4d94-9a9b-7b73fc04b4c1", "comment": "Malware payload (Loki)", "value": "e132a3b607147e9b8f8284b5cf9e3fe4ccf502aa67c7eed74b818e4d74870096c32e2928bf37e43ab161bed489e80f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506436, "uuid": "cae23119-13a5-4551-a7b3-5b186a647f03", "value": "T1AF34222963D050BBD6464FB2E6772708EAF153641019138FBF29AF7B7A21AC3E31D245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506436, "uuid": "7945f27f-fe3c-4a11-9806-238e400ba7bd", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506436, "uuid": "840b608e-cbbe-455d-92e4-34e5d991c7cb", "value": "6144:wBlL/c/AvsfqWsSHK+tdQisn/0HCHu1gf:CeovsfqWnKYon/0HC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635506436, "uuid": "1017f732-855e-4a31-b71c-ac3e078a08e0", "value": 249115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635506436, "uuid": "ad77a9d0-8f1a-44be-9bd5-04a94d4de99c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635506436, "uuid": "b009442e-161c-437a-900e-6484bd85894d", "value": "IRQ2107798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d2f21b-38bb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635513995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513995, "uuid": "ce50e605-3ecc-4e65-acd2-12488ccba8bd", "comment": "Malware payload (Formbook)", "value": "d488a5a0caf0931f5a7c052e2cd625e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513995, "uuid": "e054ff67-92ad-4ba7-a311-0070dfef5a3c", "comment": "Malware payload (Formbook)", "value": "ea65c04f2fb1960df74c4f579f8c0972dec4d14e79cdc040fa98ca8fcc2eb82f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513995, "uuid": "0a6f3e28-2cbe-486d-bb7e-3fe6a49358ab", "comment": "Malware payload (Formbook)", "value": "b94b48dc531a655b08ea378e8e8cc7cf6b4053d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635513995, "uuid": "9dfc64d8-930c-4f10-af5b-8c5848daa112", "comment": "Malware payload (Formbook)", "value": "6e52c1f522f69d8904be82cea4a53ecbe55b2be5a34acbbbc13f8f2a824cf9208389fb23fd03c2651e968ede83d62b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513995, "uuid": "a83765ac-7c17-4784-ab2b-62718c6e5e09", "value": "T18FE4AF652355D80FC35247B4B472E7BC51389E223949C60292FBBDAFF939EA6BD440C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513995, "uuid": "73f4b0d9-22a7-4236-add5-12f95f9f5f06", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513995, "uuid": "f2b39972-fd58-42c9-8b17-d9ec9fad45b9", "value": "12288:Hxph26bJViMM/dAQqys89uOZrvH4lnib/GB023CPqrGH2cd:D1iMM/dAQqys89uOZrv+3cbH2cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635513995, "uuid": "a28c8c8c-0804-4cfe-9bfd-3210f3b82752", "value": 686995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635513995, "uuid": "27edf78f-06ee-4edf-8c88-cfeeeb089bfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635513995, "uuid": "a3d8f90d-e8a5-46a3-a739-8f65d7a962fb", "value": "orderdraft.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decb6624-38c1-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635516585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516585, "uuid": "7f56a70d-88ff-471d-9114-08e6b3227e34", "comment": "Malware payload (RaccoonStealer)", "value": "f1542d07c0aa2b2727b4ebdeeabc21f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516585, "uuid": "7f3ea688-da5a-4fd8-be15-4fc8232afa51", "comment": "Malware payload (RaccoonStealer)", "value": "eab5f3d7e83f7bc51045f22745fd71ec9e7e1e60194e8400c54bb9d0d165841b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516585, "uuid": "720098f2-3d1a-4783-be76-411986793c08", "comment": "Malware payload (RaccoonStealer)", "value": "6790edd5f228233682a09ab0f09ec4f91b47859f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635516585, "uuid": "8d6ed84b-9a43-4719-aaee-80487e397d76", "comment": "Malware payload (RaccoonStealer)", "value": "d18918df277c201b7884822d5d394a3c171d03d161d299ae8a486a7df468b31762b200d955ef0145b89fe2ee91c2d541", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516585, "uuid": "4823a9c9-ca8a-4dad-bebc-0338d1f151da", "value": "T197458EC6F0B3608ED7A3B0B90B0555824A470D7A6B169AF5AF35E95B11F37A1CAD3303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516585, "uuid": "d0898b68-62ee-454c-b8a5-49d8f0d51274", "value": "835da68f7e7e29ef9a08f899d20e0925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516585, "uuid": "ec510339-009b-4244-8fe0-4cd1414a0a6b", "value": "24576:0knsnrhiMgnFimm36pd5/uYjExMAqkozpBCNtzwAb6FSGLTEZl+:RsFYFKIGaeNoVBCTzgIGXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635516585, "uuid": "da49226d-038d-4c32-9546-eb3f52f45798", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635516585, "uuid": "a0fdbd1e-c529-4ba2-9ab3-ab54edf52dee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635516585, "uuid": "95ecdbee-9c0d-4579-b789-4e22adc02d89", "value": "f1542d07c0aa2b2727b4ebdeeabc21f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d72551-38e0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635529689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529689, "uuid": "ecb986e0-9a4d-4bfb-b1ee-c101d44f2573", "comment": "Malware payload (Mirai)", "value": "ed05c5dcd0995d13c4121f500ed4f0b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529689, "uuid": "641c2f11-3be9-4462-b1e9-1c83ba9302da", "comment": "Malware payload (Mirai)", "value": "ebad9676f3fc11d7c31e6ebd801c089820848f2b726078f002e82534cc33ebd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529689, "uuid": "81ecfd8b-fb84-4fcb-bec8-2a30cd76f42a", "comment": "Malware payload (Mirai)", "value": "7f6fd42778d9663233a3c9f6d60bc4802a8561a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635529689, "uuid": "1fd52d15-f934-47eb-a0e7-4deabb6ed8ba", "comment": "Malware payload (Mirai)", "value": "8fb0a78a120efc37915f8f471e70f664a4a79f0f948f62e54caf0bd7afebce8cf8fbf33dc0da673420c45903d2cb4226", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529689, "uuid": "be708b86-0e2d-4c3c-8cef-3da1d92be1c2", "value": "T1E0F2E278831BDC73CE305C31ED2949867EC7567CF1E679F226A15E10B9A064364EBD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529689, "uuid": "4d06e0be-01f2-453e-9d29-b48fddafbedb", "value": "768:CtXvFUD5qvWrb15P8QOC1lrHfhiwB2W4h9q3UELmGr:sXNUDB/15P8khfhLv4ULb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635529689, "uuid": "bd137066-6af3-4715-80f1-ac00a8661869", "value": 35872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635529689, "uuid": "06bae24a-a4d9-4309-b64d-f471df7d2e79", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635529689, "uuid": "ec582a9d-4219-4127-b891-5f6d665bcc57", "value": "ed05c5dcd0995d13c4121f500ed4f0b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80086a4-389b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635500226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500226, "uuid": "8ea3fb6f-70f8-44db-b210-e88ec69f8d0f", "comment": "Malware payload (AgentTesla)", "value": "4a7cbe30336192502c1ea998c9e3e588", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500226, "uuid": "c946b575-f404-46fc-b634-f4b55736f6d5", "comment": "Malware payload (AgentTesla)", "value": "ec182063d9a66086a1030e5ffdd2834bffc9b5b699161d3ab58cfa4b851e9104", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500226, "uuid": "4de8f500-01c4-44e6-a435-ef15b9d9f3fd", "comment": "Malware payload (AgentTesla)", "value": "341ee9bf17a13a19815ec888b8b278c986e70420", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500226, "uuid": "ea187962-4819-4a35-b669-b4548d14faa7", "comment": "Malware payload (AgentTesla)", "value": "bb419a0159e99d94b48b92c2e1b4682a0551d266139c8fc6044e117747a60ec739cf741ff4d0b0e3b5ca5726874abd4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500226, "uuid": "1f3d3e8d-252c-414e-9ffe-5bc3006a5291", "value": "T19B94F045633DCBAFE0BD47B840A3163543F6A8227262F7954FD238DA1E23B815E05D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500226, "uuid": "3f49af4b-ebaa-41f5-bb40-de6a40e3b371", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500226, "uuid": "33bfb0fa-6c9a-491d-b650-023eb4c57070", "value": "12288:UlfZxxBBqOt/KQl03MHyVySlt8AtRyBxUkKwrPfsZEMxz/A:UlfZxxfb4IyV/tT4BxdUZTxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635500226, "uuid": "0c43089f-39bc-48a3-a439-b768385fc104", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635500226, "uuid": "4ac8abbb-8b7e-48ea-a6c0-2a9d55cdb8f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500226, "uuid": "6655edf5-b853-43a1-a14f-ea7760904cb0", "value": "COSCO BANK INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311ca876-3891-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635495678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495678, "uuid": "8dd48f3c-31bb-4302-bd30-f61fd5dccb5d", "comment": "Malware payload (AgentTesla)", "value": "da796701b9ea178f239f0b9713623d40", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495678, "uuid": "4eac3416-69e6-4393-81d5-4467de9aa22f", "comment": "Malware payload (AgentTesla)", "value": "ed62ebecb7164637884617076d3e2cbeec26fd190f07f6d83a45adfc399fd9fb", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495678, "uuid": "16e18cb1-8926-4382-9237-52883563d914", "comment": "Malware payload (AgentTesla)", "value": "45527ecd355df1b94a0f32971e2c731f37f723df", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495678, "uuid": "2d9e0c89-28d6-4339-8643-6d38632e2244", "comment": "Malware payload (AgentTesla)", "value": "75c7c32f32de7b2adc3fb25b55c7a4a78672cedb3c31b50be48bdef04ed8b6cfd7efe966e7bd51c94e6e1900e8f0b1bb", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495678, "uuid": "ee39cbf0-a139-42c4-8f3f-747619543cae", "value": "T19A8423BAD1FA4A105A43070C4067A85D12D729B3F7356AC39CCB7A1A98ABB334CD717D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495678, "uuid": "e0f8903b-fa29-47f8-8c56-379ba47d54aa", "value": "6144:mVpp0TFc1YhBi+XySOQGFF+QXrQOaljXGVCSQoln4SEV75Fs0HIYHPBS459x72:yy3HfJmZ8OgjXLXolhEbPIYHB352", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635495678, "uuid": "2cd16ff5-0285-43e2-bce3-b48f75728ec9", "value": 394124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635495678, "uuid": "41e92be7-7779-4763-a852-1eeaf5d95d84", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495678, "uuid": "9ee93764-7c2a-47e1-bd95-928a796572c0", "value": "DHL-INV&AWB_SHIPPING DOC.