{ "Event": { "published": true, "date": "2021-10-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-04", "timestamp": 1633392181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ca552943-ac28-4b78-ab65-e0ccea2f6606", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe08f9f9-24ea-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633335224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335224, "uuid": "43398464-f1f7-4db9-a275-562fbf8c8f9b", "comment": "Malware payload (Loki)", "value": "b54d6eafbd35397d8cc1b83204784090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335224, "uuid": "cc88ee68-f4a9-468d-a301-e4d6b0683b53", "comment": "Malware payload (Loki)", "value": "00b3967bff88be072e1306a9a556f77db0e6b4a51145f8f3d7dc6c49bfc3a55c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335224, "uuid": "97958b63-c0e0-4335-ae50-a0c259b50a7e", "comment": "Malware payload (Loki)", "value": "7875e98a784ebc8ca83b04040f212b808a22b755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335224, "uuid": "b68c5789-356d-48b3-b00c-4a25478c9d59", "comment": "Malware payload (Loki)", "value": "e5e6faf5e394422c88654a3409867e6e9ef01477fab4f42823b53f81f443df2e77965be991691faa341ca6c395e9abb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335224, "uuid": "482ae9c3-4f0a-478d-ac0c-2ca32af19e02", "value": "T114B38D417784AB45C1681AB181F367B403FBE58B6372D74A3A8886B71F517F4898CBC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335224, "uuid": "19324f40-bfa9-4a3c-991b-b1bc0535d8c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335224, "uuid": "5f332d8d-31f0-47bb-bf90-4724307e0cb4", "value": "1536:LpoJVeTg4jVaPYEmFIcPUnkv8S0Cy74CT3TrYz6vDpMQ43+41xPNfad8:FtZaWIwGNS0h0CTXYmvFMQ4b1LfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335224, "uuid": "779a5824-4ee4-46d4-a8f6-dc5bbc51abc7", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335224, "uuid": "2984d399-5dc0-46f3-a34d-bc7ffb78693b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335224, "uuid": "cda8049b-929c-42d6-8a8a-e5911e47d85e", "value": "TNT Original Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b74e34-24f0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633337594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337594, "uuid": "c100d97b-eb6d-41ee-bf5c-b4e37991e722", "comment": "Malware payload (AgentTesla)", "value": "401084263575dd4d30bf8f6c639dae15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337594, "uuid": "6b312e1a-2a2c-4e20-9cfa-5779afd9efbd", "comment": "Malware payload (AgentTesla)", "value": "015fffdc77770622a761048d075959b444826823f588e794636748683e8e914c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337594, "uuid": "b0e481db-b18c-408d-abe5-179146bc8424", "comment": "Malware payload (AgentTesla)", "value": "fa028c6cb735ee7d0df5028ef5669701997a10d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337594, "uuid": "b59aefce-92a8-448d-b2b2-dc19586b6fd8", "comment": "Malware payload (AgentTesla)", "value": "e2da12bf8a937de393d5b5cb37300fa539805064bf904be66beda1d719e25f12495392ea3f9c2599cbd207388124f9c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337594, "uuid": "9b189138-8815-478a-9382-23ad51283f87", "value": "T1A025AF49BB69FF9AF2790F76C0175A1883F6C4231372FB9B2AE01DC118127568E1F916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337594, "uuid": "3fef1a9b-1ddf-4e25-b41d-2262d3e62b09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337594, "uuid": "248008e0-27cf-4c09-a85d-fbf896e08554", "value": "12288:5IjnEyKAL2kxm27wiXN/TLuIuL8z6hjLy57Mx1ixxJuPp9NgC4/O6Gm6u:YNJ2W7wiXN76IuLOUnyWxS7xC4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633337594, "uuid": "a223de01-4013-4252-abd3-2bbd1cc6b022", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633337594, "uuid": "108e50be-0f95-4a5f-9e2a-188819c062d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337594, "uuid": "33cea7c0-5ae4-4558-a634-9a1bc158b3ce", "value": "\u0425\u0438\u0442\u043d\u0438 \u043f\u0440\u0435\u0433\u043b\u0435\u0434 \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u043c \u0434\u0435\u0442\u0430\u0459\u0438\u043c\u0430 04_10_2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9877ca74-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633347938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347938, "uuid": "bddab3a5-da99-42d3-85bb-31a9fe8a2049", "comment": "Malware payload (Loki)", "value": "5c60acc3f2ca0b4cabc556681cad76f6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347938, "uuid": "c2afb6fc-94dd-4ec9-884a-94ab7b161543", "comment": "Malware payload (Loki)", "value": "01657f7a46273dbf3c64b317d645e7eab6c9550551c5c62dab79e4f6192f47b8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347938, "uuid": "e715748c-b401-4ea7-98bd-84e1b0e47a8e", "comment": "Malware payload (Loki)", "value": "e9f05c5b4f075e41d9d24015e845a4c749c417de", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347938, "uuid": "20185288-5835-493c-928d-2600af8676b8", "comment": "Malware payload (Loki)", "value": "64e7c2d28958027e1b0f27a39c34ac978a97be0bad054f43ca81fc01b8e55ff631a8f0d03946a9e2fd3d9564c4f50a85", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347938, "uuid": "8aa1226d-8769-4e72-86ee-ed23e01cf0d4", "value": "T12F64236FF8B1E714FBE7DDB416B7962C3264DFE9860451431706B12CE0722C16AA02DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347938, "uuid": "aeabe555-96a0-4922-912c-7ffa27831771", "value": "6144:GkyEQ176nw4R6ImjevUmnVxZiHYlgw78m+J0to1UOb1TMPhTgYo7:GuMY66vUmnjZfX4mKebOh4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347938, "uuid": "538f8f86-1a00-4ed3-95dc-6237529d6351", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347938, "uuid": "df8b52f7-0bc0-460f-bc69-cf94ab391f1f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347938, "uuid": "f789615c-1135-434c-b8a9-dac785ec0339", "value": "ITEM LIST PROJECT-PTU2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf8ad1a-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633343114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343114, "uuid": "d5401f86-5927-4cd7-a990-95ffab6d8ad3", "comment": "Malware payload (RaccoonStealer)", "value": "786f28f2762a3e4b1698b21c66c1f0de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343114, "uuid": "7c897219-91b8-4b18-baa6-fea0e0bf21f4", "comment": "Malware payload (RaccoonStealer)", "value": "01f0dfb38fd2a9bd3b517a656e3b44552d383ab30bec50fce74a23dcac68610f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343114, "uuid": "867ef2cc-81fd-40b8-af45-622bc968e6a6", "comment": "Malware payload (RaccoonStealer)", "value": "96251033b51df35bc9ae2c8777856a91a704dbe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343114, "uuid": "7d10f683-008d-4816-9dcb-2e65d89fc83b", "comment": "Malware payload (RaccoonStealer)", "value": "8b0b6022f665107616206a428c755ec776a99ebb2a240bb882d803e9d57a14f11508eaf96598bcfa996a9b3005bb1d07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343114, "uuid": "533304b7-d6f3-455b-a5a2-1bebd8172479", "value": "T15844AE093181C7F2E67601316B66D7F44A2DFC6C4EEA524F2799272E2F3D3E1B621246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343114, "uuid": "0cc5411d-363e-48b6-8b14-471044b000be", "value": "ea6e9add4feec4142f4eaf80b256f47a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343114, "uuid": "e3172c42-85f6-434f-a7a7-e2af4ee3f02f", "value": "6144:eCVe1QLjUJZZe4Akmk05mkUROhxxpeTr/ekI:De1QfUJZZe4ABrg0zxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343114, "uuid": "4deacc06-48a3-42b4-be01-b612ef0030ec", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343114, "uuid": "1fcb2bff-ebae-47c3-b7c2-f5ba48d4d88f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343114, "uuid": "8feab0e7-04c9-4d73-b01c-c7a2ee1eda6e", "value": "786f28f2762a3e4b1698b21c66c1f0de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a124b114-2542-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633372864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372864, "uuid": "f0bf2e19-6a9c-487b-8e6d-4a7a4d6eec5b", "comment": "Malware payload (RaccoonStealer)", "value": "5a3cb616a41a0467d43cbcea95664a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372864, "uuid": "adc31c9e-a0b9-4bd0-91a3-ac791dc5f4e1", "comment": "Malware payload (RaccoonStealer)", "value": "02463c270d6d5526e385d26993400525c815f89359ad4aa7d9c8c43586a60beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372864, "uuid": "fa42a975-775a-4514-a5de-07afe2c04669", "comment": "Malware payload (RaccoonStealer)", "value": "30a390b2395dba5f0cbe0d114d14097fe752bc35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372864, "uuid": "3f414339-4ad2-4a41-b9c4-b98921c356a9", "comment": "Malware payload (RaccoonStealer)", "value": "e5d038d6adad969b14be992f1d7791545e46bb4ae03f2f4143f63e2056e6fe2e559c5561076b4f1711d8b76b7163829b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372864, "uuid": "e45b972c-9cb6-497f-8f42-da9ccf8b20cd", "value": "T161349F10B7E0C035F0B712BA497A9379692DBDF16B2490CB63D42BEB96346E0AD30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372864, "uuid": "4e9f2de6-7a78-4c10-8a8a-8dc06640915a", "value": "1f41e0ca4ea9e1d12338209135b5bab4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372864, "uuid": "99cfe75e-6226-48c9-8952-8217a5dda678", "value": "3072:GR+pNEBNjzXa4xtPIQo10a4O7yPVMatdyoAAbtiSbVCV9ljBH8WP:GRymjzXTfIQoM9dy+hkV9l1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633372864, "uuid": "732365d1-8038-4806-9aee-9776b9f7f9c3", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633372864, "uuid": "908053e9-2a64-401d-bfb7-85c315a82041", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372864, "uuid": "14f11648-7b71-49ec-8758-34243fc51d65", "value": "5a3cb616a41a0467d43cbcea95664a3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a96d531-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633352854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352854, "uuid": "4f09df5d-3b82-4796-86ec-e1ff61ca64ec", "comment": "Malware payload (AveMariaRAT)", "value": "afb045f4ff977d5a7331284b43fef51e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352854, "uuid": "44706ce8-9860-4f3f-aa67-6ff9cf6603aa", "comment": "Malware payload (AveMariaRAT)", "value": "044a45841400c8e9b5bfc7a68b6fa99da58d06fa4e14d647af908efdd3b92110", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352854, "uuid": "81c3acf1-6053-4abc-9705-35e671d2bc35", "comment": "Malware payload (AveMariaRAT)", "value": "be4a4a67da2cc497b5a6dd705ee27458d5a40783", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352854, "uuid": "65c054dc-f8d8-41a8-af00-aa20bc25d60c", "comment": "Malware payload (AveMariaRAT)", "value": "64480a9b4a630d56e9bb8ef02cad500e145358157f720c4b5377e5a5c881e43c762ebb475ec334773d5c031dcf3bfd5a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352854, "uuid": "80e7c2b8-0d80-4a9e-88e1-0a5ed9cfb956", "value": "T13A753A60A3A15111E597B77B77B08BA0C8AE3C405C6DA78F4E460AD6CB3D2F479086F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352854, "uuid": "8c65f1b0-f542-4057-9668-c09f14680496", "value": "9d3536f958f133fe568939841471fa60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352854, "uuid": "46eb235c-ed09-498e-9f7d-e84ad9bdd59b", "value": "12288:hjTG/NEiKx8FAuRg7Q7X/CRLL6/mkIJD4pa7+oEpfq:hiAuRg7SFWAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352854, "uuid": "204c740c-8a43-46e5-b50d-c6e40b31abce", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352854, "uuid": "40c35c93-0683-417f-8e57-44824be188a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352854, "uuid": "d3e746a6-6ec9-4692-b844-028965558d66", "value": "Rally Radiator004-Price REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae79f1ea-24fc-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633342821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342821, "uuid": "b08ab77a-f406-4fdf-b3f2-fe96ea443952", "comment": "Malware payload (NanoCore)", "value": "508c7474ce38c3ecc5b396a3f1310c96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342821, "uuid": "cedc62a2-7f62-40f5-94b6-7dffb834eb85", "comment": "Malware payload (NanoCore)", "value": "046d30b187004b6ab9e0fcd00f617315cbac572ee05c1f8d129ad6f97c0ac47e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342821, "uuid": "36cd2d40-9918-4ba5-9819-1d1a0c2c572f", "comment": "Malware payload (NanoCore)", "value": "a74b93537922af5a22b799ce4712fea0339262b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342821, "uuid": "e6e02785-00dc-41e3-b2cb-481d80ac35b2", "comment": "Malware payload (NanoCore)", "value": "db59e9a9f9af5306bc0f9bfd8d7923cc39e5444f0c74b5454ef45ae8b4cee0e58d60697dc740d4fa49589985d9d7519a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342821, "uuid": "8765804a-ddd8-4dd8-a92e-df152a719d36", "value": "T12A6413A523E2C5E7D2B26BB45E38E73CF737451002186D47CBD80E736D961E9E20A4DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342821, "uuid": "7693dfe9-2798-4c11-9f09-ac9690e26aee", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342821, "uuid": "bac093a4-570a-403e-9310-5043321db532", "value": "6144:F8LxBsL/INBVTE2326W2kR0gYPORxyucEtgJ7LqlfBH9tSYIz:/L/iVTNXvkR0gHxyucEKJEdHIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342821, "uuid": "5680618e-7c79-461e-9c25-0ab7e9a1af3d", "value": 315534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342821, "uuid": "beb62b7d-a09f-4f26-b02c-9c21f9d3dd1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342821, "uuid": "51d1f9dd-c66b-469f-baaa-bbf9e0c327b6", "value": "508c7474ce38c3ecc5b396a3f1310c96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c99f0a-24de-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633329672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329672, "uuid": "c0620c19-1a46-4ac0-bfb3-8b0ba3948b8f", "comment": "Malware payload (AgentTesla)", "value": "f8b4f79a32c46e5b6959196be8e7aeea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329672, "uuid": "c4817b56-754a-46ea-b739-b55654dd5607", "comment": "Malware payload (AgentTesla)", "value": "0541ad0262b771da064ddc3b939902047b6716ad73a175052874a3ff370cc4db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329672, "uuid": "63bf8075-119c-446a-9439-e8175c046d1a", "comment": "Malware payload (AgentTesla)", "value": "4d82774d359a2082c7114471116bd06f2422b2dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329672, "uuid": "d0460cfa-8568-4aa1-9e65-877db6807dfa", "comment": "Malware payload (AgentTesla)", "value": "5eab9ceeae2796ed3808eda8923eb8fe37734f713a6537d852687ce34bfb3ef8c3e5e61a9602a7a756efb383fd201d8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329672, "uuid": "e1786408-e1a2-4d79-8e86-4e2295703e37", "value": "T1CCA41269376B426CCEFAC7F97470E4C10BF2B866146AD3784EC0A0E92D723BC5A54917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329672, "uuid": "fc32480c-5ebf-4b6a-9b49-ee3a17f1584c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329672, "uuid": "f5a6b960-9903-4c81-94ab-8c05130ecfba", "value": "6144:WAa3oTMCoO/lGqRmMZZlUeTQovmYWaq0UFyzInILgdchnIITHJ7lMRicE7E/DxPC:EAMCQA5ZZfTQa3UU5LgqnHx4/BhlAeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633329672, "uuid": "91775c50-6006-40cc-a430-0057367b4e33", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633329672, "uuid": "9dfd4abd-2ecf-4df9-ae70-d22e19a855cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329672, "uuid": "2e9cb33b-355e-4135-a2ae-a51ddd9e697b", "value": "PO_A9164.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3683b0-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633335271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335271, "uuid": "0abaa7fa-4e11-4358-a87c-6c834f6a99b4", "comment": "Malware payload (SnakeKeylogger)", "value": "2ff733dbb9b655a057ed7dfc2ea13daf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335271, "uuid": "d2905ef8-3b6c-4858-bcf5-442e02e1676f", "comment": "Malware payload (SnakeKeylogger)", "value": "071820da24f6b704ce6356e79ded9baad1acaa5e400fb8727c33bae6aa6f7a2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335271, "uuid": "20ab1e7d-9389-4d33-8e29-4a2be23d3a66", "comment": "Malware payload (SnakeKeylogger)", "value": "c1d27a666129297faffab19528a1a2864e8d52c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335271, "uuid": "87a3dce6-1ccf-4cb1-9f0b-1e3a6317b6df", "comment": "Malware payload (SnakeKeylogger)", "value": "2480b016c5d184e12febba3b8764815c77a3aab83d49c4bdd2a35132fb3c1c093b94eca5e572b51f7c3609cde0f1ab26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335271, "uuid": "f68810c6-70d9-4856-be2a-3da370cdf027", "value": "T160C423CB5042A9AAC0AB47F20CB8DF7AB377850D32E44613DB951E1E9683C5C1B6B067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335271, "uuid": "4c28aa3d-ff17-4fe4-a33f-e28fb96ba156", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335271, "uuid": "63934e32-c885-4182-9b81-10531ba747e7", "value": "12288:ys8yx7i2iadN8gZE4DO5ABBCkwJbt4N8AS4EWtEjOBiZaB9BeuON/HcDfRjALs:PhG2iYeWAQaToEsOGiZawuON/HUf56s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335271, "uuid": "b863ca6d-27f9-45b5-9de1-8f93429efaaf", "value": 586548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335271, "uuid": "5820d182-c3fb-4f1d-83c1-91097c41c38e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335271, "uuid": "41bf43d6-f591-47da-9084-db2cf679d0ea", "value": "234567899876543234567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a41fa29-250f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633350921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633350921, "uuid": "1ee6eb54-5a8e-4755-8c99-2e5ddf8fe0a4", "comment": "Malware payload (RedLineStealer)", "value": "a712cc20b6de80a3a0e5e3575fd8eca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633350921, "uuid": "f2be369e-1b15-4c8e-829b-13d7146e893f", "comment": "Malware payload (RedLineStealer)", "value": "07b3cf92babb177664467ac45682fe71f3835b6f8533868885297f1143e2ee4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633350921, "uuid": "ed8ce861-f0ca-46fd-9ba6-bdf34ca16df1", "comment": "Malware payload (RedLineStealer)", "value": "5f4e7c064aeaa93440580ccfd9fab019ad5035eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633350921, "uuid": "8d7c4ab8-6cc9-4d08-b3a8-1a1c005da687", "comment": "Malware payload (RedLineStealer)", "value": "97d5046175b0b964eafef37ba353a0eaaeee4479c60bbfa4099d1f60f8b647d27bfb46a365237d92ac71ae6e1bf18455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633350921, "uuid": "1c1339a4-581c-4396-9e3d-8bd827e3f6c0", "value": "T127763374BBF688F6EF8017399F8E4B72F07C039A4526519327D9C00D9B38479A21F966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633350921, "uuid": "d92cb314-482b-4eb2-83c4-13a7e0087e8b", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633350921, "uuid": "fb8fa4ce-b682-4c67-bb3d-ad4ad189bf59", "value": "196608:xlLUCgequxql7wD6ypMupfPDIc/7Iv7yO7I4peAjG:xddgetMl7wphpfn7izI8fG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633350921, "uuid": "f7c8f522-f718-45ba-9457-a903a0264b39", "value": 7418908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633350921, "uuid": "18c654d7-3cc3-4a62-9f54-26d2dcbb1e3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633350921, "uuid": "f2796c87-290c-41b1-9ec3-dcf49def5e4b", "value": "a712cc20b6de80a3a0e5e3575fd8eca7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bff77ad-24d9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633327731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327731, "uuid": "196d218e-4517-4416-a4b1-6171a693cd3c", "comment": "Malware payload", "value": "0b9f990ea6e7ca8e2d4aa4daf319af81", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327731, "uuid": "c70b104f-9054-46f4-be44-84203a3beb13", "comment": "Malware payload", "value": "08b69d540899b46f7b3d0f26eaa633b13f93ecbc1716aa9f1dd6949e1da08f43", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327731, "uuid": "f458919f-2a55-4ddb-ac57-168979be9096", "comment": "Malware payload", "value": "0361fdc0b54439416391e1262fc1a4f4e455a69c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327731, "uuid": "fc3aec66-83b1-4b43-a76e-22744d3d51cd", "comment": "Malware payload", "value": "4ea3565485a0129455def25e87b897fbb5c1d9a0fd74895374aa925f8e88768064f26925b76fd939adef7a25f4377c7a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327731, "uuid": "30acd424-5792-4af4-891e-3dfac4627cc8", "value": "T1E6228E2CC902F816D11148BCD55683F1FBAE50D3E612BD2D61A4739E07A02CB57DFAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327731, "uuid": "dd33c90b-9102-4ab6-b5b6-abb44d5706fa", "value": "192:ScIMmtPp8G/btCX0iSOF90famWBXfc3zboN:SPXxrtCEiSOXqo0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327731, "uuid": "87405380-073c-43d3-b809-6d50429067c4", "value": 10344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327731, "uuid": "eed412d6-7ffe-4d64-a65a-957fa20fd966", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327731, "uuid": "3c7e8c47-8493-43f4-bfc1-905d9636bc10", "value": "Request for Quotation-V-38545.