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c2dc5d-38da-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635527220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527220, "uuid": "1d88e365-7b94-465b-b6ec-34807435b357", "comment": "Malware payload (Mirai)", "value": "b0019d74584d86ef6687cbc8278b9b97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527220, "uuid": "3da3cf01-0cb0-4ac9-b713-00ac69519f73", "comment": "Malware payload (Mirai)", "value": "eda8b9c0df93e13ae811f94c09ef4ff9b41fb37554f7aed43bf17adb3648911f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527220, "uuid": "ed1bca18-fee8-462d-93fe-4a9a4547eaf9", "comment": "Malware payload (Mirai)", "value": "9275bb5031968f94c0b57ae2001a543405987d2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527220, "uuid": "5043dd57-6db0-4592-b955-df068c2b843b", "comment": "Malware payload (Mirai)", "value": "a572d940cc7583e27c5928b9b85fbc70f54acb413f545a942283d261208cf800978831a0406424331cb7f4065d882eb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527220, "uuid": "014089d9-07df-4e08-883a-31fa7f47f806", "value": "T129634AC0B543E8F1DE1616B42067FF375A3BF2F6111AE9CBD3E4A923AC42A41940769D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527220, "uuid": "49c822d4-8efb-4ba1-8fef-4be6a83eda50", "value": "1536:yTmzDttn+ofhw63xq6m7zRRkyTQ2IwKTmChsUopOxAcrxyvbzXtGtISYCpC6:Z3Tn+ofhw63AQvjTuU+arcvktZjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635527220, "uuid": "8e091334-2dc6-439f-b927-08590154a453", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635527220, "uuid": "68d7933c-473e-481f-88e2-64677b14b6b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527220, "uuid": "11758b1c-3e7f-4260-b865-777849997a6f", "value": "b0019d74584d86ef6687cbc8278b9b97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690ea649-38ef-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635536145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536145, "uuid": "133ec21e-2499-4540-8525-4539a10a09b3", "comment": "Malware payload (Mirai)", "value": "7a40533ae23c9ad78f62854030cae373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536145, "uuid": "361c8160-6c7d-4785-b8ac-4b8dc9208c5b", "comment": "Malware payload (Mirai)", "value": "edc6930b30ecad1c771ed2297a7633303663bbe49ee1837c57266167d532e4f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536145, "uuid": "2fd832c9-67b9-4a47-813b-7eb5167082af", "comment": "Malware payload (Mirai)", "value": "1be1d20769e6d38dce5df729347ec73487d91bc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635536145, "uuid": "63053a21-ce53-4ec1-ab97-1aff5f561afb", "comment": "Malware payload (Mirai)", "value": "92c40e955f1200ef8f748c859c4a4896552c276bea42a142cb9b4157cc114ac6e562638eba81ffc52f72da6b051a7543", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536145, "uuid": "e1f53e78-5205-4c36-a4da-ddb7cfbb500c", "value": "T19B834AC5F443E8F4DC461A342177EF3B5F72EABE2119E687D3984632AE42B02E50265D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536145, "uuid": "4779c490-a3dc-4f5c-b8f0-41f67b33ecfe", "value": "1536:2EnSyw5t+1LeAvKwjPYZEnhuBcnWYfHGutkf/sSX+/ALeAvWlfwhU+yi5+EH:XSypKAvBjPYZsh8cnWYfHGuSsSX+/ALN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635536145, "uuid": "07fa9083-1c6d-4102-ab96-ed88b75319b7", "value": 82704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635536145, "uuid": "54352f63-aa14-438b-9552-c68392d6dd55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635536145, "uuid": "bb28154b-ba22-4fcd-b15e-377d38d85a3a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410c352e-3860-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635474660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635474660, "uuid": "9818c938-2d2c-4175-99fe-bc93b2905071", "comment": "Malware payload (Formbook)", "value": "58e139c2d34846d74e928df2f53841c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635474660, "uuid": "f63faf7a-c26d-4fef-8cda-5d16e57e7737", "comment": "Malware payload (Formbook)", "value": "ee96df216161f048ee9c50853b018f779d71bce1498f28a4d1b1bc3d797f14ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635474660, "uuid": "77066aaf-75db-496e-be48-db74a4753f1e", "comment": "Malware payload (Formbook)", "value": "90a239f29005c46351dc0ba13ec55c6a8858cc32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635474660, "uuid": "c4b7b4b8-9a51-4773-a683-1bc688f00c1f", "comment": "Malware payload (Formbook)", "value": "8fcf584c74e00279a60aa129466d4de3f72309967f98d57063fb31b6c2adf8bfae789702884485c32f8cc980335e7441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635474660, "uuid": "ed24b68e-b2c0-48fc-8bc5-89b26ed5cf41", "value": "T16B363390F1D4453EC0F608B2D46A3EE7E3EAD4AB2B43F22B16427E5D1D511E858A91F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635474660, "uuid": "cae25096-2fae-40de-91c6-00688b43d1dd", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635474660, "uuid": "9ebfa70d-86c7-4dcf-9f19-f76132dfc315", "value": "98304:ysc/NNPNU7KqxM52jQOdg4Ibbsh2VRS+CxJj9+sF0d2fAu9JqOUqOs:yzPun3jHdgnbVRKxJjFffAu2qOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635474660, "uuid": "4bc512d3-5174-4fd8-8241-2865598c958a", "value": 5326569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635474660, "uuid": "481916fe-d69b-4a22-b4cf-4f7528ebc104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635474660, "uuid": "e0b42c40-e7bd-455c-a876-87567ca3aa64", "value": "EE96DF216161F048EE9C50853B018F779D71BCE1498F2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d9d621-38e6-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635532512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532512, "uuid": "1753e692-fcb0-4c91-baa4-84a8fa9b5b30", "comment": "Malware payload (ArkeiStealer)", "value": "7c60906a6b21fbbe1e8134b9f3a59418", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532512, "uuid": "881d4b87-6db0-4fcb-8041-74f57c93c96a", "comment": "Malware payload (ArkeiStealer)", "value": "eecea563147d007bc88b5baa2294e2a814c88975f82778454fb2a515dba401be", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532512, "uuid": "822af7a5-eb20-4497-903e-84db0b8b2c92", "comment": "Malware payload (ArkeiStealer)", "value": "8cd71270d8dabbf02c9169719229abf68a286fce", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532512, "uuid": "ad765ef9-a269-44c5-b707-6e15727db97b", "comment": "Malware payload (ArkeiStealer)", "value": "49da481e065e9936acd4a868c4865e5830cef37aa2204a4bae3298683fff5e7bc61d333ca2bf2e56f518dfc2dbbfd5e7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532512, "uuid": "693fc89c-3d64-43cc-9ad3-b3f87b8b61a3", "value": "T132749D10A6A1C434F1F212F849B6A369B93F7AA16B3494CF53D516EE4B786E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532512, "uuid": "3a2e1fb8-23fa-4a56-b535-7c21530cc05f", "value": "b4e1899733b7c624a2bcad81ab4ebcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532512, "uuid": "9161f819-29ac-48cb-9538-bc531239f904", "value": "6144:lYJUBXU3jSV/xW7JCAYtEleu902c2C0BfBQhb8:l+UBXUOV5W7gAYtElj902rlBQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532512, "uuid": "1dfcc13e-3bf3-4a13-bd04-efb8f43751d8", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532512, "uuid": "b8d35c5a-23a7-4ffe-a33f-7d12ef7ba461", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532512, "uuid": "6ff3e536-e0d4-4731-95da-a7117642aaee", "value": "7c60906a6b21fbbe1e8134b9f3a59418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7ccfb0-389c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635500529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500529, "uuid": "825c3eb1-ee5f-45c5-8625-41b1219b26b6", "comment": "Malware payload (RaccoonStealer)", "value": "6f13644a74aebdaadd56380dbc1a4265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500529, "uuid": "14077934-87a3-4dce-9a4c-f1b7132c5a8f", "comment": "Malware payload (RaccoonStealer)", "value": "eed04bcb8ac8720b0f1f1f5238494d58d163631cc63d5de1a1109f66d2409fe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500529, "uuid": "15d4d970-3319-4da2-a00a-9e5d6c90b191", "comment": "Malware payload (RaccoonStealer)", "value": "5470794e5766b346e73d4a44a194ccd582df3138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635500529, "uuid": "bac203f8-779a-4eb8-8382-885923447e1d", "comment": "Malware payload (RaccoonStealer)", "value": "c801acfd9373ebf675cae9ccf217fa1baed428402d28002af9ade13df94fcb5a58421686b0394e5db5e2da8b260d5646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500529, "uuid": "e727e606-dbc9-4a93-b124-8eea1152b21a", "value": "T111D4E000B6A0C034F5F656F8497593A9B53E39A1677494CF23E926EE4A38AE1FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500529, "uuid": "8887af3d-218a-4e18-97ea-9de6b24e1e4c", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500529, "uuid": "b2056f4a-2970-4974-8668-8a07edfdf134", "value": "12288:wK9bGaH+LtaS/BvPY44KdLNHIiC9Ef8XnD5VegJLS5ST:Xo4o55vPwKd9oEEXD7q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635500529, "uuid": "be0eb023-92d6-4da9-802c-01736b694773", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635500529, "uuid": "4c3f446d-a75e-4f45-903f-686b07e9e2f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635500529, "uuid": "eccd4006-6b7a-4d8c-9ce3-04486a83a7e2", "value": "6f13644a74aebdaadd56380dbc1a4265.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef29ce30-388e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635494709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494709, "uuid": "ea8d0e4d-7060-4ed4-9394-74471347fc51", "comment": "Malware payload (Loki)", "value": "e4b5c11f8c4f84b9a240a293100b33e7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494709, "uuid": "b6f29ac0-5b55-4a2f-bc09-e743c301341e", "comment": "Malware payload (Loki)", "value": "ef8f9358e36d909a7b048d30456dcf8b5d548deafa80adc7635c7881e61715a3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494709, "uuid": "9d78606c-c3ae-49c7-b27c-194af951391b", "comment": "Malware payload (Loki)", "value": "75eb295ea88bc82c7e1f493b9d247ea72155d4fa", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494709, "uuid": "f30ae05f-9a71-459f-b2c7-83a909e8585d", "comment": "Malware payload (Loki)", "value": "734c8cb25e8447b03fce24ee131fd7353bd7ea79524e417f38a421bbbca7b5b35af8e8cfb36c28e8de846bcd5484e055", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494709, "uuid": "b485b35e-bf08-4bed-ba22-fb87296e01f1", "value": "T10F4512425F9551EBC70A1E31746F231A831C4C5EE16C9B1AD2FBB16A87F0D72C263A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494709, "uuid": "5b99050a-b947-4395-a776-b6eaaf697a69", "value": "24576:MtN0K9B8qFKO/uAzmFTFsRM+m3eOzV5KGa4TtKW2+lg:sB8QT/uAUKDm37Gdfyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494709, "uuid": "1ca57bb7-ad38-41c3-b90e-38b4695097e8", "value": 1178152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494709, "uuid": "b347a016-9bfe-45fc-8d70-026a7aec45b8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494709, "uuid": "5f54a434-2fc9-4e0a-90ff-37634adaf95f", "value": "0022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cfdb09-389a-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635499632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499632, "uuid": "f4f9bb58-37f1-4356-893e-6f8fac2b1c9c", "comment": "Malware payload (Loki)", "value": "4abfad65054e3e3f890a6ebb6f927d68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499632, "uuid": "f78717ad-0860-4f78-9da1-e8c482bf5d7d", "comment": "Malware payload (Loki)", "value": "efaecc96942d1988b9adb7419ea8aaaae42ca045286a854109bbe9f29dc2c8f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499632, "uuid": "20998c1d-870b-44d1-b6c3-13f6b4ab8fb4", "comment": "Malware payload (Loki)", "value": "27dd679bd31b3c4511b66321c9dbd51829989729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499632, "uuid": "b50a591d-26ff-4c23-b90a-e476994418b4", "comment": "Malware payload (Loki)", "value": "c5fba63375a15de8e6da8d01ad32ce59478f892e3c55d2c4e03fcd5f16a631f3b609f3eb55479e0239067e89c0a6847d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499632, "uuid": "f8cea7ad-c301-48a2-a119-70da805c841b", "value": "T1A144F22697681561F22309F71FE5B9F42937BCA69C0D844B2284FD9C1FB2686490377F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499632, "uuid": "a7d96cec-d3ef-4c90-8072-f7aa9416d39c", "value": "3a196462f17f4821d4c80ed2f22a0dfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499632, "uuid": "7f1857a1-9653-4790-b350-dec6ceed0267", "value": "6144:4DuKdZmK43ZLV9/5cY3jvLG6DlbKks5KnsXzPBmZ:4Ndw3ZR9/1T66RC7IZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635499632, "uuid": "a529d070-cf14-4b2f-9fe7-fb65cbd3df4c", "value": 264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635499632, "uuid": "5603a756-8f2d-4c67-b7b3-2fad499b8c57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499632, "uuid": "aa7a70f1-9e5f-47bc-88f8-2c8602bc16e0", "value": "PO88736446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c06f067-3891-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635495723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495723, "uuid": "04bda8bf-e950-4170-bd99-87005ca9ba81", "comment": "Malware payload (AgentTesla)", "value": "2b3b73da054db663307f54a6e33a44d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495723, "uuid": "c05b5936-2214-4477-945a-5d3e967c21ac", "comment": "Malware payload (AgentTesla)", "value": "f03c678106db88fa9f9c148709c092bcee93d1e238c2864c05d84e42ebcd2ccf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495723, "uuid": "49718997-1322-47c2-b97c-12368f3feeb3", "comment": "Malware payload (AgentTesla)", "value": "eb69ca7b14435517f559075a978765ded157ba5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495723, "uuid": "826d62c0-3124-4aae-bf87-29526574d6e3", "comment": "Malware payload (AgentTesla)", "value": "af285251461effbc70dbbe0646a0ff192587cff065a00a03e08a58ff10baf7708b27bd69777dc9c001dec30a56495314", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495723, "uuid": "3fef88c7-59dd-4c06-aef3-176944452110", "value": "T1E074E045A339876EE1BC03BC44A3076847F5A8677372F7858FD638DA1823F821D15AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495723, "uuid": "a5a14bd9-502e-4eed-8ab3-bc0959f7271b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495723, "uuid": "76e7f479-8bcc-4dfc-91ff-e824f15ae2ee", "value": "6144:9lfZxvLf614b47d6f4Gz4K6PCFWZ1BeU39m2PqOQy2MBqrEd8K7twnowoIIUjxkQ:9lfZxT6Bzm2PJQy2MBqIW4twoBUjx5L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635495723, "uuid": "ae10e066-216d-4765-9228-88f5e9ef9755", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635495723, "uuid": "373c3a51-bf03-4309-a105-d1428ecf5755", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495723, "uuid": "5d768c9c-e6f7-4e99-a57a-f1d1704d6d6a", "value": "PO# 5100299028__0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e189bc3-389a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635499700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499700, "uuid": "dcfca5f6-b6c8-4919-a3cc-0d0bddefbf8c", "comment": "Malware payload (Formbook)", "value": "68d8a36449116490976ec30082dad2a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499700, "uuid": "3cbbcaf9-b60d-4f65-be5f-139904fc442e", "comment": "Malware payload (Formbook)", "value": "f0b67dba2c080cbd4fbd19b34f8b32d6d9254c9365b7d98abf085615d821f294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499700, "uuid": "407f4e59-7143-4f7c-9101-e0f9a31b31fd", "comment": "Malware payload (Formbook)", "value": "84a939cf6dc021dc8f66ea0333648914aaa96bdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635499700, "uuid": "59000869-beec-46f8-8454-2b81b6d75efd", "comment": "Malware payload (Formbook)", "value": "9cdeccb5f190ab0fecdd57fa2ded590553407671ba3695364206920aada55c380c86d151f35e66aaa7ad6505b5ac2acc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499700, "uuid": "2e6bd59c-ff78-4fe9-99ad-109f0edb95f7", "value": "T1F494F2A23E9DD493F51E0571706BE34AD129949E07330815F7B9BF3FBB6818A780B606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499700, "uuid": "d26fed27-5a46-481f-8bf3-d8a66207fcbe", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499700, "uuid": "f7db7d2a-6c24-4330-bf5f-003ce7e13117", "value": "6144:vBlL/O9SGMhIwqvpu4lkI5ex93XuNsu4VHvs5G4dtDQTHvob9wbN3aSI:JkS/hItu4lq3IQk5rdOoZ43aJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635499700, "uuid": "224d884e-649a-4017-aaab-b3a94f3c3991", "value": 428868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635499700, "uuid": "920eea16-7301-404f-8791-5f18e408844a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635499700, "uuid": "4b959ced-069b-4a1a-8e72-6c463185517a", "value": "Scan003_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb97e141-3855-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635470248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635470248, "uuid": "184ed1f9-288f-4f95-b80d-00a2ad811ac2", "comment": "Malware payload (RedLineStealer)", "value": "f4e868760f3af522ab9d5e8852e25b69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635470248, "uuid": "272c6952-7db9-4f20-99a9-6461901b0ca6", "comment": "Malware payload (RedLineStealer)", "value": "f0bf1ff85a29dfb06cf83aeab4093d9bd9edfa5781fbb65fe8a31d32cc14f2bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635470248, "uuid": "14ef98b8-a68c-4aa2-b84f-53bb0fdc1891", "comment": "Malware payload (RedLineStealer)", "value": "527c7a0c96b0ebb810f9fa6575b13502e350da44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635470248, "uuid": "cd5c3e10-80eb-4711-b84b-7052593ca2d3", "comment": "Malware payload (RedLineStealer)", "value": "da28a010fd7c6b58e32c28a1ecb3d2a905459075d54c56b4c2d980772fb097c9e7fbb1bb95c2885e958a8db4beb334ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635470248, "uuid": "a9f0957a-a26a-4e19-b162-a233bdd9d083", "value": "T112748D10B7A1C435F1F212F8597A9369A93F79B2AB3490CF12D526EE4674AE0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635470248, "uuid": "b47e7fe8-f5dd-46f1-9bd5-7e93a25f1897", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635470248, "uuid": "f9d9bca2-8c2d-4eea-9cff-434da819c174", "value": "6144:OsHUpEfVm0VYjVP+PlevIFtXnA5etjJL02:P0pN0VqEPlevIDXnvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635470248, "uuid": "3612abe6-6740-447f-979f-2d7f305fe38d", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635470248, "uuid": "54860457-e659-47e1-a289-da6a4fee412e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635470248, "uuid": "125d4666-12b5-4676-96bf-8c07baadea25", "value": "f4e868760f3af522ab9d5e8852e25b69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e85b5e5-387a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635485849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485849, "uuid": "9578c8a6-3244-43e8-8b87-044fca106600", "comment": "Malware payload (AgentTesla)", "value": "175fdbd633810607fa08c6239914e1e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485849, "uuid": "d2c79056-4df2-43ec-8c82-140c075d3a61", "comment": "Malware payload (AgentTesla)", "value": "f0e32a1b7f1f1b52a034708b87a423a09b9357da826a9a6d9b93329f2bc740b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485849, "uuid": "70772408-a003-4347-a80c-9e3d4ad8d840", "comment": "Malware payload (AgentTesla)", "value": "ad74834889bdf1864805896d6e44b4a19a837f24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485849, "uuid": "5a386608-83be-40ac-8320-c69d9cb49189", "comment": "Malware payload (AgentTesla)", "value": "45599e101b6a70db0eccbe41b111e15081d29041bfc820b0e8e27969738cca9a100b754aacb38def011ade6c04215307", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485849, "uuid": "1147aa6e-af22-436f-bc3e-acd622d65d0f", "value": "T14D8423002899207AFF7412E5DAF19C883851A963FE1ACFDDF52C9D749096CD6934CACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485849, "uuid": "44faf1ca-e5cb-474a-ae14-745f0ffcc70f", "value": "12288:p8dK288mFglMbXTLmcUmf72on0R9gsW5D6:Sx87UmG9gsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485849, "uuid": "068261fe-fc37-4b81-b0b4-00261008518c", "value": 408000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485849, "uuid": "17af8dfa-bb55-4056-967c-6c67ac30e8bf", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485849, "uuid": "e3c48f2f-4b24-4497-86ab-4ff5f421477a", "value": "QUOTATION.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd966e3-388f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635494785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494785, "uuid": "5512f5d4-3995-4b64-9f9b-9b7132b54a61", "comment": "Malware payload (RemcosRAT)", "value": "14ff5e0fe561f13cdf7a598dbc6fc598", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494785, "uuid": "3c8129e9-8e7b-4557-aa27-f2840f8e74bb", "comment": "Malware payload (RemcosRAT)", "value": "f209e4caf270335b9688781274f169ce1bd46e12c0585295a0c31dcde7e57e8b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494785, "uuid": "6686909f-9bf0-4e89-be0b-4e4d6bc56b81", "comment": "Malware payload (RemcosRAT)", "value": "dce0653178a63d857c1a513c3d55101f4fbb1473", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494785, "uuid": "2a8a510a-e6c7-4d9c-a582-e053c963adfc", "comment": "Malware payload (RemcosRAT)", "value": "3c38cb5cb119be10cedd5eb53c1cb3584a3ab922b4f629fbf5edf5d1e26b9a5bf78b118534061a02ffe7e560d1b671a8", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494785, "uuid": "ba67fc9f-db41-428a-89b2-ae3738b25fca", "value": "T13F25AF23B3D0A175F272B5BA4E2696BC4C0AF9253804AC837BF50F9DDA353502A25777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494785, "uuid": "7694093b-9344-457e-af77-23cdbb944ec0", "value": "3f5ed924d88345a5aae215811a2cff84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494785, "uuid": "43ca0b77-8621-4792-bdd5-feb214829032", "value": "12288:qXIL69gWfTG2pMP1o6C+8zix8sdaPp62E4Js6NuLpjqayC94M0LdEegD:q4uBfTG2pM9o6NN+swhY4XMjF9Bey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494785, "uuid": "efb5519d-1729-45d9-8ee9-fb23af482b13", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494785, "uuid": "7a6976cc-2327-443a-bfb3-a7c9fe310b79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494785, "uuid": "580bfd62-f554-4784-bdea-3edeaf050724", "value": "DHL_656457 receipt document,xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0842876-3874-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635483544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483544, "uuid": "b495ba34-18de-4e0b-982b-ec829d4c47e1", "comment": "Malware payload (RedLineStealer)", "value": "51528d8f32a00da656a327601aa898b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483544, "uuid": "6cb3cee1-2ec2-49f2-8716-cff2369ad58d", "comment": "Malware payload (RedLineStealer)", "value": "f35fc48fa7245d56a13e52b4e1fd205e867c672045d78cbd871b8e98f316b60a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483544, "uuid": "d0e56c89-4e28-44d2-8f16-e4a02b5dc5f5", "comment": "Malware payload (RedLineStealer)", "value": "4e0a41549ed00e09f292e966f8b581563f7173f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635483544, "uuid": "e0debf37-50d2-4a1d-b669-f8912ce7c15d", "comment": "Malware payload (RedLineStealer)", "value": "d3c588833393079c9c8d33f5f0f85019a8733a89f21f942f6376071c9e653dd90320b757320d94539cc55584f82b9ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483544, "uuid": "20d12b6b-4e5c-4256-b8f0-c38cf3306311", "value": "T1FB64D0F136B98831DC932A304875CBEC5E3B7C61E92485563674266E8F72ECD46E231E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483544, "uuid": "e41b4772-4e31-42bb-be5c-f19e258e169b", "value": "2b117a88efd5ad3db577a4f98b26ff8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483544, "uuid": "9c945af4-1a76-4a0c-a2fd-3e8e93b7c6f3", "value": "6144:fc6N6JN+sJHqhpUMTL4NdBWWPAXJqU6jPG0i6ng+uzbgwu6L7ITsq:fH6JNNKvUM6+WPAkU6T1vunnn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635483544, "uuid": "c392a8da-20ee-47ad-97d0-267c649cc406", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635483544, "uuid": "1105ccad-98e2-4278-9881-19a1978d7deb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635483544, "uuid": "49cd6a30-6615-454a-bf9e-635e2e9c31e8", "value": "51528d8f32a00da656a327601aa898b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf179442-38da-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1635527270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527270, "uuid": "c344e5eb-72fd-4077-a02a-a6b907f5ce26", "comment": "Malware payload (AZORult)", "value": "bf7fc1c484d3c92db7e4131251c766c5", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527270, "uuid": "37113bb1-fdfe-4b21-908d-238fa2ce4e52", "comment": "Malware payload (AZORult)", "value": "f3626b892a978274c9de67efe8625b10ddfac9c1a0410c6d39ab04593ec62e23", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527270, "uuid": "ff5a4d2c-12ab-44f4-9e34-795d05600b54", "comment": "Malware payload (AZORult)", "value": "21839af6ef94342558fe0444bc29e925c309d7bc", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527270, "uuid": "b71bd3ef-3d9e-42ee-8616-23fa18f9ed3a", "comment": "Malware payload (AZORult)", "value": "e40945dadee537f61170c3b02d1c3c7f2d4b5504864739b35acb38b7cad5c3603802e5801082e271ca17ec39ac2d849d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527270, "uuid": "a929e34b-cf49-49c3-9790-1849375cccfe", "value": "T18DB3196EF7C19277D02408BDCD45A1B9907975302E391822F7E64F6CD8F96C2AA6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527270, "uuid": "5b63f4e2-c703-4c8f-9706-285cf3830b98", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527270, "uuid": "a93c6d04-e964-498c-bb6a-1fe9cc90fb80", "value": "3072:KExRaX6raoCoCyz6/mqv1JR+yBtGOeaeWgicq:faZ1tme++wiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635527270, "uuid": "67683642-49ac-4a96-8969-94a7d4278fea", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635527270, "uuid": "0a19073e-b101-40b7-8e54-c853a02261fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527270, "uuid": "e30d0a16-b1e3-4476-9ea7-c3f717eed7e3", "value": "F3626B892A978274C9DE67EFE8625B10DDFAC9C1A0410.