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f272a06-2544-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1633373532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373532, "uuid": "b72e0589-09f9-4dff-8b1c-7f7c83890f5d", "comment": "Malware payload (BitRAT)", "value": "199c6ca4dd9c770e65fa6ab057338df8", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373532, "uuid": "e99f8a10-d48f-476b-baa5-a0e8cbf454a9", "comment": "Malware payload (BitRAT)", "value": "09a365ac0a698062b59ea6b45f9d4b5d32ba3f70b9a93df77521c29603e14047", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373532, "uuid": "a0b76c8b-476a-4f26-b2d3-87aee9690b28", "comment": "Malware payload (BitRAT)", "value": "57c046f1a1b2f868c285854ede0b3ab35d06b904", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373532, "uuid": "0a2c62e8-abab-40dc-9044-88762829e521", "comment": "Malware payload (BitRAT)", "value": "59a1df8c7481dc3a6150043a5fd8b4a01514aaa494b5a3863400deaed00bd3aba99d9c3d9ae414dd6e6bc3b0cd494168", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373532, "uuid": "8a835115-7013-44bf-add9-83248c7f1cdb", "value": "T1BD154D3B72E48572D1D12AFEA81D6694AC223D14393590CA95DCFB7C39393F12A3A1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373532, "uuid": "deeca52a-c8b4-4ad0-8b2b-0c62064d9639", "value": "b007c2633498ce5e9ac88f6c5e852d8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373532, "uuid": "02970bce-1815-464e-b722-409957d7b841", "value": "12288:jlDYMzwNJM3m4uZQvFTt0jjqipWUUtWZPO19tT3jmin4uq8S:7KpKvFTmjjTWUrZW19tT3jmin4t8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633373532, "uuid": "68c65fb1-fcaa-421b-b376-00c7e9f6305c", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633373532, "uuid": "5daf6aea-7b74-4032-a8ba-d7790a2e7ae0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373532, "uuid": "44c99bf8-5c29-43e4-9467-76160c77410f", "value": "Yfqbmuahufznqznknlmwfrtnauqppwcobt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fac46c7-2548-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633375250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633375250, "uuid": "82c0d97c-ebed-41a8-a7c2-3e3bdfbad056", "comment": "Malware payload (RaccoonStealer)", "value": "28eefc36104bebb595fb38cae21a7d0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633375250, "uuid": "6ac20e54-04df-4a59-8880-7940c664de8b", "comment": "Malware payload (RaccoonStealer)", "value": "09af49f80d3185ecc400db099f6a56cdae9c3a55a51f573d179c52be5e8b49cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633375250, "uuid": "d730b966-6a2f-4438-bc9c-62218e1ddda3", "comment": "Malware payload (RaccoonStealer)", "value": "2badb31294cb13ebffd3492ac364029f39be378b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633375250, "uuid": "a5a760e0-f95f-467e-a9ab-32a3a3e0f565", "comment": "Malware payload (RaccoonStealer)", "value": "567692d14edc65ca0cefdfec6056b97e34b87b90f37060ee13a87b55758047be8fb7f45b0bc04256cf187dd5698c99e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633375250, "uuid": "575842a0-49d4-46db-93b6-9affa9a1d2b5", "value": "T1D1C4F10531B2D3F2E6764671B722C7E0096EBF6D0C25518FAB48136E6E3C3D29762B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633375250, "uuid": "88a44c30-f207-4da7-9009-824e0ffb2454", "value": "820638e32882fc55584544cedf889893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633375250, "uuid": "a8ed1e7b-345e-425e-a783-77681bf0879a", "value": "12288:1XApZS9liDodNK3zWKzW5P1YtzTrxKHzJYJzxp6L:1YZSHCwNmz3sYtYYl36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633375250, "uuid": "e301368b-5026-4211-9ebd-cc84ac18f91a", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633375250, "uuid": "e602545e-9613-45d2-b2c7-b7694af3d5aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633375250, "uuid": "9167c444-8c71-492b-9118-ad32701e71ea", "value": "28eefc36104bebb595fb38cae21a7d0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea39d8a-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633360941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360941, "uuid": "6d96a5ec-93ff-42a5-a3ff-10f0811e6e99", "comment": "Malware payload (Quakbot)", "value": "1f4a448f535f2a3657dfef39beb4a662", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360941, "uuid": "ae1ee366-813a-4b55-b64a-3a51ab45e22b", "comment": "Malware payload (Quakbot)", "value": "0a8b0b423e864ae0c19cbe56b135d804b91516bb9b633d889c315c757bfd3930", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360941, "uuid": "f25dba1f-d3e5-423c-90ad-f42a87eb823d", "comment": "Malware payload (Quakbot)", "value": "3469b525c73b66fab130abceb11f23eb53723b88", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360941, "uuid": "5269faf7-6384-44ec-9781-dd68dbb049b1", "comment": "Malware payload (Quakbot)", "value": "3f8c9ea2393f133952ba20c980d12ecdf46f604da4a14893e4d81b3ae9c96793e2b0fc5d1fca75fe6357d500a8551082", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360941, "uuid": "9ac5b0c9-abf4-4611-a9cb-b3900b7c78ee", "value": "T1D5D3AD467797C94BE54903398EE3879B3B72FC21DE72470332467B0E4E796A18C16A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360941, "uuid": "cb78a7b6-f595-4009-b717-8659e9906c4e", "value": "3072:Sk3hOdsylKlgxopeiBNhZFGzE+cL2kdAxc6YehWfGdtUHKGDbpmsii/+u6ssC06+:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360941, "uuid": "1600cb70-7ca9-4600-8e36-a60b95c875af", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360941, "uuid": "aa52ed3d-e1ae-4f15-a233-1712f4a1be18", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360941, "uuid": "31adc536-e942-462b-82d9-dd115474becc", "value": "1796250310-10042021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf6d1cd-2512-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633352134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352134, "uuid": "4c7b047d-c709-4fae-bfc3-707c7308faea", "comment": "Malware payload (AgentTesla)", "value": "a56126778923c78f03d4ef0f92d0e3fb", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352134, "uuid": "1853c22b-2a37-4cba-b5a2-d52f5f1fec00", "comment": "Malware payload (AgentTesla)", "value": "0ac5212a5963ab13356a9de11b9bff2ed9f152ccfe310b4c2d1088def6696e3f", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352134, "uuid": "1d45c9d5-9cd0-4c8f-b686-0b5c48ef5d6c", "comment": "Malware payload (AgentTesla)", "value": "f7d2fb9d5d2bbabf1428ebd13e7e51fedbc68187", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352134, "uuid": "6f0b5265-d778-4fae-8073-a4b2fbfa2a07", "comment": "Malware payload (AgentTesla)", "value": "09c7c56a4e19df2d039718627219e1c4f7f6b85c68e9eb3146b24a3c0f5811d25d8a23653f08747e127935964fb95b47", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352134, "uuid": "4f7997b4-4761-461c-a323-201f49420945", "value": "T189942384DF9231DA11CF22699A1F4319338252BCFD5E0D546B8E3520AA3BD75A8CC36F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352134, "uuid": "74ac1ae1-5f3a-4b69-8c6c-dea0cb1a45b1", "value": "12288:0mWbzPER/0Anw8JWsqq6+IE/J5e3uM/Zf3sNiD:wzPc/9qqtI+J52ukf8NiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352134, "uuid": "0329b14c-42e9-4fb4-90cc-c096b806c981", "value": 425859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352134, "uuid": "c1d95512-1979-4cfd-92f9-4f56c02362c0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352134, "uuid": "2319e7bd-7dc8-4f05-af1c-fbffa42bd59b", "value": "TNT Shipments.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8947b1-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633342043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342043, "uuid": "976be632-c67a-44e6-8f62-583264623d47", "comment": "Malware payload (Gafgyt)", "value": "8261d1b6e765370a1ebcd4393b9f0cac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342043, "uuid": "d3f494b0-5c56-4856-b791-2df05283e0b0", "comment": "Malware payload (Gafgyt)", "value": "0b59cd1c5b4c7165907a831358d33fe02ffc3cbec069b9268e669af44dcc4434", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342043, "uuid": "5db3bb4e-7f74-4f51-ac6b-05773a6387e0", "comment": "Malware payload (Gafgyt)", "value": "5d0b7f44aa8f91a7db9f619f226fb201f025b75c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342043, "uuid": "e1294101-58ec-4d3c-a9d7-35dde85775b9", "comment": "Malware payload (Gafgyt)", "value": "23e1682bccaf2d2545e491bf0f8aea71b5aca91a207a8a1b63e735ac0a872bcc45b91493471999cce6dbb12b5f7042a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342043, "uuid": "3eccf4a6-39de-428c-b0d0-1ea2a92bbb19", "value": "T1E8F2E0F69EE1C615D95904BA38AF7C0D1C31EB0DF809115D3B9272A34882F792D6FB29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342043, "uuid": "1b59c8dd-7e84-4fd6-9a63-4dbbe063e8b1", "value": "768:zuXQRH6lLCbVWLC51vC+X2ptEZjY0M2nKYWxernbcuyD7Uiyqj:yXwuLCbVW+PvDX2ptESSWxernouy8Zqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342043, "uuid": "1d28dbe0-b525-4e33-8129-bc7368f23ae4", "value": 34524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342043, "uuid": "51ebdb29-5ae7-4618-9c39-02cf55e14793", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342043, "uuid": "1788f591-84a7-4c2a-8250-e03baa2246f6", "value": "8261d1b6e765370a1ebcd4393b9f0cac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226a3299-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633363202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363202, "uuid": "380c541e-f542-429d-9ad1-c1527cdaec31", "comment": "Malware payload (RedLineStealer)", "value": "574a01b85dcafc9143b558aa2567c229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363202, "uuid": "7b4c172b-b448-4c62-9f99-2a26978dc44d", "comment": "Malware payload (RedLineStealer)", "value": "0c59ab16b4ee11dba423c1c3c873290dc1b754df278d9ce4b7155810b287fa80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363202, "uuid": "b29612b5-2b4c-4bf6-bf29-f5714d4a500c", "comment": "Malware payload (RedLineStealer)", "value": "d9203eb2074d4780d52aab5ac21c06368b3599dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363202, "uuid": "26006cc3-2286-400e-b4c5-4f2d18a92756", "comment": "Malware payload (RedLineStealer)", "value": "a038750f1df70d38d5deda1e35c0d8b6a40704523f6e7e0dffeca3340cbbad5d507b26a4827af3ad29d4e317c3c14551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363202, "uuid": "f60fe345-563c-4328-b1fe-f3d458bf5897", "value": "T16784E00A7290C7F2DAB14631BB26E7E0492DBC6C5D2A564F2789272E6F3D3D1D721312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363202, "uuid": "402de19f-37a9-48aa-a9ac-b5e64ec64ea5", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363202, "uuid": "afce1b4f-eab4-48a9-bc50-e3822a04455a", "value": "6144:45ff33HROYtx1LUiiKptzh9Cg4Brj3TETov8Fr1vfwROhxxpeTr/ekI:yX39x+iio39urjoTovkVzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363202, "uuid": "ad7531b5-01ca-4099-8a9a-10ff05c174d8", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363202, "uuid": "1f529d3f-1820-4077-bdff-3c546a6f8dcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363202, "uuid": "9f014773-d713-43bb-8cd5-ad8452df8476", "value": "574a01b85dcafc9143b558aa2567c229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9e4486-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633348427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348427, "uuid": "28454a68-2915-49eb-8bf4-0e53f090d338", "comment": "Malware payload (Formbook)", "value": "cdd74989ccca9c104e0239199f354397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348427, "uuid": "7f969af9-20a8-4ebb-9c85-418f91d5dd84", "comment": "Malware