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829a3c24-38b3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635510418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510418, "uuid": "8513a610-9f61-4ed0-93f7-b6becf0e8c44", "comment": "Malware payload (RaccoonStealer)", "value": "698c5e43e243b539239cd20fc1ae2b23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510418, "uuid": "ec0c523a-adb5-40f6-af80-a32278b5aa4e", "comment": "Malware payload (RaccoonStealer)", "value": "f3fc38ead9aae7ffdb533c056bcc93f6db5cbf153ac9cd8673945535288af947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510418, "uuid": "1f5617db-57d7-4553-9a61-7fadcdf686e9", "comment": "Malware payload (RaccoonStealer)", "value": "0f134dd2448f054e03500d0081c14b8fe7241fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635510418, "uuid": "c8280056-7957-489a-9494-74e9650dcb25", "comment": "Malware payload (RaccoonStealer)", "value": "0496e3c1d58cc44c5f86e18da67c57d98b948798ecd7ba4584cc790dbdbf21e912b5ed15daba14c11fc72b46fd2d451e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510418, "uuid": "c36aa570-6380-4f8e-901d-9256c4b73a22", "value": "T192748D10B7A1C035F4F252F859BA9269B93F7AB16B7490CF12E516EE4634AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510418, "uuid": "8d72cdcd-b0ee-4acc-91d9-f55acd23cf1e", "value": "e522cb867082e04c7a4b61561f8516ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510418, "uuid": "959bc262-7f36-4913-9720-f8b69675f20c", "value": "6144:IuTtoV59UAUwyNUHJH1v/cTHgc6zBQ7kzgMnh/n:ICy9KsH1v/cTHgc6nBnh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635510418, "uuid": "57cc5265-d981-45ec-8de7-13b5e9557d18", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635510418, "uuid": "73f0d089-92b3-4a45-a154-0e810cc1e9b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635510418, "uuid": "1dec3cf9-d3e1-47c6-b082-6dd738b15df5", "value": "698c5e43e243b539239cd20fc1ae2b23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b154187-38a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635504204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504204, "uuid": "1c6bdd01-62d9-4889-b134-50af017a96e2", "comment": "Malware payload (Formbook)", "value": "e3d87c2d533796d8a78793bf4ef179ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504204, "uuid": "c51b4e8f-4cc1-4bf4-80a0-42a9bffc02cd", "comment": "Malware payload (Formbook)", "value": "f40c731716d135ea7e583819570a83d92e24c3dfb2a3b0ac375bd97774ffd689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504204, "uuid": "799e9cc5-5e2d-4dd0-868d-f034e23a741b", "comment": "Malware payload (Formbook)", "value": "7855d161dc42e4a0936f71274c9142950fc542c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635504204, "uuid": "e29ed668-f2e8-4487-b259-929fb4ae5a18", "comment": "Malware payload (Formbook)", "value": "2d74f9362c504ea0cd9eae8b9586234b17461e922e1a1e87b99a849bbdab5dd8d0144ff60b680610de34b65d732919de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504204, "uuid": "dd9e6db6-f815-4d40-b586-8aed5a2592b1", "value": "T1CF74125D4AE8DA31CEF525B820A981C977F942196220E65B1A0273DB7EFF703C093F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504204, "uuid": "d565f68f-07d8-4e11-8eb8-c9663c8fc66d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504204, "uuid": "cafc6c9b-8a45-4e99-be3f-488665c23708", "value": "6144:GZRNbMMSgoWYaE/CLwwpWv3vTwb9u+HVdBi8ZSB4GRtcnwvjvBCNdLc:+b/HNTE6LsPk9u+HPBfbwvj5C7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635504204, "uuid": "db0df5ad-0e4b-45b5-8683-b9190a5cec5d", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635504204, "uuid": "e321182f-6712-4f21-8717-398a5efe1743", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635504204, "uuid": "4175d7c0-a237-411f-a481-8c39fe2175b2", "value": "PO4809217226898789.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f5589a-3868-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635478017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635478017, "uuid": "8d185f89-0e79-42e0-b4c6-68ac1aa51640", "comment": "Malware payload (AgentTesla)", "value": "ea3b8e0a3d23f10e93c5e37682f35f52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635478017, "uuid": "2bd8dff7-27b0-4d12-81b0-9875de0e7e46", "comment": "Malware payload (AgentTesla)", "value": "f4c57c24272dbcfaf2079e9d0041907acc1f3b804541ae0a46366b07e1f5ebb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635478017, "uuid": "dc6496a2-28d7-4d47-b33f-579225cf009d", "comment": "Malware payload (AgentTesla)", "value": "6a3fd905e8c35ae2554d17b89a638bcfaf00ef8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635478017, "uuid": "947b2be3-3f78-4393-92b5-6faeb74ee017", "comment": "Malware payload (AgentTesla)", "value": "2869fe81e7d102c2af69045c1216e25d76b8989336b89465e68f9ad2b64a708b312fbeace548004782343aa19e0543df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635478017, "uuid": "b7332cdf-a880-4a4a-aeb5-1c1311704d2b", "value": "T123B4CF321296AE99FFBB1FF4583021441FF5BC63A77DD249AD8A409623F2950CD60FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635478017, "uuid": "274e661a-3582-4c96-8735-c6c3c8132e5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635478017, "uuid": "964e3432-af22-4a48-8d74-df6bbcf896ac", "value": "12288:CCNqjcqJFTPdFNNt3Y6tse/1YCQw/SxA1j1IFIT:CCNtq9Ntow1jQ4j1IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635478017, "uuid": "78a5f07a-81be-445e-97fe-c379a1e097ac", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635478017, "uuid": "1969debf-8592-402f-add2-4216d73c492b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635478017, "uuid": "66c33899-36cf-40c4-a1a2-15e3ebfebaa0", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9081fe60-38f6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635539217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539217, "uuid": "819f600b-873b-4843-a201-94ff4ddad885", "comment": "Malware payload", "value": "022bc73fb9791a575e7799c81158b70a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539217, "uuid": "4069dcd1-594c-475c-a4fd-c8dba373ad4c", "comment": "Malware payload", "value": "f520f97e3aa065efc4b7633735530a7ea341f3b332122921cb9257bf55147fb7", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539217, "uuid": "43740d8b-6db8-48d6-aefe-f1c398730a48", "comment": "Malware payload", "value": "f35a3627b53dbacfee92ab25a14104ef145efb46", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635539217, "uuid": "5058b46e-efd5-414a-9acf-390235ed8fdd", "comment": "Malware payload", "value": "e1974eeb8ab1834dbc1a229dc6a3eeb8c1221a499b131dfdf7e10ee9b75ac0c64c8f9e1a164335ca65fe02a141360a11", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539217, "uuid": "e4e50006-1efe-47af-86c9-ac010d333fd1", "value": "T1ADA33967C66AC4C7ECD68CFCDB2972ABE0B4BA1A4C1445D3BE768EC26B31D645116303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539217, "uuid": "b26307d3-c663-491f-8a4b-6d79f89ffb5d", "value": "1d30df1e5b7623c4b3e7485c04815cbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539217, "uuid": "7ae1874b-7c4d-405c-9c5e-ce68c10627d4", "value": "3072:TWK939CyKO0NZThiKlNkZRmiXmAe/lY1lzBRjn9vOw:P0vhXsZBmEltRjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635539217, "uuid": "6835b784-54c2-4a2b-9867-05f88ab1aab6", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635539217, "uuid": "b9805083-cb0d-4c38-bfc1-3dcb21377cdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635539217, "uuid": "f40504c5-31fc-49e2-a643-9e34c5b5d69b", "value": "oldmystat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4286c9e-3891-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635495979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495979, "uuid": "30140042-f394-4f06-8c39-f0f4bd48db60", "comment": "Malware payload (Loki)", "value": "4fb2f672e188592f43da7b4c6d64e80e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495979, "uuid": "ccbad932-096d-4816-acf5-67d5dddff887", "comment": "Malware payload (Loki)", "value": "f53dc97b91a6942d8e2d94427056b28fdd9c01cde939029dcb3843d6b7ae129f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495979, "uuid": "c054852b-9d36-4344-bc7c-7ae3b927dff1", "comment": "Malware payload (Loki)", "value": "f42cad0fb2a08fb7cfb9680a480b778ed46bea1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635495979, "uuid": "f5630c0b-b82a-4f73-af69-150124729f1f", "comment": "Malware payload (Loki)", "value": "84aa6d92ed1a954e3ea2f8158a9ac137181c47c802bec561f34038f50162dcc093955606eb19558c6f35d29dd115f04a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495979, "uuid": "5ca5feb4-75b8-4a38-8358-88130c722e2c", "value": "T14694CF0063EA991AD3B90F7514B310505BB1B8E77E21E74B5E8830DE697EFC50A81F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495979, "uuid": "b9d4fedd-f5e6-40da-8c73-f351925cf129", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495979, "uuid": "9032e983-8c90-43bf-af20-673dd272ff4e", "value": "6144:KsRyfdO196y8/ZZp6puGQ4vduIiqg+D39UoZBjuZHm1dENc040Mue6Ij5p:HbHI/4Q4vB6+799pp0Oue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635495979, "uuid": "c1c35565-9302-4196-8fde-83bdd3f75fcb", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635495979, "uuid": "4b31fa78-761b-47ce-822a-3a6fcf1dfbf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635495979, "uuid": "1f4414f9-a16a-4999-848e-c8b9e2bd66e7", "value": "4fb2f672e188592f43da7b4c6d64e80e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757dca93-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635485485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485485, "uuid": "8fec1b63-03cf-433d-bb0c-44cdbe0de2b3", "comment": "Malware payload (RedLineStealer)", "value": "143d846ec9a54971f98798b6e72a7ce2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485485, "uuid": "9f2f9151-7edf-4381-9b7c-24f9d435ea21", "comment": "Malware payload (RedLineStealer)", "value": "f5516682ddf2db69468dc8f1ac61ec18319066bb90526a7d25385a4cf0b133fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485485, "uuid": "0984eb31-fd85-49e6-acc3-c150b3a9b11b", "comment": "Malware payload (RedLineStealer)", "value": "39d4fa5bb0f052dcda1c3b06fd4c1df5504bd264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485485, "uuid": "49844954-22db-4f4d-9a32-16aad2dae662", "comment": "Malware payload (RedLineStealer)", "value": "4b6fe531a539483423a4c920c0b73a0677190592ea7fa110a2bd7eb915b358dcc2621ef65dd8b0eae9fd460973641cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485485, "uuid": "c0a19132-57e0-45dd-95cb-ba2c36f16944", "value": "T12764E0F072ADC736D4D36A34882DBA955A3B7C62D93091C63370262E5D70ECDAAE431D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485485, "uuid": "d6415124-b38e-47b5-94c3-e0336dc6425c", "value": "18875662b19ade4ddd6bba43f9abb4a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485485, "uuid": "bfcb101e-e3a5-49fc-98c1-b09cbb981b80", "value": "6144:6B9YFzPwwALhXJ1MqUn3jxJ64i3cVSS7olutPIyaIfeSNz86JUJtuzbgwuA7ITsq:6IFzPUhXPMqs3j+kSSuSPIpkr8htunnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485485, "uuid": "ca2ce49d-63a9-468f-bdfe-3f41d3889c7b", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485485, "uuid": "5494308b-8035-4e85-acd4-871821fd64d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485485, "uuid": "57498746-27e5-4983-94c6-0e1312878d66", "value": "143d846ec9a54971f98798b6e72a7ce2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2db9fac-3879-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635485588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485588, "uuid": "9b0b68b2-93f4-4f11-bd2e-17bdefb4f980", "comment": "Malware payload (RedLineStealer)", "value": "ba75c08d31eb6523ad7c1bfabe8c85fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485588, "uuid": "02b3d629-7378-416c-81a6-ef26eaf56582", "comment": "Malware payload (RedLineStealer)", "value": "f64b0b78b83baa21b3b09adfe538331848fb15f11eec09fe75794774f171ec61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485588, "uuid": "cee81a6f-9cf5-484a-ab14-cd18e224764a", "comment": "Malware payload (RedLineStealer)", "value": "91032583b7d8c28a563068263486a6b10e8c35ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635485588, "uuid": "96a60bb9-db3e-499d-9562-e18ce98f3d1f", "comment": "Malware payload (RedLineStealer)", "value": "858f1340329b63892d1cc0ac557eebdd54b5cbe6594bbe3988bb0475ef6991dece4d06dcc1cf3cf3a20d734d248920bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485588, "uuid": "54ddff92-59b8-4f3b-98e9-b7ad8e00f566", "value": "T18C748C00B6A1C035F5F212F859B69369B93F7AB1AB7880CF12D516EE4674AE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485588, "uuid": "f7d0308c-62be-4ac8-bcc2-6e89e2f4b4b9", "value": "e7e707cb5a6cd20211e77d5d46383cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485588, "uuid": "0a205df4-7540-4946-aff2-c00f23b7520c", "value": "6144:8OUnM0nPlOn3H+rgTzLQJik7WvLlY8Ld5HcdHWaa:8dTndUH+rgTz8iMWvLS8LIdBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635485588, "uuid": "cbf5a814-7478-4ede-a9be-18f55fef4e52", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635485588, "uuid": "9d7353aa-ad73-4183-bf03-95e4d6bea919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635485588, "uuid": "67bc5cbd-4ed6-478f-9e96-7c574b0c66f6", "value": "ba75c08d31eb6523ad7c1bfabe8c85fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6de4dc-3909-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635547264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547264, "uuid": "b65d8d5b-1c88-46d7-8d1c-64e32d5527a5", "comment": "Malware payload (RaccoonStealer)", "value": "3b62e9c30b398554f476147d4386f2c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547264, "uuid": "364dab0e-a428-422c-89d3-151437cac58a", "comment": "Malware payload (RaccoonStealer)", "value": "f7066f5159f83c1266329e7e8bf27abe5fa6f481da98e3b31c3f8e3cc1af7f06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547264, "uuid": "eb0e5304-6a8f-48c5-9abf-29a51aa310e3", "comment": "Malware payload (RaccoonStealer)", "value": "7d45a88064af2c0f161bc682eba5244168ee1554", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635547264, "uuid": "228cd9ea-b746-455b-842b-861dd52352c4", "comment": "Malware payload (RaccoonStealer)", "value": "5ed92d21642edff449eb2fea63800fc6731d85ae8be155c2e874ea09e4696b0a30d2be64f109f43c98dd13c2c8df69b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547264, "uuid": "7a02e39e-5861-49d6-8378-3ae79afd34d0", "value": "T1D3D4E01066E1C034F6F612F84AB69269B93F3AA1677491CF63C516EE4B74AE1EC31313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547264, "uuid": "40108c83-694d-4f29-a719-85cf5a014156", "value": "8554f137e95e1371295faad9355adee2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547264, "uuid": "b3130872-4f7c-4a0c-ab40-d2f664b1009e", "value": "12288:1MBS0AzcVCAIkmb256sgQywX7Axl/9yN4u5oO8:GB5A8PBIvx+4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635547264, "uuid": "d9a929bd-b9d4-4597-bf2c-4d12f5e360a4", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635547264, "uuid": "dd75282e-1020-4b6a-b3e2-6c275a470c57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635547264, "uuid": "9cccccc9-8a27-4c43-87a2-dae93f6bffd8", "value": "3b62e9c30b398554f476147d4386f2c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebceea0-38f9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635540288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540288, "uuid": "c8519d5c-4b7d-434c-aa1f-a6c3d5f527f5", "comment": "Malware payload", "value": "3baddd3f89ff9fa6d5058dd9e78351ed", "object_relation": "md5", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540288, "uuid": "60d15dc6-059e-493f-8f1f-7ae30bd3c4db", "comment": "Malware payload", "value": "f7118fd4b83266389471f8752f63f320b00db81c07db46d7963eb382fae8cb81", "object_relation": "sha256", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540288, "uuid": "6f45346c-2257-442f-b28a-2d9242427339", "comment": "Malware payload", "value": "875120c436db92826a795e289eb49749438e7eda", "object_relation": "sha1", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540288, "uuid": "9f19ca0b-7e92-494a-a3f6-796e12e57520", "comment": "Malware payload", "value": "d04914354bd4ed88cb8edf77479dccc5260a66d743851404c9951f357f8019de5ee84b5e59f4b6dbe2c2f8a125b7451d", "object_relation": "sha3-384", "Tag": [ { "name": "SharPyShell", "colour": "#FE75F0", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540288, "uuid": "dd4b41d1-a430-4acf-812c-7e08af7fea8e", "value": "T10442D7B003548AFAF7E54B96D5B1186C2579227B78902484D792FEFF2C1BEC38079867", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540288, "uuid": "a7fe03bc-b97d-4bdb-8e20-53357f273a39", "value": "192:k7xDPpA823AoOv6SDAi/gBpa255aED1WgYw532URFBdwBf9ZVtTFtkDKbJUD5:kReJ+DAiga25QED1WgYyBdKFDXbJUD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635540288, "uuid": "6ed52a0f-713b-4afa-84ca-5f0abd076099", "value": 13037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635540288, "uuid": "61036bc8-1411-42a7-8826-607d44a10e1e", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540288, "uuid": "293b1e22-8029-4e3a-8b70-c07d08aaa078", "value": "eGeNYQrK.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f67ecc-388d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635494269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494269, "uuid": "59d2f2f8-c2ce-4814-8832-0e4bb614726f", "comment": "Malware payload (Loki)", "value": "1e8445c29aef9a98df406a97d73c9dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494269, "uuid": "783490f1-fa57-470c-ad4b-5d1524089ae5", "comment": "Malware payload (Loki)", "value": "f74616a3a4251eca59b493e72e59504799d846907e550470197c3bfe3711a3b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494269, "uuid": "8957d5bf-4067-442e-bcc0-cf76fb064aa1", "comment": "Malware payload (Loki)", "value": "04997a9db6372feedaa6aeab143c66f76315304b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494269, "uuid": "e18aebaa-0e33-4488-ad9d-400a0f4f65ca", "comment": "Malware payload (Loki)", "value": "17fc3d300948ac3cc2dc6e70ba8beed9ee20ba6319915372f0d294eb953881d60adaf8bb4dcaaf768e77e993dc00a542", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494269, "uuid": "e90c8dc1-33f1-4031-a47c-9d6d9450bada", "value": "T1F4242EC5E98455A0DD59AB716A37CD3582237EFDA874A42C28DE3E273FFB2931026053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494269, "uuid": "39b03c42-150b-43dd-b4b3-a86e34fb610a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494269, "uuid": "0f1633b2-dbb1-4336-9293-11ebfee7a890", "value": "6144:lAkztmr9r/EDpppppppppppppppppppppppppppppb3j8:X5mr9r/+pppppppppppppppppppppppw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494269, "uuid": "e34518dd-dc01-430e-8cb8-a6d3b9a0a37a", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494269, "uuid": "90d650f6-26af-489f-b471-7038a5136f3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494269, "uuid": "5512a569-7319-4eaf-8c21-8505f7fe7251", "value": "PO{Emir}.28102021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f3e5c2-389d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635501167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501167, "uuid": "ad3dfe03-9a12-4c42-9b92-44058013d859", "comment": "Malware payload (Formbook)", "value": "d316b55036ed7571bf26849eb0ae463b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501167, "uuid": "e104605f-24ce-4486-9e60-4b8475c55c9a", "comment": "Malware payload (Formbook)", "value": "f82263cd92ff85163569edb0eae620d23858d5958bb88b5bb205e6660d1e8822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501167, "uuid": "8ec60b78-bf28-4745-8c6f-464c6c1b63a3", "comment": "Malware payload (Formbook)", "value": "9b9e1398a81f5692caaf168023311e78fba2b193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501167, "uuid": "e37c54f6-d299-4ed7-b22f-f77be8d73c73", "comment": "Malware payload (Formbook)", "value": "f1692173dab0a1fa591bae270cf9a1be96cd0445ac1b3e58e36b777a1463ee206bea522b318a402a5ee421748d872f6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501167, "uuid": "03847279-00e3-45f3-8bb3-dfce938e09ab", "value": "T18384E0846378CB6BE4AC07BD94A2166943F598733672F7428FDA74D61833BC11E01EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501167, "uuid": "7327289c-d646-4ee3-8d5d-c0dbf88f996a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501167, "uuid": "6a0afed0-8a1c-47de-bea4-0d3d9045a71f", "value": "6144:JlfZxJ8N614b47d6f4Gz4K6PCFWZ1BsKUmST8q59Zcs6v1ucMJmQsEHyqQKgecwh:JlfZxqwB1ST8+cXIcMc6QKggfiyCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501167, "uuid": "db075f00-93a3-428d-850d-37bc72f4dfae", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501167, "uuid": "78c13209-3f86-4756-aa90-ada6a222ce7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501167, "uuid": "b7840d70-e3b3-42b2-86a5-b5e4387ed032", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8aaed3-38a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635503130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635503130, "uuid": "798513a9-ece8-4db7-bbc3-b6b3f2d344f3", "comment": "Malware payload (Formbook)", "value": "8e07e2f350449f748eb0d1a9cde22180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635503130, "uuid": "b622314f-9d7d-4047-8b12-00454d785fb6", "comment": "Malware payload (Formbook)", "value": "f83cdf1780fcb5525b353125751e8495c5d372d6fbd341b06a60f05ac2de2160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635503130, "uuid": "be651b86-30c8-4b5d-87b2-cfe1a131fe84", "comment": "Malware payload (Formbook)", "value": "6e453492ae09c770dd23bc4836c53b7bf7d505d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635503130, "uuid": "b4dc042e-57d8-4d73-9221-8fc00a8f252c", "comment": "Malware payload (Formbook)", "value": "6d561e1e8d69570caa46c08e15fe6934e756b28529314708f964c59a412a330ea6f400827cba4dfa0f66761198bdbe4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635503130, "uuid": "fc627a49-eada-43ff-b336-a51e75b9c789", "value": "T12BB4E04572B8C905D4B503B0D4B9C0F04771BC25D662E60FA9E63CDF3A72782862AB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635503130, "uuid": "fc509116-beb1-4a0d-b5af-7b9ae6c8d71d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635503130, "uuid": "6e535016-acbf-471d-89e1-e6a7ca33ba36", "value": "6144:pY6teQzFNImLrfqldJQjgeZ3D3aNjuopps9pm0fhKxrts7qsP8Y2wENviijhGa:weImHwQfDcH04fkCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635503130, "uuid": "6830c79d-7ed6-4952-ab7a-5957507aad0f", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635503130, "uuid": "bb9e5676-86de-4ba8-8abc-2525b8c15d01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635503130, "uuid": "3e554371-41a2-46d1-adb0-6c1a0cfea709", "value": "pvRnUbWwToDTcwg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9768ad62-3888-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635491984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491984, "uuid": "cc54eb08-568d-4570-8bd2-01ea9bc44cb4", "comment": "Malware