payload (Formbook)", "value": "0c68bedf273c54fb11df082f5ba6db85fd819cf12f9d40a0a6a683d859315548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348427, "uuid": "90bf68f4-9856-4d0f-b0bb-4af8090e0af8", "comment": "Malware payload (Formbook)", "value": "129d9eae5e82d63cc19c6dfef74cd9d8c903fcf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348427, "uuid": "1aa25d60-2048-45df-83e2-07119ea764e2", "comment": "Malware payload (Formbook)", "value": "1fea69dc2401ea9fd6e5bec4d576750bc113bd1485fd05636eec010b747ddd81db1599bb2be7b6b9beeaf2a1fddcf4f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348427, "uuid": "5d2ef347-e97c-45fe-a44a-5dd6943780c0", "value": "T1FEF49BC49D894613D7944272EC5C620632692C1A3723938BCBE57CB73FFE683C62D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348427, "uuid": "a7dcd6ea-a290-4d74-87a2-556fe0172792", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348427, "uuid": "c2ff0e48-09dd-4c8d-b25c-d3830e8da0b4", "value": "12288:M9mtiK5oGSjc2YADH/7sG1Zhvqyih/sFOSwHfABaqzSqf2Qq5GWS0gOhk:0+FoGFcf7/vchUESDEZQq5GWXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348427, "uuid": "ea121c76-c6e0-43f8-9d27-4034e2349b94", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348427, "uuid": "d06a7f86-708b-41de-93a2-aed1e8a51450", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348427, "uuid": "7aa2b3bb-dd66-4cba-bbeb-e35707cc517f", "value": "ORDEN DE COMPRA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73c149b-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633339454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339454, "uuid": "3bc08cb9-242a-4009-8a15-2e32dd9e8518", "comment": "Malware payload (RemcosRAT)", "value": "ff9e19fe7ce086136ad7053ea76ebb08", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339454, "uuid": "91f2da64-8365-4568-b1cd-f0278e2be84d", "comment": "Malware payload (RemcosRAT)", "value": "0c9976c9ffda1da06a0f8293ed9db01c9fb1d40a91f9896bda3ecfa406f67f4c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339454, "uuid": "485c5bf3-f724-49ab-bd0c-461115b7becf", "comment": "Malware payload (RemcosRAT)", "value": "d384a70f1ebda5985f0679e8be3c11a56705d1b1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339454, "uuid": "72fb1890-5069-4d1a-9c39-7a6ce1368131", "comment": "Malware payload (RemcosRAT)", "value": "98a51b7cabf1aad7fdd42ece84107410b8ea39de44d7ea5b8943a761bdcf6ff1dd3b25dbbc0db88855701d6daa417b0b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339454, "uuid": "525703d1-b89c-4b5b-8ca8-8f5d046a9b2b", "value": "T1440507216160977AF01737B2DC47112457E9297D3D084B72FA881B8B1B2F381AED69BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339454, "uuid": "d523f93b-881c-48de-8446-38ac1f5771fe", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339454, "uuid": "f7da77b4-11cd-42ca-82f5-8bb098f111a9", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyNeYAycjL7YiEFXXXB:Naeq3gF1Sf+WIy5AyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339454, "uuid": "06649ad0-135f-423d-8988-7d0c24702ad5", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339454, "uuid": "730b1ac0-68cf-499d-88e6-c9ed9e027bed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339454, "uuid": "4aae9a34-f758-47c4-a93c-0e6928c41653", "value": "DHL SHIPPING_119040-DOKUMENTY DOSTAWA,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e37418-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633341733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341733, "uuid": "df92fae3-ea03-43db-98e8-5bbaf5941149", "comment": "Malware payload (Mirai)", "value": "9243e9dc24e36b3a2e829dd618b0c3a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341733, "uuid": "260b9716-a9f6-47cd-a8b5-48d5bc92e4f2", "comment": "Malware payload (Mirai)", "value": "0ca5502a830898a628308df05cc8e475083ff57bee5c793b48dc7c7e6973fdc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341733, "uuid": "3508222a-6e74-4720-8351-504694a377ab", "comment": "Malware payload (Mirai)", "value": "bba8edd0f23c541c7582103cab4b365d349af026", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341733, "uuid": "fe1008f9-f2f7-4a86-a3a9-48653615e23f", "comment": "Malware payload (Mirai)", "value": "3c9df9f045ee96d926d3b0aea59257649e18787e9927dde5bbea7d06e38784fa7cf5c6e0caa5480a312e4e0e8fcf4635", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341733, "uuid": "a28cb84d-4eb3-43c6-98b8-a5d9de1d262a", "value": "T104E2D0A4D2E6C6B2E6F6BD740DB8EED44BE099EAFC61C5401208FB4A8926333C5515C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341733, "uuid": "8565db81-45f0-4c4f-bcb8-9dcb7f72d8a7", "value": "768:ygz9OI48qBgrWGIT0GXxhvCVdR5BSHF7q+AYR94uVcqgw0RKWXT:yQ9OIXrTsDxhKVTi0aR94u+qgw0UWXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341733, "uuid": "8e8de5a1-ef61-475b-9abd-d17828ee7014", "value": 33700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341733, "uuid": "2c98965e-dc97-430f-ad36-183a1f771c08", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341733, "uuid": "2fa400ba-315b-4f60-94e1-41f70d67788b", "value": "9243e9dc24e36b3a2e829dd618b0c3a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122985f1-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633338694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338694, "uuid": "43b8d19a-183f-4570-8a3b-9292d6e46c7f", "comment": "Malware payload (AgentTesla)", "value": "6f12bf692ab3150315ba40b35d82b861", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338694, "uuid": "a7630f17-1acb-47b4-beb3-ffa2a6cf50d9", "comment": "Malware payload (AgentTesla)", "value": "0ce9dd105728a0d9dff59c549aabe49d4b9eeaa92f81f84ba82119b00962eb05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338694, "uuid": "62927d90-de95-4ec2-8ff3-b87b70155f48", "comment": "Malware payload (AgentTesla)", "value": "308eaadd69c65b7863f60a3d8f559a232ce3ebde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338694, "uuid": "440e8891-1722-4183-a68e-47b9bc947ca8", "comment": "Malware payload (AgentTesla)", "value": "a0808d89534922f443c26087aee6497b2c217c575a89f1fbce18ab1b40058baac10f2cc14ed703ceb1c07172bf26dc19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338694, "uuid": "b2a85cb1-957a-45de-ac57-72561529083e", "value": "T1C4351202B6C68CB2D5B30A326A3527116DBE78301F259B5E63D4456DEB797C06328FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338694, "uuid": "b47e3bf8-aed6-44aa-a4d2-01f2585cf1e4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338694, "uuid": "c2098777-be32-4369-b263-f4cb55ed2411", "value": "24576:7AOcZCZ7ikqA40/s+P8JscRyAv26tffaCVTTq6ai0bagi7vJIX:dFN40/oscRj2sffdTTq6d4a5mX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338694, "uuid": "c4692c93-9ab8-4a05-a560-512c2c7e9076", "value": 1122179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338694, "uuid": "f7a48efc-c250-4685-b49b-641df6f25cb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338694, "uuid": "5569d66a-e752-46c6-b076-d04fa3c24d46", "value": "HSBC Payment Advice_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea5822f-24db-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1633328434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328434, "uuid": "4ef66d1e-a4e8-437a-b0ba-f5ad5932e0af", "comment": "Malware payload (Tofsee)", "value": "a5c55b3a3840f0403d67b15e8190f669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328434, "uuid": "b7561933-6370-427d-8401-edba9cb7df4b", "comment": "Malware payload (Tofsee)", "value": "0d2a861ede99c483bcd9fc49376950308a0560d466a2b17c2146233765c23d56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328434, "uuid": "9dc45b0d-cc36-4a92-9896-f3d82eeb45b1", "comment": "Malware payload (Tofsee)", "value": "53ec15d5238feb25b14f70e8abc2c4ea232c185e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328434, "uuid": "011009fa-87f4-4817-a02a-aafcf050a547", "comment": "Malware payload (Tofsee)", "value": "03e7fa59c901f51a930f28f586448ae9f1091704427841f09e7e4b71077f2394f260498581c7d4053ff34cf148cd45d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328434, "uuid": "1be00ecb-c8fe-4c7f-bb74-180dc0e3d151", "value": "T19444AD4971C0C7F2D6760170AB96C7F05A2DFCAD4E2A564F2BD8272E6E383D1B617242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328434, "uuid": "37fec16c-c79a-473c-8079-f4cf397ade37", "value": "d33805713bf84c5172011e6ee58dcc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328434, "uuid": "e47dd630-943c-443a-9353-f6cc91fa9108", "value": "6144:SF2tD9LJb2Q9slNdgiBFwROhxxpeTr/ekI:S2PFb2Q9yN3pzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328434, "uuid": "80af8794-5012-48b2-961a-39f6c15b1428", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328434, "uuid": "b0ba62d1-ed55-4ad0-b179-252f543958a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328434, "uuid": "494c9ddd-5b88-4847-9235-7de4e1c44f7c", "value": "0d2a861ede99c483bcd9fc49376950308a0560d466a2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777b5886-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1633343159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343159, "uuid": "2126d778-a5a4-4e65-af34-ab95dc0b1a72", "comment": "Malware payload (Stop)", "value": "550b59b69ebfd6dda6b55725245b46ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Stop", "colour": "#589677", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343159, "uuid": "0dc0e90c-6517-4995-9ed2-54be9c9a4fde", "comment": "Malware payload (Stop)", "value": "0d977e55742460c71884d6040178fc8c7abf8c97136b6293da37cbf9c59b6778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Stop", "colour": "#589677", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343159, "uuid": "9795f4fd-0f18-45d0-8c25-e41fd6459861", "comment": "Malware payload (Stop)", "value": "f6a71793288cc09397b262fba8fc38b29073a44e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Stop", "colour": "#589677", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343159, "uuid": "b4ed7e7b-1214-46da-a1bd-76b7615b745e", "comment": "Malware payload (Stop)", "value": "8cfe7beb952aa0abb7e6b4c7b5e0d01867312fd050e762af5a9529371d54961546a53fdf9d783a4ab5f91adcacbca194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Stop", "colour": "#589677", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343159, "uuid": "650e6089-6f0e-4a60-9f9f-962862c44f70", "value": "T1CF05121831C1E7F2D6721270A722CBF1DB3EF8AA4A59550F7B89376F6E383924E15205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343159, "uuid": "0c9b3a52-db18-40b5-b8f3-259faa368fc3", "value": "d33805713bf84c5172011e6ee58dcc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343159, "uuid": "76221208-bd75-4b3e-a34a-95639bc8e364", "value": "12288:KxrffFxEHP0VOTfvvQfDDkuM5glE15y4EXJUnrAtHbVzxp6L:K19xw0V6n4LLM5glE15HcJoABd36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343159, "uuid": "89de1cf5-1060-4065-93f8-8815969801c8", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343159, "uuid": "cab53730-a242-4284-a59e-ee4cdbf1df38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343159, "uuid": "9314d0f3-ffb8-47a9-b67d-e3643b2f6806", "value": "550b59b69ebfd6dda6b55725245b46ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4365229d-2525-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633360251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360251, "uuid": "e24f5721-b385-4246-8aa5-be696b0fcf01", "comment": "Malware