payload (AgentTesla)", "value": "ac9a73cd145d839bd33207437c2ccb13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491984, "uuid": "eb5bc04e-d7ad-4640-9ac0-b5c48e208f5a", "comment": "Malware payload (AgentTesla)", "value": "f8c3fbfb0abe01065fd42f4968595f7b75790ac4a9c21fd5294f0dd40af14aa3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491984, "uuid": "5c71da17-e408-4007-a8f9-0d9130b12903", "comment": "Malware payload (AgentTesla)", "value": "0feaea8f2c39730181fae235d4ef5b7fd3746579", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491984, "uuid": "7cc4f0bb-64f8-460a-827a-39589e895b75", "comment": "Malware payload (AgentTesla)", "value": "02c778f5efcf54c28af61c3195184d877f00ac3842463c0c8b9352aaad308ae2e29f0c60f6dfa8e387afa75965e0884a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491984, "uuid": "08ddb0da-0aa9-44de-a6bd-741adb2d4ab9", "value": "T150A42326D136F7769980DCFA95E6D86C40E6BC2FC13A730A8FE52AB15195B4035C2F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491984, "uuid": "6b9fc23f-990e-4823-be82-b0e699aa7bca", "value": "12288:G5jWdfChn2UHkGwGBdD+WGvf5sDS8m/G/YpK2VAec:GSCMUEGZdDLG5iS8mcYpjVAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491984, "uuid": "f049cc6e-dcc7-4575-87d3-388da29e267b", "value": 453542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491984, "uuid": "f9f15cec-1841-413c-b43f-9cb3b535e03c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491984, "uuid": "0fa027ba-2750-4110-98de-5b6e68d113c5", "value": "UPDATTED S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c658064a-38b1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635509672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509672, "uuid": "6b469fcc-732a-4ac1-a67d-ab02c6fa5fb3", "comment": "Malware payload (AgentTesla)", "value": "c578c40c41cf43b7b742a60ef8bd5f82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509672, "uuid": "1f84eb9c-2baf-4596-947b-30a9f34757ab", "comment": "Malware payload (AgentTesla)", "value": "f9e261c7fa1ff60b7e9989b3b1de95758191ec2226a32359491ada10cee84de7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509672, "uuid": "8e8e6ee1-827c-4ba0-9e40-22a3bf0f9ba3", "comment": "Malware payload (AgentTesla)", "value": "7872bf738d8e1167d816e73d4288c08e2b92d364", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635509672, "uuid": "7c7f966d-06a1-4b28-85ed-a9262894646a", "comment": "Malware payload (AgentTesla)", "value": "1b9cdfa32dec587296377d27d3595c6325f99524c57540d0cae2ca98709a6b8fd4ca2bdfa64d6e4b5854c84eb1842d64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509672, "uuid": "633e8198-911b-42a0-b6c2-092a1c657cdf", "value": "T1F6542327B1E1DD6BD1810EB10269D99EE2B9D1080501AEDF8B605E73FD726C7DD1C0E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509672, "uuid": "c4a81658-d60a-405d-a881-b7c26e7e21c9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509672, "uuid": "99c81ca9-2344-49dc-945a-3e4cb9bb6591", "value": "6144:wBlL/caWPXragqQbOKBfFxdZCT235y1M5w9XrrsnqOf7pQ8i:Ce9PX+gbOUjC6pfEX/OzpQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635509672, "uuid": "a3703ae2-6d53-4935-8bf0-bc7d7d3467b9", "value": 281839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635509672, "uuid": "2c1fd6a5-2da8-44fb-b4da-1f478dbf6dcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635509672, "uuid": "6ce4aa04-98f1-4314-b4b4-94fa320fbdd2", "value": "Remittance Application Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554e2851-389e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635501322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501322, "uuid": "c7b12875-4743-49f1-9254-322bc3f4a8ca", "comment": "Malware payload (AgentTesla)", "value": "2817cad517c37d516e0df30dffc4c59d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501322, "uuid": "84b61850-7193-4ee8-bae2-9dbf577487e4", "comment": "Malware payload (AgentTesla)", "value": "f9e72a9c987c6cb8b91b083d3085b20d605bb099482d51f6c4a26fc1dc2140cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501322, "uuid": "a57a9f5e-2f09-496c-a7fe-167134d98e53", "comment": "Malware payload (AgentTesla)", "value": "c9a7794a948291a5315c873f1a399e8d4e9a84ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501322, "uuid": "80dcc264-cd5c-4ed4-8793-5668d43128c0", "comment": "Malware payload (AgentTesla)", "value": "2d6003827df710023bbbd5fdd17e3eb7ba1cb953c51b33d3fcd2ae36bcb359c88e652c24c0ceca840467e182c5332b94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501322, "uuid": "a075214a-00e7-45b9-a77c-ebf50d577b18", "value": "T185642335A0D988BBE09B9931DE7FA515F37EE5030514120B83D4AFBB67223D3420EB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501322, "uuid": "7bbc2b53-bd90-41e3-a2ae-f7ad6bd82dc9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501322, "uuid": "20f03660-2197-4dd2-8c3a-562591bf0a52", "value": "6144:wBlL/cu4WxHfFdmMFUQuckgfCvWBizs/wrGYH7WqsZqRlLhH1d85:CeuFmMW7a8zuw6YHSnZGhH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501322, "uuid": "c9503b98-e2c0-4153-a1d2-69191a02347c", "value": 311574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501322, "uuid": "49c94271-b5af-4fd6-bd70-3ec504db2ae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501322, "uuid": "4e2723f8-8c03-47ba-a929-84bc1b6fe53b", "value": "PO#R7603020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a97ca7-38da-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635527225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527225, "uuid": "1dac6192-5e96-49e6-af8a-9b6ec55670a2", "comment": "Malware payload (Mirai)", "value": "96fd54901b6e71959d343b48429793c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527225, "uuid": "d51b10e1-5757-4888-93e0-ce4488325cd6", "comment": "Malware payload (Mirai)", "value": "fa379a96ff9a181eae8a96c08026f19f4a8ace7581757c9019289c7d620681ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527225, "uuid": "be4fb359-eff5-4818-be02-b4782888a6d3", "comment": "Malware payload (Mirai)", "value": "8d6be81d9e11aec359b1044026c197243cb8dd1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635527225, "uuid": "55229c1e-d2ef-498c-a776-126a2d6c69aa", "comment": "Malware payload (Mirai)", "value": "1d5c4c43e0d543aa3bf669b832c1850b220bfdd55c11218d1ba40dd65cee4588ef71a411db644e525ac633510763c33d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527225, "uuid": "a71ef396-d0e9-408a-98af-f15f5e061ee5", "value": "T16A63AD29E49699E0C0814A34B0E5DE761F23A9C492672DF6EEC041F65847DBCF618FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527225, "uuid": "1cbdb57e-9a77-4332-8366-1d48dae64fd0", "value": "1536:4aOI62v5kwtCQZAXQ9FaL/NQTh1stbmHmkCrU:40Zv5kBQPt1WyHmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635527225, "uuid": "75925543-1f72-43dd-80b5-7dd6072d6b24", "value": 71120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635527225, "uuid": "910e914a-ce47-47c3-b9d1-d874d67e0ea1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635527225, "uuid": "84af54d9-a79d-4753-b160-88203f056dc9", "value": "96fd54901b6e71959d343b48429793c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e4b743-38e4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635531583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531583, "uuid": "f2de978b-b7c8-49d9-8fd1-dd12fe8973cd", "comment": "Malware payload (RedLineStealer)", "value": "5621749e05daad91b37e4fda523a7782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531583, "uuid": "79f88bd6-7bc1-440f-9623-7bbd30560850", "comment": "Malware payload (RedLineStealer)", "value": "fa39bb57e0c8ef6d1bcea10ed6c89c8ce3f750a362c592128cc9f1ef570a14e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531583, "uuid": "7f4f1e68-22f2-44b0-9b84-7a81b4e4390c", "comment": "Malware payload (RedLineStealer)", "value": "a550f66f2835a3fbe2f871f7c4fc0485afa43068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635531583, "uuid": "d6041f50-4cb2-4eaf-ae3f-45ab734a0633", "comment": "Malware payload (RedLineStealer)", "value": "72b26629cc7465e88a3dd04923cb191b0d991c39bfcc553d905f5e8cfbcd15b9f28c3754d719da28f67766bbae718cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531583, "uuid": "0cf25a3b-ff42-4b59-acb9-fc591c232cb5", "value": "T1B5052AC6F1B3608EE7A3B0B90F0515914A471C766F129AF46F35A96B21F27A1CAD7303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531583, "uuid": "2cb83125-76ed-4c5b-803d-9c1b18a54202", "value": "c18eb5133e3f30215246505f555d85be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531583, "uuid": "cef07d0d-4022-4f03-9d8e-164fb3ef577f", "value": "12288:FYk30OedwzonhERNQeViCukoB4sv3VizWb937TbtexRxusJrCi0KJQ:KL3OoiRNQeK53VigP5sZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635531583, "uuid": "153c1985-4e32-4f19-83d4-8e5a0c064a30", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635531583, "uuid": "66ddb27e-b3f5-40ec-bcd6-3fe6e58e0e1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635531583, "uuid": "35edcf22-bf8c-4d11-8b27-bac232a6cf23", "value": "Genshin Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fc3c07-38e7-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635532734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532734, "uuid": "8aba6676-7744-4599-ae3e-dc6e768b3309", "comment": "Malware payload (ArkeiStealer)", "value": "bd43a9755290d3de30565b260a2e343a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532734, "uuid": "ab2fdd8d-db47-4450-87b1-e4703198f705", "comment": "Malware payload (ArkeiStealer)", "value": "fae89c0c8aecff39611306812832967df94621ef7a41c938f031c0d1dcc00ef5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532734, "uuid": "8bfc22c9-d032-4f5d-8d3d-b36e127fd40e", "comment": "Malware payload (ArkeiStealer)", "value": "c7331f8c0d10d1acbe0cbe8ec636e1936ef468da", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635532734, "uuid": "a9f41a31-bd2d-4b81-b2ce-b55a09bc0562", "comment": "Malware payload (ArkeiStealer)", "value": "1931b2726b33f45ef7ff105bf018232b1eece1bf40a85dbd86050c7a498de0b8dc8f8804f30195f22ccc80ff185ee245", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532734, "uuid": "d219dad1-3153-49c4-9f1d-8d30bb388696", "value": "T140749C10B7A1C034F5B212F859BA9369A93F7EB16B7490CF12D526EE4A746E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532734, "uuid": "6d50e0e4-af08-4795-b2ca-7e3e875f3cad", "value": "de06d9e059534704f287050011120a38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532734, "uuid": "cb62b96c-64d8-4cf7-bbb1-4797f467542b", "value": "3072:HIBqBNjyw06UXVvYz3eiu5leC3pC4P59iRnp9zgPMQQpb8c1445jUGkrYLbvzney:oB+Smuiu5EC/5OgPub8EzjUGk8Xbjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635532734, "uuid": "82bf35da-24f1-4ee0-8749-8db359b442f7", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635532734, "uuid": "c749770a-32b2-4c40-ba1a-f9f83edb3929", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635532734, "uuid": "23d58cce-28bf-4779-b4b6-3f939f9e271f", "value": "bd43a9755290d3de30565b260a2e343a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387e0f0b-3887-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635491396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491396, "uuid": "e0340e04-aa7d-4961-9ba4-5ba192cd56a3", "comment": "Malware payload (Mirai)", "value": "8ccfc3df4a2b63c7944837c0e3e6bb6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491396, "uuid": "3dab7752-6da1-48d8-bd70-2c01caf6fb07", "comment": "Malware payload (Mirai)", "value": "fb117b5b9ba03f145f4342b65b6268b4378660bfdc9b38a00668a2d0fcacdf2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491396, "uuid": "2681640b-8503-43dd-b53f-37d04868d96b", "comment": "Malware