payload (RaccoonStealer)", "value": "ecc973cf6a6cd2c803255c9f120d5aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360251, "uuid": "fbad0486-e4be-496d-be9c-e79e06aecf06", "comment": "Malware payload (RaccoonStealer)", "value": "0f3d1f1eafa140c32e246c12a7ccd5b6205526ad08be581e5f55b9179f19be5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360251, "uuid": "75faf000-ed2c-45ef-bc6c-29edadd9a38f", "comment": "Malware payload (RaccoonStealer)", "value": "f90d672fd09b13364d561acb9e1965d7cdef6a68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360251, "uuid": "2766d4fd-4bc8-4ba8-8ba6-49697119779e", "comment": "Malware payload (RaccoonStealer)", "value": "f42c39dcb488ffd5331e7dd33087f57ffb316a4e86278116401f5c705f3cf04e63a0417a7d37786a6a6a05921d496e9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360251, "uuid": "44349c6b-78af-493f-a27b-577e6e5bb647", "value": "T1B8C4F10931B1D7F3D6750A706B66C7E1796FBC280D26428B7748631E6E393B2932234E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360251, "uuid": "7fb8700a-39e9-4aa3-9996-c2365571505a", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360251, "uuid": "a436e506-9db6-4b56-a2a1-d2eae2a6e693", "value": "12288:tqsDzNra3a8OT9SdU52j/C/rGLjTGrI6jQn/Xo/Gzxp6L:tFDzN+OZSm2uD6WknQC36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360251, "uuid": "59affd3b-917b-46d9-9cde-c1ab7dc50e42", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360251, "uuid": "abfdac25-f0b8-40e6-babe-1a7b32994ce6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360251, "uuid": "7ba49e06-c1b3-4971-80cb-653f6723abec", "value": "ecc973cf6a6cd2c803255c9f120d5aaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992226bc-2517-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354382, "uuid": "f2c3d883-5262-471f-921d-5e6f14358516", "comment": "Malware payload (AgentTesla)", "value": "92b9b02b1051773f484ad686cb9c1918", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354382, "uuid": "a1c6b019-1dde-400e-8df0-595b56a8f85d", "comment": "Malware payload (AgentTesla)", "value": "0f40598b3b7f052fa4752b8d9e4d845282da5215aebcd7cadfa7efc0fe46ac6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354382, "uuid": "20c9115c-8971-439f-9089-b4f391ed918d", "comment": "Malware payload (AgentTesla)", "value": "1cfa7f519fe01db9a6801587e7611ae99dfc4b25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354382, "uuid": "64f64440-9b99-4350-b1e9-4331ed595963", "comment": "Malware payload (AgentTesla)", "value": "a0420671a222d2d7d18a0128f94149c3d13a5b48d847c14e7fba7c54df97d3d72e4fc9945c5c8789502e7c851eca19bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354382, "uuid": "81b77d68-67d9-4c44-b324-5e886202f47e", "value": "T1AF940229A3778308CD7643F03C24F66347B56526219AD3785E89E4EC3F63B7886E0997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354382, "uuid": "e921b1b5-e3f8-4931-bb61-417ab5cb951a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354382, "uuid": "46cab0bc-7a01-4d2d-a665-5e3b17f0923f", "value": "6144:WtYzdQ+3HwOQnuDLQbf+AeLTETHSd20N6p6tq+vrbp19b0ej5Bi0PksOdqatcCYB:5WoAbTEqv16tq+vrbXXPTO0aiCYFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354382, "uuid": "6723541e-4ad8-410b-ae75-d031adf22f4c", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354382, "uuid": "27903c6a-a46d-4370-ba80-7606c40d58dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354382, "uuid": "e5819a80-6321-4b03-975a-f80801e5a7a7", "value": "Invoice 4747848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4804c558-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633354675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354675, "uuid": "6319eacc-e983-410d-b0a4-482d49fa8549", "comment": "Malware payload (RemcosRAT)", "value": "8fc915a01617ca176460bc2f09350091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354675, "uuid": "aa147470-65e7-4c1c-a3a8-56670b863700", "comment": "Malware payload (RemcosRAT)", "value": "0f4d575de493e7c295566dfdb0643fd130e96ca20f44aaf19e72eaf31ed1584b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354675, "uuid": "3b7a5f20-33b4-408b-b6b9-2ab9109052ba", "comment": "Malware payload (RemcosRAT)", "value": "0bd1175973cdb72d7a97655d8662afc9b92d458c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354675, "uuid": "f97c98c7-4270-47e7-882f-bc9654874f40", "comment": "Malware payload (RemcosRAT)", "value": "68f3d9d2750b6ac6126d147e138c349f2bebc8eb2be12a4ab2507406bf3da5c9db8b778ebc0337372b3cd86c89eabd62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354675, "uuid": "c3c63612-b273-4ad6-93b4-a5975c9c118d", "value": "T184053B5560506725F61B377AEC0348582BE6AC3C2E601775F6D00B4B1B6FA86EEE087F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354675, "uuid": "33167e25-69ae-42dd-a4d9-2464b19d5f09", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354675, "uuid": "35204bad-98a9-49e5-a4a9-8f832ffb54ef", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyN+YAycjL7YiEFXXXB:Naeq3gF1Sf+WIyxAyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354675, "uuid": "bf7e5d31-629f-44c2-9088-d0a23ed07961", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354675, "uuid": "f57dfdee-ff91-4205-ac35-d13a88f9d0ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354675, "uuid": "ba2cbcf8-b125-498c-90a7-4729db5f0e2b", "value": "Best\u00e4tigung der Kontodaten,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00277bea-24b0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633309887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309887, "uuid": "d60def22-b2a3-4eb6-9273-ed81636a7f8a", "comment": "Malware payload (Gafgyt)", "value": "0377f62b8d17a154b812a1645343c082", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309887, "uuid": "247d3a29-6cb5-4679-b811-5bd2fb6a3cfd", "comment": "Malware payload (Gafgyt)", "value": "1044f06305cd58d8d134cb81902b524cabbf7f20b564e82df7bd07dea6dcc7b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309887, "uuid": "1698e731-dfb8-4774-8a68-36b9af8f4d16", "comment": "Malware payload (Gafgyt)", "value": "92850e6ba75654456ccb8eabbe8d4d23d33ecfa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309887, "uuid": "7beef6e2-4801-477e-a605-9a4971ec19c2", "comment": "Malware payload (Gafgyt)", "value": "fdb9af2cf5372a166fb915b3489cb94fbd9fc2e7fb8474566dfc9953396e36bdbd9ded884a9064533748bb8be43a4e13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309887, "uuid": "1a38c8bc-4ed2-4fec-95dd-7ea9a1c6e61c", "value": "T1C9C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309887, "uuid": "01d40745-f240-4252-8c0f-e5df0a3bfea5", "value": "3072:ekYPUfsgnsb0J2ag/VfzkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0zkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633309887, "uuid": "fb1f43b2-91c5-45c9-ab51-e441ebd65cc0", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633309887, "uuid": "277f4437-3333-471d-a4e2-48a372213ba2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309887, "uuid": "ae1f2119-9acc-4093-b5a8-6f3d1920218c", "value": "0377f62b8d17a154b812a1645343c082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdc55b1-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354736, "uuid": "07a1205f-e6dc-42dd-97b0-03f17582a96e", "comment": "Malware payload (AgentTesla)", "value": "952ed81c840c14a80f12273bd1ee9fe5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354736, "uuid": "4df3c03c-e336-4686-90bb-1fbe5f85b801", "comment": "Malware payload (AgentTesla)", "value": "10a6df2962057178616d3d8fa1723c4fbf2da0097a6f7396f639895ca42481ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354736, "uuid": "1420c81e-aba4-4e72-ae75-e560eeed1252", "comment": "Malware payload (AgentTesla)", "value": "aca9782ee0b3370c5ce6e67794b382db3aa6d717", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354736, "uuid": "9eef6a66-a170-4f70-8abd-4d7b545e2068", "comment": "Malware payload (AgentTesla)", "value": "4775bcd1697e9efd356ccefcf8ecf9da47067ef5ad4e64ab74a8c6c40bc76f05157de52c3884e181a305fab4fdb6e46e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354736, "uuid": "4fcb4685-510c-46b6-b0f5-ef50cdec9e4d", "value": "T13D97CF9C3A50B58FC447CE36CA945C64E6B0BC67570BD247A04336EC9E7E3AACE115E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354736, "uuid": "4c3dfa3b-7880-416d-ae77-f6f17b9370cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354736, "uuid": "5294c571-4d83-4cba-8a4b-7862f0d2f8a8", "value": "12288:XIRVI/yzQs2TaIpIFc55uuR/pbZn5y+ZKQ68vaWiSQA4fRECzHcvqUYTEhbJWIiI:YoMIpIeRrC+Zh5Li8wjzHc4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354736, "uuid": "8616701d-831c-4f5a-9f4d-4c99101da09c", "value": 39845888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354736, "uuid": "82e0c626-b761-4114-95b8-bf9faa24e4ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354736, "uuid": "4208e64c-2cb8-4d3a-bb9a-9355b519013b", "value": "orden de compra.pdf_____________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3585d76f-24ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633308259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308259, "uuid": "6b95107c-506f-40e2-ade7-37948274ba9b", "comment": "Malware payload (Gafgyt)", "value": "788ee2214045769bab1c395be68a0403", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308259, "uuid": "5c595151-9424-4017-a4da-363a0b774d37", "comment": "Malware payload (Gafgyt)", "value": "115a676ce28e60b7ea751864340c250dea83e6dfd4047b8e87e4151e873742ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308259, "uuid": "f32d970e-72b1-4b6a-8b58-f468eb8463b6", "comment": "Malware payload (Gafgyt)", "value": "d1f2ced2ded686fe3dcae7117fadaa657d7dd131", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308259, "uuid": "084666a6-94a5-440e-a71a-715c3835e673", "comment": "Malware payload (Gafgyt)", "value": "a7de5a317216fd5faa30a52dda0223ef633620f16348eba1fde36df19b0c1348ce3ed2d35c621fc005af11ad2c5f3261", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308259, "uuid": "0c0e2c5c-de7e-4794-a3e4-1b2ed098c2f2", "value": "T1A6B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308259, "uuid": "e195c0a7-e506-4445-89fe-3e02b75280c8", "value": "3072:MSY+46m1qOzssjFPPKNy+AmkZrQAhPDCXFke:06mgOzJjFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308259, "uuid": "ca2178f8-636d-435f-94c8-d91190c69d7c", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308259, "uuid": "f67ccec9-c066-4648-9b89-24d62985e3a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308259, "uuid": "f275b2cd-f948-4ba2-b8a3-1e81d855b350", "value": "788ee2214045769bab1c395be68a0403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa64235-2539-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633368800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368800, "uuid": "c66c58b9-1997-4dd8-9655-3de67ba0242b", "comment": "Malware payload", "value": "21f36f94628b57a6ca2fda4d67b16813", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368800, "uuid": "a4da0452-3fe3-4391-b093-1d9c5f789848", "comment": "Malware payload", "value": "136b70564c525cf3093c60d6bff87ab8f829d7efbb41817097f1941eceb366ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368800, "uuid": "3ee3fa3c-e275-4874-937d-ff3cc3fac213", "comment": "Malware payload", "value": "c00610eb7b4eb81cc71c96cf3bc5b5055e82f235", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368800, "uuid": "13d0de11-7c88-49cf-bebf-5045f23a4044", "comment": "Malware payload", "value": "f0e1734cbbe4bafa5e62d0d0a99ddfb992cf56a8a1b11b29b4bf90778ebb3b591d0d1f19644b05c742854d747e54bdc9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368800, "uuid": "1c4456d3-314b-4e32-8112-2af520223ed4", "value": "T10321197B8C45E8E48A964931AC3A2B00D184B71584B8DFB7D13E1CD048CF93D98838FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368800, "uuid": "074bb132-98d0-4dc2-9349-6fdf8d26d5d2", "value": "24:gfAjFEInjqNpkn/QqgskgI5biz4ZF9atc9I9GG9DL6VlNLcXYCLsW9yZj+:hvy2/Qqgskj5bk4ZHaugGkGVolLsW98+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633368800, "uuid": "30edd803-0bec-4a8d-bd42-121b80a16999", "value": 1442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633368800, "uuid": "9440f727-2eba-4211-836a-5e5ed77cc27d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368800, "uuid": "1cfa1c31-3958-41ce-a844-54fc5bb99d20", "value": "0x0006000000012228-59.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfcf6b8-24ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633308538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308538, "uuid": "57c3fa5e-4cf1-4b14-9b74-7383ffd984f5", "comment": "Malware payload (Gafgyt)", "value": "fa295758e772475cead1cb3b941a07b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308538, "uuid": "00ed0fcf-92a4-424c-a501-22189d8cc9be", "comment": "Malware payload (Gafgyt)", "value": "1458704d15aad5c549d1d113c5c6266a769824fdab0446995197d5b97b9a9bfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308538, "uuid": "ee23bcee-a314-485b-9750-b9c34dcc2e2a", "comment": "Malware payload (Gafgyt)", "value": "4f657cdbf6b39da50f62f0a95c747f5e8f9f7488", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308538, "uuid": "1d2f7dc2-2f4f-4a6b-8d81-aa2866448714", "comment": "Malware payload (Gafgyt)", "value": "57b7c06b786865c27bf9a3d3e07b43692943b8f873b9f920c1489cd108ad43756160bcc86f576f4244fe6f769a90dcb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308538, "uuid": "84157c08-cfb1-4661-ba52-9cbab49686f1", "value": "T15A833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308538, "uuid": "1f3f8c5a-6c90-4807-8ac7-67d84421fef8", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LFWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YZ2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308538, "uuid": "4afb2f5c-b305-447d-8723-e11426086183", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308538, "uuid": "01a8039e-949d-437d-b1b9-e634c7a66108", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308538, "uuid": "0f3c801f-c82b-4b79-885a-fe1b5b52ecaa", "value": "fa295758e772475cead1cb3b941a07b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a255eacf-24dc-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633329057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329057, "uuid": "95de7276-f45f-445a-9c8c-06dcb855240a", "comment": "Malware payload (Formbook)", "value": "225ad98e8b5bf987925ab31d0d8446ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329057, "uuid": "056d81a2-4ef8-4621-9972-fea8112e8edd", "comment": "Malware payload (Formbook)", "value": "151ac73a940835aa086b34eb4a68f0a8cd5a124622f9f4173a2072cfd1c9ed82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329057, "uuid": "0daf4473-8561-4f0e-a922-7041a6fda480", "comment": "Malware payload (Formbook)", "value": "5d51805704c257b1a0887d98ecaa931ed145236c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329057, "uuid": "cf2749dd-0cf1-424f-981e-c5e395f78c5a", "comment": "Malware payload (Formbook)", "value": "c1643578794ad9bedb940c02a171487e6df8b8674ae7bd5ef8bb9f2b69f473a8d719a3595a8fed85956e37ee0f6d3cdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329057, "uuid": "ed7d3b4e-912a-4eef-bba0-6de4da6eba4b", "value": "T1C3E49D54F11CD2B9FD0922B1257DFCC829F82EA8143DF91BBA97B1E264B9E3154B0193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329057, "uuid": "bceedaa7-976a-4142-8b52-64b88a6c0c75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329057, "uuid": "3cfee686-4c12-43dc-9e34-6e257f7c66aa", "value": "12288:oSbQ+X8+UiDLbRHah6UNvq7SlQk7LefaWEvVqBlkjK444iqGBcxTb:XbQ+X8+UiDLbRHah6UM7SbkmvilcK44W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633329057, "uuid": "3b08ffe3-f664-4731-816f-d1871b5dd8e9", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633329057, "uuid": "9697d9bf-7fcc-4ffc-9c25-ca284339e1c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329057, "uuid": "fe931f35-856b-4338-a9b1-8008968e0698", "value": "Cost Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34e1403-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633354855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354855, "uuid": "2d437c77-6eb2-43a6-b822-bcfd52516d12", "comment": "Malware payload (AveMariaRAT)", "value": "8cbf6174fb3a4b3e90b5990b56035865", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354855, "uuid": "664de10e-c36d-4ffe-afb0-417e81c48228", "comment": "Malware payload (AveMariaRAT)", "value": "16ddda7e3bc7f3b487325b51715c01ab3cca61e582dd7e147e5ad46da9b9b1ad", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354855, "uuid": "c3ccb176-da33-4dde-adfe-0c226cab7817", "comment": "Malware payload (AveMariaRAT)", "value": "83ccf675ae3638bbd064ee6701389e93c9a9100c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354855, "uuid": "60d6cd59-0c70-4f70-a375-5da495a36360", "comment": "Malware payload (AveMariaRAT)", "value": "1af07094dbbaa21aa76d1029c04978bb4e698aa12d5f9a85942c962b1dbb07a2da15f21ca114da4214dbcbfb7fab8c63", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354855, "uuid": "65da6abc-956d-4890-992e-346651a2d006", "value": "T1A494BE57A1CFAAECEC2C8AF41C20F35C37766C11641ACD286D98F0986A7576119F393E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354855, "uuid": "75e14bdb-ccdf-47ce-bbbe-2a68f1edbd00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354855, "uuid": "3fe099d1-f9ca-409d-b2a2-29c8c4887525", "value": "12288:gSeESodjQX25MzfcLcYMM6+HzlqwIyxzQkzDwL:sESUIpc3LxIeQkzDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354855, "uuid": "7428f428-aead-433f-8832-f0e80d7ac66e", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354855, "uuid": "eac17efb-d6de-4808-b94e-aba0c466fbd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354855, "uuid": "32aded19-56d8-45b5-93a9-f7a33ad36103", "value": "PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680dbb12-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (4444)", "timestamp": 1633338838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338838, "uuid": "8775523d-d2f0-4445-9b52-16d170a2f1ec", "comment": "Malware payload (4444)", "value": "5e5cfe1fcab0e5d3bf1ee2020707a28c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "4444", "colour": "#4C2839", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338838, "uuid": "52a1b382-e09a-4580-a0c1-de0c9940e344", "comment": "Malware payload (4444)", "value": "1768c7a55fd08ef7e82fc48e3410dc02ab97c745fd8758cc272868dee07dcc00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "4444", "colour": "#4C2839", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338838, "uuid": "e42eb1e1-9c97-404b-950e-16e5fcf82e9c", "comment": "Malware payload (4444)", "value": "280a13126fd3b28994ec7db5b968809c8df0fd46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "4444", "colour": "#4C2839", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338838, "uuid": "00daaa81-44e9-458b-8838-a583ac1929ed", "comment": "Malware payload (4444)", "value": "622615a73d2968385ffe23f752465534111b08fe643835599934ce3f7f7e475cc0b432a056585b5a03318b440153a52b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "4444", "colour": "#4C2839", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338838, "uuid": "d8216ae6-1108-4bd6-b394-7a77d9ee1544", "value": "T1A21501137A0B4549CA54CE76FDFB6B5533386BF64C638303A3492B2D427F6AD6982342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338838, "uuid": "4ffceba9-1fcd-4261-9e58-cc581fd50bb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338838, "uuid": "1ebf66d1-b8bd-42e0-8362-91eba4b90c34", "value": "12288:uVKZNFGGVc8foYajvsZ50Flqo2y+GcLrg0nH3bc3qsSQA2oQrWx0B+YcJ:uKZO4c8f6vs/0FQWikk3tRUrWaB5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338838, "uuid": "c867a8ea-4f53-46d2-90be-831c148dca6b", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338838, "uuid": "4d207aba-c33b-446a-b097-283d4f254ade", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338838, "uuid": "bc596553-653f-44ce-b102-008c365d2b84", "value": "5e5cfe1fcab0e5d3bf1ee2020707a28c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79b0ce9-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633342058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342058, "uuid": "18bca238-3aa5-45b5-9cc9-660bb1653991", "comment": "Malware payload (Gafgyt)", "value": "8873e9533936a1c0a35a6fda6e9211ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342058, "uuid": "51c2a979-69d2-43d6-83ae-a20d5c023fd8", "comment": "Malware payload (Gafgyt)", "value": "186562981de6c99e94fb4bf5ffaafbe0dcc0094d44e6a9b973c1338364cd17e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342058, "uuid": "bb1e5fef-8bc4-45c0-8167-cdcaca803ed9", "comment": "Malware payload (Gafgyt)", "value": "5376a86eaf591316901085afa3bae3552f83dd00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342058, "uuid": "fed4e034-ed43-4e62-8996-b14d66904a1a", "comment": "Malware payload (Gafgyt)", "value": "7e03b2cd2d20aa38f2961a48f28d1da9c70eb6c7897d62ef90843e607e36fab5f63f9c0edfeb381280c299c5eb99bbf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342058, "uuid": "01ae632d-ee87-4ddd-b66b-b0cced8b4e2b", "value": "T17373BFB1D0687CA4C25C0138B9F9C9392713F404A6635EF49E568BAA640BDECF51E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342058, "uuid": "6f841964-d20d-4aa6-9907-c19832919325", "value": "1536:z/BmBJTHblwt3imVUkYrL6AVtfoXwFTAVMwSeGCBxk:zZmLTblEimVarmMfNTAKwSeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342058, "uuid": "c3471a00-983b-4e09-bd87-819eda40a4ba", "value": 