payload (Mirai)", "value": "646f16d2fb1b0a5867b69bc1dc2b369275c244b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635491396, "uuid": "496dfe78-403d-41b0-9cb2-d38e8809cc63", "comment": "Malware payload (Mirai)", "value": "9d49013b63cfe67bd16ada94cd26dbe750e3d5d07ec71d96da0de2161d9ffeaa37dbe96136a8eed21f2050953a343891", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491396, "uuid": "5bb838e0-4d19-4715-a327-1ecccecc82ac", "value": "T148B3F747E7918B83C9DA27F5BA8F52027312D750A3EF2303DE285FF43A82A9B5D52445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491396, "uuid": "e56e5711-f5a6-4df3-afa0-5a68a47c66c2", "value": "1536:VDncDo5kWexdJ8MsLYxvNloxil8dYJqmifFWkOzw/98LmlUHklc1o4:+mI/J8M2+8dsqmaFWtM/9EB/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635491396, "uuid": "db451d5d-e07a-45a3-88f4-77772ba17bed", "value": 110137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635491396, "uuid": "3b6782cf-08db-46e4-8cc5-bb7288b570f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635491396, "uuid": "414f9c81-c962-435c-9e54-04f8e0e53e15", "value": "8ccfc3df4a2b63c7944837c0e3e6bb6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bb6579-38f8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635540161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540161, "uuid": "520a0d29-9f0f-4e62-85ee-a669bcc443df", "comment": "Malware payload", "value": "95b2667f1a1f47ebb18aeccc1a229443", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540161, "uuid": "d3b8e61c-650e-44e3-893c-aaf358ac2386", "comment": "Malware payload", "value": "fbfbc6e81fb48d1ee2de7dd6ca830b58f5f5f9c41468052c730222db6bdac7ac", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540161, "uuid": "95e2afe8-1344-47a4-ae53-49e9d77b7028", "comment": "Malware payload", "value": "2fdad2a2827625f6ba6ba061b740d32f70f5ea2a", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635540161, "uuid": "acb1ac5a-7d77-4803-b59a-b1e67a57950b", "comment": "Malware payload", "value": "ffc1c3732259b9f2882cacb18f8a507ee4dd8b2c85935707e4bc4eb9fcc2b29f9b8b64c923c06bf8f4f7a87538fe0dc9", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540161, "uuid": "e920e2c6-cad1-48a1-97cd-cb933e51c73b", "value": "T1A7C27C7EF55B0A48DE46D668161ABBA5064DF11D33C440E23BBCDB387A4D8578B22D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540161, "uuid": "7a83f01f-2e3b-4c45-82a2-35a00cec23a8", "value": "768:q3IB+SvswyCkWGP3vKPQ5t6cLsK3D2BdPcET:ASwHWGP3vwkt6U3icET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635540161, "uuid": "b97d739d-e393-433e-8b3d-5e46b6c7aebb", "value": 26572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635540161, "uuid": "43d12b10-ffc0-4248-b7f2-bbb5e4219beb", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635540161, "uuid": "13138cb5-541f-4dd4-b9c5-99f5e6c9a61d", "value": "95b2667f1a1f47ebb18aeccc1a229443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169f1b11-3892-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635496063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496063, "uuid": "c4e27768-b664-49b1-9fe1-088a888799e7", "comment": "Malware payload (RaccoonStealer)", "value": "b657b154ecfcb7a3ef8766c7607ffa3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496063, "uuid": "23eefc66-1e39-4dbc-98ae-d6242acf620f", "comment": "Malware payload (RaccoonStealer)", "value": "fc45091d99dbacc2d6d92c6f358fd4886326e092789de5ede12cde6ac8234915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496063, "uuid": "bccc4891-3c20-40b5-8b89-4c3e28246217", "comment": "Malware payload (RaccoonStealer)", "value": "9ef49df00099cd302f96eb315501c8547981205c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635496063, "uuid": "7a871683-4039-4c1f-a5b9-47f4043dcc50", "comment": "Malware payload (RaccoonStealer)", "value": "44aced417380e6c219031502175afbbe1f3c7f27f7ab3bd4b69e76935265cfe35d1958ac2588d11b12a53b02fef73da4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496063, "uuid": "9a2c10b0-a586-4d6f-8848-12a4f3b2f85e", "value": "T148D4E010B6A1C035F5F252F849B5A2A9A93F7EB1673491CF12D916EE0A74AE0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496063, "uuid": "c05a8a3f-4ac6-436f-9a62-12e700b44147", "value": "8554f137e95e1371295faad9355adee2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496063, "uuid": "b88ff1c1-86c1-46cd-ac8f-8b410c7f6e86", "value": "12288:ADDoAtDvVPTjiY3i0S8h9/ZdzB7lz11JC7ezKV9Id18Rdp:6DhbPTjPi0S6/fFRxrT6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635496063, "uuid": "76d88a0b-fccf-4568-894f-7a9a8c4d4c3a", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635496063, "uuid": "655c639f-1b41-46ed-b405-dcaad555546c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635496063, "uuid": "98798441-15a5-4065-a9f7-d07cb0912ee3", "value": "b657b154ecfcb7a3ef8766c7607ffa3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87b2c98-388e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635494697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494697, "uuid": "107096dd-f97e-4027-b92e-7a9ad50edfa6", "comment": "Malware payload (Formbook)", "value": "4a4935f0b21078ed884aba51e0180900", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494697, "uuid": "806d614d-d472-45be-9030-fe5c3684ba09", "comment": "Malware payload (Formbook)", "value": "fc9dd028870ac7c508f0b40d747c8a5ab65a9af1da88a8f931488bee2119b505", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494697, "uuid": "8b4512e0-31a4-484d-bd2f-c0537a154aab", "comment": "Malware payload (Formbook)", "value": "848e0796cea2c931bc39d92e0c763175a87b4a87", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635494697, "uuid": "d184b109-4e30-4662-9a5f-a02352cbb7d6", "comment": "Malware payload (Formbook)", "value": "b54f0885fe0e98ad9b57a8f26f866dc0bc50c9c7faebc7364ed5ae8d4f3a2ef862bf23d2bacbf08cbc41415ab562bd43", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494697, "uuid": "f6889590-b986-4b17-a6ea-903970e53f2c", "value": "T1D384E09BF7037B6DE823463530ADE15664EEDD94922B40143AC23E1F5C75F2E247EA22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494697, "uuid": "44af84cc-0ad1-4c21-8c7a-c20dbb02e3e2", "value": "12288:2fzIya/rjBE0/LRexxieM7naBR0/YGpQIH:iMJrdl9mt6KR0/bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635494697, "uuid": "44e5ba6b-ef1f-4a43-a277-c50eb39bcc8e", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635494697, "uuid": "0af917f6-b771-4853-8ee3-8ac58f703fc8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635494697, "uuid": "8efe30a8-6593-4bf2-8986-915986712789", "value": "0014.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd83213-38ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635508480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508480, "uuid": "e14d3352-f7f3-467b-8214-c59bce31c8ce", "comment": "Malware payload (Formbook)", "value": "40f14c49b952aa5ff20f9679f1bd13e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508480, "uuid": "1f0135de-870c-4d27-89a1-4309b8ad87ac", "comment": "Malware payload (Formbook)", "value": "fcb7e25d33700d8f04ab05d2fc0cba77dc5ccf6a32b93abc3511dcfb608dbc9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508480, "uuid": "52b444e6-f46b-4b61-8c03-9a8313e41a64", "comment": "Malware payload (Formbook)", "value": "78529e67ac1d3cde77de6fe7fb5d99471f02e388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635508480, "uuid": "75763a5d-2aa7-4ca1-a54c-98f638e4759d", "comment": "Malware payload (Formbook)", "value": "e4c9b6b50545c74e31066dfd35fb516bd7b2c65dce5010aed90207fd451863ebe515e5965291f317dfa006582ae1c420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508480, "uuid": "82ba67ab-45c0-4c1f-9a61-a38e6da109e3", "value": "T145C4366352FD66FBE168077844530A2A0FA17F327A73EA0D5EB638F52731F814922D52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508480, "uuid": "ac1ecb9d-04f3-4fbb-bc41-e06d3984a558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508480, "uuid": "cc5551ee-4501-4e10-8723-06e4e3f4e5b1", "value": "12288:7lfZxT0B1aKE2DQBdrJ/X58qja+ijH5nFiD2:7lfZxTkmdt/X5pcnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635508480, "uuid": "eb776341-7a8e-4505-82b8-558871e7a447", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635508480, "uuid": "b9286713-a9f8-4af8-b868-f522f8386884", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635508480, "uuid": "4f5335fd-34de-48a6-97dd-06c5b271c3a2", "value": "TT copy for our Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2411c174-38e1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635530016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530016, "uuid": "23feb159-13d1-4a28-8f04-1706331c389c", "comment": "Malware payload (Formbook)", "value": "64ef3b710cbdba9314f8db054856b7aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530016, "uuid": "7aed1da5-d542-4bb1-8b57-6dc9534c5c43", "comment": "Malware payload (Formbook)", "value": "fcefea88bd56297ecb4400f18ab565100bf36d3bb813e440eb9e29caafd32ebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530016, "uuid": "34ac135f-8e15-4e0c-a7aa-e36afcdf9474", "comment": "Malware payload (Formbook)", "value": "17bbe990e0627c10613051a800ba81b230c42610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635530016, "uuid": "d44bc990-2321-4d36-b774-3d9bc982012d", "comment": "Malware payload (Formbook)", "value": "282d15b76a50ef5e572989bcec42f47e3deeea1aa854536cf602b3b0a44e73ff73f6493cef538dc87ebe5808518ee610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530016, "uuid": "00abd2ee-f56b-46b2-9d03-50416fee3753", "value": "T1C9C4C080716CC2D7E5BD0AB15897A13412F4789EA2D5E24F3EC677DA21B3782050EB7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530016, "uuid": "88bfc623-1910-4835-892e-ff47e87cea86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530016, "uuid": "f855fce2-0a7b-40b1-8400-db400e29cb28", "value": "12288:RlfZx3aBcBUl0WQnyVy510EvhjDgV9JuVPVnr06pCflyAKp:RlfZx3tUBVM10EBQfuVRACYlWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635530016, "uuid": "adf2d86a-027f-4538-b68e-6d1aebcc94d5", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635530016, "uuid": "25023d78-1883-4271-8361-455bddfbd4d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635530016, "uuid": "3a433ca7-39f6-49b7-aea2-a014fa749030", "value": "Yeni sipari\u015f _WJO-001, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ebc4c5-3883-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635489992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489992, "uuid": "5445f8da-d5a0-48cf-aefc-9eef1a45db2c", "comment": "Malware payload (AsyncRAT)", "value": "ca3406debaf00a3dda67a24153c4b2a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489992, "uuid": "f640f1d3-912d-432f-9f58-8cad4783faf5", "comment": "Malware payload (AsyncRAT)", "value": "fd09789949b53a44f9f8d85655b64174379bdc05096bf649cc20bd0758cd0a06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489992, "uuid": "fbc8f972-a362-4b66-b980-cab80fc8d21d", "comment": "Malware payload (AsyncRAT)", "value": "8c919c8b61ab45cdc957499877e309f81679f4cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635489992, "uuid": "e6a1599b-59d4-4f46-ac81-f84f6e8b28ed", "comment": "Malware payload (AsyncRAT)", "value": "2a39dbba79db8303c999822ad498f14909e143c47679c405f7e9e3008f6ece14a4c32fe6ee190c7e14845e5890bd6dd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489992, "uuid": "442f8e0d-8d6e-4373-8ad0-109153b02f11", "value": "T12E742313D3D444B7D2639A30443B3BD5EABDA608203676DF4BF06EE43691BC6A61E043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489992, "uuid": "8a3704b8-e8bc-471d-aa3c-261ace855407", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489992, "uuid": "87fc40bb-6d04-4161-9bbf-01ceb17416db", "value": "6144:wBlL/cT4K2M04dRwAdGcdqPgvbIrD/eKGSnkjeKPe2tDM3VOZOaSKC3KkWK:CeT69swHcpvbMGLfzx59OowKkWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635489992, "uuid": "b2321d60-13f0-4aea-949d-eadad22713e6", "value": 