76804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342058, "uuid": "322c6732-92aa-4a32-80b9-1a54340627c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342058, "uuid": "89114024-f991-49ab-88c6-b80795bec08d", "value": "8873e9533936a1c0a35a6fda6e9211ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413f8753-24ed-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633336196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336196, "uuid": "007bdaba-0f65-4e37-a877-9f0ba4097ab1", "comment": "Malware payload (AgentTesla)", "value": "0ae469f45e9dd85b79f244ef8aec65b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336196, "uuid": "7d046997-1960-43d5-b599-38249f9dacbe", "comment": "Malware payload (AgentTesla)", "value": "18f18f95b6e1cf687e393cc9b6aa1d70705a7ee96945b281db9ccc3bd907e1fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336196, "uuid": "b3beca0f-6798-4eb1-9319-bb72c7b3e290", "comment": "Malware payload (AgentTesla)", "value": "1bf50ad8bf89c3aa3696653680f6656f2a445bb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336196, "uuid": "cdc992a9-1627-42fd-b972-3841cca76245", "comment": "Malware payload (AgentTesla)", "value": "215769f024391d6f316f550f87ac6fccaa48eb8fe71d3d27ccc0f2de5f22115fb63af4dd3a0da7fd448ba6304ab06cef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336196, "uuid": "3b02b526-a03e-4353-aeb4-5e70d6a7fe86", "value": "T1369402A913E79304DE798BF53C65D14227B5B12A219DC3781F88E8FD3D62BB40AE0847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336196, "uuid": "db35dff6-5e7e-4003-ba5a-9388457dc0d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336196, "uuid": "95edcef7-5ccf-4918-b86b-ec9524897804", "value": "6144:motMDERQ+3HwOAS0fc1Y316T8rza3VFwKZQxmon4QdFD6aeO3N2gcPPzMu2ArUWw:EESo71Y3Vrza3VbCIl4O1rdTMuXrUwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633336196, "uuid": "d0fdfcb0-c833-497b-a360-57ade72eda5d", "value": 418304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633336196, "uuid": "8fc2311e-6c03-4b50-9fe8-ae15e23a920b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336196, "uuid": "dfaef4f8-912c-47bf-97c3-8cc6a6e8d2c8", "value": "PO 229156.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54c8c8c-252d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633363986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363986, "uuid": "54b27926-fd5a-47d1-ad86-88350e8ea658", "comment": "Malware payload (Formbook)", "value": "b04b0416c7a562416e58c07fb38699a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363986, "uuid": "1da8ac00-ba62-4024-b530-0b07bd27b8db", "comment": "Malware payload (Formbook)", "value": "19492b5df68b96dd4dd552f1a4735f795fa8bedef47ac95f1336d9731ec5edd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363986, "uuid": "287367ce-2648-45af-81fc-299dbcda2319", "comment": "Malware payload (Formbook)", "value": "e0737cd598cd24a694632f81bb274d1e8792840a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363986, "uuid": "2eefb179-d3f4-4184-8f45-499154b804c2", "comment": "Malware payload (Formbook)", "value": "7259dacbb737b6adaa786ff2bf38eaf8576827168afea5f8e4404a3cbbbbc8daf114d3e7d9545e164f5e2386361c1101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363986, "uuid": "786cff2b-8161-42a0-b6b3-2ed9c5bacd27", "value": "T1F2E4CF64B743D61BCE7547F02CEDA6406339AE211A09C32E7885B7BC2E737741A4C9DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363986, "uuid": "c52cc4ee-bf6f-4922-9e04-a4ea9015846a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363986, "uuid": "eef1f973-dca4-4c90-8760-484a43a260a5", "value": "6144:0leWOQ+3HwOExxWFVBHtfsrIL7po8wutYF7Ke2ubf3XJvf9NGJUa/tnhn4122Irm:moXz68Le8wuOF7KeL3XJv10U4l4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363986, "uuid": "cbc804f2-e501-4e1d-8129-7568ce55ae2b", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363986, "uuid": "7e71fc5a-71d8-4ef5-ae08-44fca10bbff1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363986, "uuid": "92335e3a-3c01-454b-86fa-73eda0ba5876", "value": "b04b0416c7a562416e58c07fb38699a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829392ce-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633339312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339312, "uuid": "336c582a-370c-4bf9-868a-860a4a9ab578", "comment": "Malware payload (STRRAT)", "value": "53c61d3e434b7b53dd3ef75348efa1f4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339312, "uuid": "386a5af2-6bbb-436a-8f93-0e5528ab3036", "comment": "Malware payload (STRRAT)", "value": "19d70f989916c257d0c89f5c8424375d3b3f9ba573f1503f5f85d1c69c112a67", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339312, "uuid": "122edbdd-3ad7-42f8-af63-eb5917695c3c", "comment": "Malware payload (STRRAT)", "value": "29f45cc6c3355526d8d41b49bada82cb2ff80039", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339312, "uuid": "5a9bc122-8226-45f0-a95a-d7880c78167b", "comment": "Malware payload (STRRAT)", "value": "cd7d39ba336a332d04672b2de263c8dba0aabf4fd565fdd3236fdc5162cfd7b2b38772c470908af0a7d221e2928ff396", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339312, "uuid": "3c95bb56-cc06-490f-ac69-306817e7c6ca", "value": "T190C312F81960C82543AB05F650086AAC69DDF4F8F9C2DE2F878D24E27D5EF29F351864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339312, "uuid": "df3a870d-d601-4ece-a0c5-4f2c21464508", "value": "3072:QpAg/4NyBQ79he4WOUqoO8QbUfetXk0BHCSeuMEL:QOzaG9YOUqoJQbSgLxCRuM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339312, "uuid": "30d39227-37db-4b55-8bdc-cfd5a3754dbb", "value": 123209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339312, "uuid": "64a71db0-e4ad-4856-9d28-fbc649d9125f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339312, "uuid": "e37b8f3a-fe58-49f3-bbeb-c7e21d4dcdae", "value": "Required Purchase Details October shipping.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bcac82-255f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633385171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633385171, "uuid": "12498977-7827-427e-9ca1-01696a3e2468", "comment": "Malware payload", "value": "308493a960b7a68197b827df204d8069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633385171, "uuid": "5b63c539-dcb3-4278-a216-33820550f7f8", "comment": "Malware payload", "value": "1a01d821aba5fd6eef3b540c9640a6ff19561c36dcf28461d649cb17cc73bab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633385171, "uuid": "0dd41d47-92c5-4444-9df1-d8d2ff527d3b", "comment": "Malware payload", "value": "22a2cbaa97cc2d74988669ce5be4edeedda9e165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633385171, "uuid": "0bd3f5eb-4e6e-41a2-8c7c-20acb90991d3", "comment": "Malware payload", "value": "5ddcfe46f81f4f3062596392bb29be77a9f132dd91aed09646e775259fed18ac6f92732cd38486cb847f013b59f7e676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633385171, "uuid": "6d258f57-a2f8-416f-bd24-939d11e2a0a8", "value": "T1D1849ED2BFEF9F11FB84693158AA5398A537F4190F43408B202263D95E1EE64EE1631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633385171, "uuid": "568b8e75-1676-422e-882e-53b541531bc1", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633385171, "uuid": "0503a9b5-3efb-4b78-b852-5454a820abba", "value": "6144:24vq5hs5I/nc4w0HFmjHhKy6p1khCEkMLMHg8pbRTjTPh8:FC5C58mjHhKy6p1qCEkC8dRPTp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633385171, "uuid": "9f45c58f-8bc2-4d97-83b1-08a77393ee8d", "value": 376695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633385171, "uuid": "be0fb893-4fc0-41b5-8259-8722aa9c755c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633385171, "uuid": "43128a32-6079-4825-a616-e479ec20431b", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc92628-2503-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633345589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345589, "uuid": "260115c0-8970-4431-a12e-440447b9f665", "comment": "Malware payload", "value": "eb016236613647c59e5e4ca81904718f", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345589, "uuid": "7b6c9f89-b355-4574-9c3d-6890e09fce35", "comment": "Malware payload", "value": "1a88536d2164d6c3b6d050a5f766dd703b69a49d8174586993b1266f806a5b22", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345589, "uuid": "26b680f9-37a9-4622-90b2-ad323bac92d8", "comment": "Malware payload", "value": "b3c73896095ae23ae05a6c942325ab904c811203", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345589, "uuid": "3403525a-86a1-4aba-97f0-3e70abea75da", "comment": "Malware payload", "value": "4330ad45ea960864f8f33f40edffab2ec94dc43df65388350ef9d52525a55028a58bc196778d95e30a29ebca98f4d5b1", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345589, "uuid": "541c1e9e-081d-48e2-9f05-18e254f37f83", "value": "T138635D193298D115D1251F328ECAD6F93B2D7D406F8A833B3220337F6E7B6A18B25660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345589, "uuid": "2e3e47fd-22ff-4670-a407-d6a1374c550a", "value": "384:xPxZeYFrxFTBBKQsDXsHiEuTJ1KaitmjYOMFR98clFo39D:ZrxFtiEeJGOMFb8cjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345589, "uuid": "08d05cb3-9545-45a9-91cd-2140a48ed876", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345589, "uuid": "a273dc86-a116-4448-957d-e0e1cc7de287", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345589, "uuid": "412f6435-305b-44f2-8cf5-474cda19a847", "value": "20210913_PO530.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5ad231-24df-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633330498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330498, "uuid": "2e94eb42-1750-490f-a6f5-2e218edb66cb", "comment": "Malware payload (AgentTesla)", "value": "aa9571188e337c73a8e26d98b0990c1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uu", "colour": "#50FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330498, "uuid": "7a8ee238-3e26-4800-93d5-3fcb49f0e4da", "comment": "Malware payload (AgentTesla)", "value": "1b60e400dfebae059b0f7b6dad85c26dc487a7f472ee27e9b936a9d2d5dff48d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uu", "colour": "#50FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330498, "uuid": "e8430add-dabc-403a-a0d2-df1a3c180abf", "comment": "Malware payload (AgentTesla)", "value": "92ed89a0a957509503c6474b0258af289617509c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uu", "colour": "#50FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330498, "uuid": "d57a2bae-9139-4b7e-aecc-6aa7b90f5139", "comment": "Malware payload (AgentTesla)", "value": "53112bc4b61dc205f7ced03d2532973e1aa1fa16d32e33490d2a82ba2eb59e0fb87093e31abbe41c60b39b0ee13f9124", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uu", "colour": "#50FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330498, "uuid": "969ef6ca-fb93-4f43-a1d7-acae933e6364", "value": "T18164239AE023C4178E2E3B397B49785E15CBB88D350E7089CE5EB65DA49EC453702DE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330498, "uuid": "1aea3227-15fc-4e24-bf42-8885b4b8b8c1", "value": "6144:UDasArVnvJi6aTnXABSXspEWIvx8DVfU1WDFfXudk8cwlYslfQ1pl3M:UYJJitTnd4W2xfU1i5R8c47fyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633330498, "uuid": "bc00b1e6-905a-4433-8db9-976fba95f327", "value": 330462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633330498, "uuid": "f30c9fd7-ba07-4f45-bc8f-93addc6ed731", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330498, "uuid": "43ac1022-f76e-484f-ba6a-5b0957053fe9", "value": "TT copy for your confirmation_.uu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1189f3f9-2544-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633373482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373482, "uuid": "f15ddb5a-fa7b-434c-a08c-ce2f84da908c", "comment": "Malware payload (NanoCore)", "value": "1117135152aa2574b11fc3143834fa7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373482, "uuid": "09127d56-4e93-4d56-b6d2-90e6fbf01954", "comment": "Malware payload (NanoCore)", "value": "1bc078cd1f3178f475f59757d39f3a77c57d4e5ae9b094f453fb28e7ebbb4dd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373482, "uuid": "46888b31-4a34-4c95-b420-859a02354240", "comment": "Malware payload (NanoCore)", "value": "61918cd6e162a21a9639a3f86e493fa16033a792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373482, "uuid": "9e71249d-0f11-47cb-9f32-0669c9d26318", "comment": "Malware payload (NanoCore)", "value": "2d3cf58f5da691828741839cdd9c25ba8997f1f236234c7fd90b1357d92ae5ce5d6b6bf0ffbc85cd1bcee85115fdbffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373482, "uuid": "ffafbcf9-e03a-436b-8188-87a104c09b14", "value": "T1FFB5F87552FDCE065642B6D00FD4F482CDAFDFF108B6919396A84E9BC319D926AB0332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373482, "uuid": "133e0b16-93d9-4c6a-846e-4dd9b17ab557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373482, "uuid": "1081dc1c-3198-4d9d-a499-94931e4b2d76", "value": "3072:9lD7qW7+Xy+lrguEGpUI4UKsaX3jV1v+UIUXRpJCcvAiRcvgnOU4ez9U/25p4K2u:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633373482, "uuid": "b26a8069-abeb-43ac-b6fd-be2a1f6005a5", "value": 2344448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633373482, "uuid": "2e1ab5b7-28ad-4804-a384-070d698d1148", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373482, "uuid": "480b9618-3275-464e-8cd9-1edfe9d21a3d", "value": "1BC078CD1F3178F475F59757D39F3A77C57D4E5AE9B09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d61fb5a-2511-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633351758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351758, "uuid": "939f4aa1-3101-4c4a-bf2b-5a5badc23a16", "comment": "Malware payload (AgentTesla)", "value": "4848485b65241043189c99b7790836ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351758, "uuid": "cf31bd35-670c-4fc5-bb67-519474502bcc", "comment": "Malware payload (AgentTesla)", "value": "1c72a295a2d1f21831a17c6919abbde4117ebfafc0f9279ab468e00334759112", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351758, "uuid": "155b670c-2019-4c1b-9748-e71994d4126d", "comment": "Malware payload (AgentTesla)", "value": "6e3d9afab074f435fc951dc43c3ab7afdcb662de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351758, "uuid": "e90a9e89-ba46-4492-b00e-086614bcb643", "comment": "Malware payload (AgentTesla)", "value": "63f3559e3eff035c17c34d51bcd0950c52d1dae3e200c3217c1436b7b216733aaa53ca2868dda84eb6b5c009795dcd29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351758, "uuid": "97597b7b-a46f-466c-804a-5c3abe80933b", "value": "T18155122BBB176901C444DB32EDA3BB601770AFF29CE2CB47F246355F51BA3566840792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351758, "uuid": "dc2e29dd-cfd4-4f69-bbe3-e2937811eb1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351758, "uuid": "c578f803-263d-4c84-9a94-7934e3ccb24d", "value": "24576:/2byN9UB69h6n83Qv7JlGLIqIcI8fpqjb+DVWIEb7f8NAAvtCkuYJL:/khBwE83iJlEfRdhBhWBGAwuYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633351758, "uuid": "44d4ddaf-4ec2-457e-af0e-6ea4e671baf9", "value": 1339904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633351758, "uuid": "f3149c6d-2be8-4bf6-b1ca-51a034874096", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351758, "uuid": "aa9e70f9-929c-48a3-a266-9c095b26964d", "value": "4848485b65241043189c99b7790836ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc12bd80-2507-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633347569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347569, "uuid": "4cdda435-d7b5-4691-a024-34a227e598ff", "comment": "Malware payload (RedLineStealer)", "value": "d0df47494727bcb81d5c01334f0a2132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347569, "uuid": "7c9b341d-d15e-4559-b3aa-610659c7597c", "comment": "Malware payload (RedLineStealer)", "value": "1e82b02f7cc7ca0f1f879e7c352ab8d60e2fa81fde99cb650bf83a0c244e97d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347569, "uuid": "32cd44e4-efe0-4754-8a38-c1e1e61e66b8", "comment": "Malware payload (RedLineStealer)", "value": "a4407c318b5cf507869ebbfebc1b68359cc176f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347569, "uuid": "b1f1b5c2-3695-4ab3-9614-b8de1a143323", "comment": "Malware payload (RedLineStealer)", "value": "289b2cf0f6ed892d070341f76c499dc31b9aa53fcfca8fdec2a3ef988f64eee3d9a0a43d9310bd585ad4e4fc8bfc0d42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347569, "uuid": "4b9e9596-ec96-4c4b-b289-ffcbaa48eb57", "value": "T13BD458553D4286BAC97C0BBEC67843C0A23D6C136F30E27D6FB176A916F328C459D5A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347569, "uuid": "3e7fbafc-0d2e-46c0-9c92-731c32928d71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347569, "uuid": "ddcd30c8-8cfb-4cef-bc37-0117ff8b8263", "value": "12288:KptAg/b2+nGUDp5a1uI8o8do9C30mFZyQG8J:sb2+GUDp5a5SZJFZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347569, "uuid": "8e09d56a-d557-4c50-b282-0c25d18f7798", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347569, "uuid": "b2bdaada-ecf0-419c-b5e8-0ae26fbe42ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347569, "uuid": "ec01dd78-0719-4f0f-a9cf-56fb521a2876", "value": "price list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa398f9b-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633360853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360853, "uuid": "f89a0f03-48a5-490a-ba9b-5e9f016cc42c", "comment": "Malware payload (RaccoonStealer)", "value": "be01323b80fba9b067b964f32fb09b79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360853, "uuid": "03bde375-cce6-48f7-8b8a-abf7276d0826", "comment": "Malware payload (RaccoonStealer)", "value": "1e89e268686b120ae6e58ebfc87c5a532d227a54c35bc3b01ed1b992503f64e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360853, "uuid": "857eb012-6340-45f4-ae80-058773fc2ec8", "comment": "Malware payload (RaccoonStealer)", "value": "3cab41e92e0c6b2cc63e53f7e55b22db566d000a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360853, "uuid": "ac96d9c2-fc20-405b-b73f-612525903681", "comment": "Malware payload (RaccoonStealer)", "value": "6173f24f38b0b3f443c0674bf93b578fde4b18b2c6e73d6cd8bb3d1b50e4de40014af7c3d43f6856c1b9314f8b396d7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360853, "uuid": "4a001b1f-87f0-486f-9261-6a2b54707aec", "value": "T11BC4F10835A1D3F2E7B242B16752E7E1452DBCA81D269ACF2798261F6E383F1D725343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360853, "uuid": "b817d72d-dcf7-4063-a221-a107960eb1cd", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360853, "uuid": "4a21c845-460e-434f-abbc-c84698fa65b2", "value": "12288:HoHoQ2Akjmwt0+jFHCQ3cnXJ9sMuzxp6L:HOoI2mwt0+jd2nsL36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360853, "uuid": "976b7ef1-64a0-476e-aa13-aab69815b8f6", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360853, "uuid": "321f0393-68ed-4763-bbb6-17440b955780", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360853, "uuid": "9d03d4f4-2783-4e98-af19-6fe2e1babfa0", "value": "be01323b80fba9b067b964f32fb09b79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f7109c-24e2-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633331739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633331739, "uuid": "ced51677-5799-4f9e-8660-5f51b1251a24", "comment": "Malware payload (NanoCore)", "value": "8716ee641f0572d128d1261c9393f4af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633331739, "uuid": "7062ec74-c05a-489d-8db9-df7a3bf70e17", "comment": "Malware payload (NanoCore)", "value": "1eb67ff1a8f16725e58ab95f31a3302f55196e10ba9bcde26960e87aea921c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633331739, "uuid": "73c2a1f1-b9e7-4127-a900-4cfdd9323612", "comment": "Malware payload (NanoCore)", "value": "c448efffce2c2abacd30cfa3fd3e6458c35866c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633331739, "uuid": "478406e7-9767-49f3-b861-d5e144db7bcc", "comment": "Malware payload (NanoCore)", "value": "7ccb1926eacb05bb2478d40f28d71222a0f06b461deb27586f0f97f6421ec111b9896c5fbd4bd3348afbf474eb979a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633331739, "uuid": "e3558d87-4b4d-4010-976d-06d75090124f", "value": "T119F412902323050BCDB886F4B898EBD25BFD446BA198D2F01D56D5BC7DD3BF90AE4642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633331739, "uuid": "9053d282-0958-4850-b56e-fc7f2d1ac602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633331739, "uuid": "63876b57-79e4-42cc-b893-9c363ec4c066", "value": "12288:WrZbyG+NkqSVRUM51k0shDxOVZnXBsYpz8nt+VKfuWx1Zqvsuly3oX:M+NELUMrk0sh9sVRsYgtaW1Ay3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633331739, "uuid": "431b446e-d933-4601-9eb0-1035c063773f", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633331739, "uuid": "86c0c555-6a6c-4418-9315-132226e3567f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633331739, "uuid": "572be29e-d772-4217-9e48-f534ef4254d5", "value": "8716ee641f0572d128d1261c9393f4af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeab0600-2501-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633344969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633344969, "uuid": "85d9dbcc-b092-41c4-bfda-a13e31499340", "comment": "Malware payload (Loki)", "value": "ac2c99059acb87cc6f8d85aec34f36e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633344969, "uuid": "17cdd6cc-53fc-4358-a7fc-a9bcecd6ad80", "comment": "Malware payload (Loki)", "value": "1ee35bc40a58f1084