350097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635489992, "uuid": "cf2c3411-b816-4569-bdcd-b6f04c5e1904", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635489992, "uuid": "c35b5c86-393b-4b84-969f-36eddd71eb90", "value": "ca3406debaf00a3dda67a24153c4b2a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48707f5c-389e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635501301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501301, "uuid": "25c3dd4c-50af-4e33-a49c-da5a578b78c6", "comment": "Malware payload (AgentTesla)", "value": "fbf2b5b40c0babae49c460d11a007908", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501301, "uuid": "f78602f5-0a93-4680-8083-d393497070e7", "comment": "Malware payload (AgentTesla)", "value": "fd253a4e041590bb20b05bc6152ec1f931e1252a16d50b7ddb84eee70fc1501d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501301, "uuid": "39ba8399-c0f0-4d00-b770-04cc704ed179", "comment": "Malware payload (AgentTesla)", "value": "ff14675f9baf9c1141041fd87a57b6959b3bae2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635501301, "uuid": "9913e1e0-f50e-43d7-b4fe-d6316623d5b4", "comment": "Malware payload (AgentTesla)", "value": "d2cb0de20426b890d6f473e379b8f2c1bab2c0192458f2f70cef04a62c1c03bb0be27404c5623a036a4ea2a36606c8d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501301, "uuid": "61eb112a-34d9-418c-b289-bf571572159c", "value": "T160C4DF04F2509631FA784A3614D3B254DE2DAD9114168E996BBD339F3F732D08B0EADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501301, "uuid": "991f877a-ecd4-41c6-b8e5-42043fff28cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501301, "uuid": "2dc294e7-894d-418b-9c1c-fbe51e48e786", "value": "12288:r7Q6GVWyUR7r71fSJH6/OXH5nrE5Z1qvy+QFLs:ZZ7r71fSJH6ipLKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635501301, "uuid": "68c52ec9-cbfa-4f77-b6b3-1941e56ebcbe", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635501301, "uuid": "cd66b2f8-582a-4147-b419-7f6f9ef0fbf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635501301, "uuid": "bef7b9e0-cd0b-477e-9c4e-38075dc55c94", "value": "Factura comercial 179515.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6137b39-3912-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635551280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635551280, "uuid": "2ac45d92-a922-4482-b46f-c3a8bd91811b", "comment": "Malware payload", "value": "9579afc6b99c2a5e4e2873d1521a20f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635551280, "uuid": "844cd2ff-2a34-4068-8dd2-54c9cf21a3a5", "comment": "Malware payload", "value": "fd6c587e28bf5a9f9deb6b93e77421a7ada9bf27b9250e1f186fd794470722ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635551280, "uuid": "11a7902a-36f8-465e-872b-c206d499a276", "comment": "Malware payload", "value": "89ee7a37995c20657dc9bc5026dcf4d3f4fe4142", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635551280, "uuid": "a6697c4c-df85-4895-9287-57200a4303b3", "comment": "Malware payload", "value": "16abee1ff8fac4556671ee47c54809b4ef9aaf8f08411903e25fc7db55aa391a560b8229775a0fa344b6e84ccb30642e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635551280, "uuid": "0bcb4d3a-9e04-4df1-90c0-cd59d9dff228", "value": "T19424ADF132D89571D0A33F3048658AE0993B7C22E9649177327427A91F72BCC5AE937E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635551280, "uuid": "ba5335b3-2d89-4fb4-9bfb-c9f9d2fef1c7", "value": "2b117a88efd5ad3db577a4f98b26ff8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635551280, "uuid": "bb5f9d18-12ce-407a-ad0c-3b0af53ed556", "value": "6144:nt2c2PtgEN5+Z7qzT6iDR/0TKFANq+Vuzbgwu6L7ITsq:t4PtgEN5eWzTeTKiNq+Vunnn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635551280, "uuid": "6c371848-e493-4dfc-8a18-645fc493e4fa", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635551280, "uuid": "f1fe65c4-0d49-4883-8c7b-d7728589a487", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635551280, "uuid": "437a7132-9dca-4455-bb10-93e007058d84", "value": "9579afc6b99c2a5e4e2873d1521a20f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8eb532-3878-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635484960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484960, "uuid": "dd3ec961-01b4-46c9-aa67-a1392cf71633", "comment": "Malware payload (RaccoonStealer)", "value": "516b6a98501f2db79e0e53656ce2d7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484960, "uuid": "cb76352d-2a5a-4cab-a1e4-0ab5c3856948", "comment": "Malware payload (RaccoonStealer)", "value": "fdafc1997596b14d4597e5a611d419e73344f202bb49f51501aa03f7c5039572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484960, "uuid": "79d1813a-53b6-49aa-b309-1c0ac0c111e6", "comment": "Malware payload (RaccoonStealer)", "value": "300283ebcf6ffae2c8422761c6f4f16d17295afa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635484960, "uuid": "23a14b99-b5d1-4c2c-a442-e54ce02378ed", "comment": "Malware payload (RaccoonStealer)", "value": "2725424dd6e59cfee0f96efd11976c82089dca22d7414a6c79b29af6f72faf64865d6c4e86d65c26af72672cf707b002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484960, "uuid": "07d48d4a-abc6-4af7-85db-e9d703933717", "value": "T176D4D010A6A1C032F1B266F849769369B53F7EB1AB3490DF22D516EE4634AE1FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484960, "uuid": "ea263c14-7458-4bc0-8e03-816480c84e49", "value": "389a11aacbf687c9e251b78d996c02d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484960, "uuid": "3e4429f3-9d83-423d-a695-d59cf44d2840", "value": "12288:F20qhdL/F/s+q9k0l0N7HhkVco94FeTbneQRN:8ldZE8N7KcRgeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635484960, "uuid": "9995d292-26c3-4866-8368-587f92a0c6fa", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635484960, "uuid": "1674b5be-39a0-4f34-b931-851ee658f8eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635484960, "uuid": "122b5d68-15ba-41fb-83ee-361c5cdb92bb", "value": "516b6a98501f2db79e0e53656ce2d7b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac05a709-387f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635488153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488153, "uuid": "17bcccdf-8499-41cb-bf35-475f96e3b4bf", "comment": "Malware payload (AsyncRAT)", "value": "76b0099062e361c41bba0e917d151b5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488153, "uuid": "be3c2ad6-4c78-4905-be6e-3dfa4b981a4f", "comment": "Malware payload (AsyncRAT)", "value": "fe16fc25e78f89e1041ef0effd697878c483a4a0507b3d5fcb4a830328e5b726", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488153, "uuid": "f1ea7973-2836-419f-a8bb-044632178626", "comment": "Malware payload (AsyncRAT)", "value": "4feb84e71cc1de96140fcbf83404aba729283366", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635488153, "uuid": "5b4567db-2d2b-42a4-b7e5-740158af5c41", "comment": "Malware payload (AsyncRAT)", "value": "2a5ef6ded5f83b2424f88dc12eeee844621c796d1f0d32427fc52e7bf5afd50417d40a56125d2e1cc42da74fc779e43c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488153, "uuid": "e8614cd6-ea5b-4518-95e7-0a363470d70c", "value": "T1E75423DA88BB09F1B5730DDA73CD2A32387D67295924997F5E71274E2F1E40DC101D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488153, "uuid": "9c3576f1-31a3-4da9-b31f-ad377a210a77", "value": "6144:swWYX+a2ebDEHjHYlm8TPx+hjz7Tb6Dl6JFSZ:e+fbDijimUx+5Gkjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635488153, "uuid": "f0f3ce3b-e9f5-4a80-9de3-e5aa3687678c", "value": 281714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635488153, "uuid": "f0fa799d-0503-45b8-aa0e-b66ea2b16b07", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635488153, "uuid": "2d0f091e-2a80-4f3b-b6f1-6aeba021b484", "value": "PO_Contract_ANR07152112_20210715181907__110.r17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1c513a-3853-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635469044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469044, "uuid": "a93edd73-1294-4b92-a3bf-a55fe526e86d", "comment": "Malware payload (RaccoonStealer)", "value": "d26fb8270e414d94dcfce307894984b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469044, "uuid": "165da07c-0763-48a1-a45e-28bbc4d8c8b9", "comment": "Malware payload (RaccoonStealer)", "value": "ff2ac01bceeacfb50486d9ec87bcfce8523b341530a4a7b9a7bbb804c882ad41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469044, "uuid": "97254aa3-be1b-4d6e-8eea-f2b900c43bab", "comment": "Malware payload (RaccoonStealer)", "value": "c4bc153edb71b41239c141e84fb51fde3b7d0238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635469044, "uuid": "704353ac-8ace-4065-802a-ff81100b0187", "comment": "Malware payload (RaccoonStealer)", "value": "cb147467a6fbc501eef69b1336b420c14c2830ea17547fa8e31a48f32975e9a6bb8be9e960aa426213fc0e97158b3a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469044, "uuid": "6df47474-1cba-4060-a32e-1675aa3a9c27", "value": "T19A04AEF077EC8472C063753188618BA14E2EBE61EE7499873374221E1E74ECC96E5B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469044, "uuid": "2d68593d-375a-4c8c-a149-2567227b3387", "value": "18875662b19ade4ddd6bba43f9abb4a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469044, "uuid": "80cba401-9fc2-4a58-b70d-ae64560d3e89", "value": "3072:OmjY8W/DvRQE4n4NQIVXWH2NWrxpzbgqrukVggjcGkNIVqI:zjY/DvRD44Jg8uzbgwuA7ITsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635469044, "uuid": "885ee1aa-05f8-4108-a728-e88f30165fe2", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635469044, "uuid": "aaabda68-8668-4fae-9a24-18319ad9b602", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635469044, "uuid": "ac078d52-b4d1-4302-b8fe-fd0428592822", "value": "d26fb8270e414d94dcfce307894984b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b32bd3a-38ce-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635521841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521841, "uuid": "0a6e0ea9-0d6e-42f5-aae5-f95afa24934e", "comment": "Malware payload (NanoCore)", "value": "0b4726d9561f5205802edfac4b88cc3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521841, "uuid": "f1dfbabe-5daf-40e3-9e93-942e0e235a77", "comment": "Malware payload (NanoCore)", "value": "ff66be4a8df7bd09427a53d2983e693489fbe494edd0244053b29b9f048df136", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521841, "uuid": "6f509939-e9ca-4495-9bb6-cf0ee6e37cc3", "comment": "Malware payload (NanoCore)", "value": "5075992b4f9ae9600a0420f49346324849491784", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635521841, "uuid": "ce366b07-f0d8-4e89-a357-50eccdf01b3d", "comment": "Malware payload (NanoCore)", "value": "020c4fc7002d16b462693fabf94d6a79bdd8bd45ccd5b161eeacb8422bd068e61468725de3bad53c481f8adfb3104472", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521841, "uuid": "bb71af86-187d-4658-ab83-e7e0c4b1751d", "value": "T19B14C02A77A94A2FE2DE8679711212139378C2E39CD3F3EE18D415B68F667E406070D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521841, "uuid": "95d6808b-135d-40b4-b3b3-8cb3770645d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521841, "uuid": "5c24a89a-166c-4ee1-a6b0-c18a074dda8a", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIWz6d6+Il1c3rxbivlpfC:gLV6Bta6dtJmakIM5/XT6rxmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635521841, "uuid": "e0b3e34c-8ac0-492f-8fc0-8d455252d745", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635521841, "uuid": "048c0edd-e7ee-457f-9a82-b5463b41d900", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635521841, "uuid": "e856abc1-59a0-494c-b7bd-16feb2add8f6", "value": "0b4726d9561f5205802edfac4b88cc3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }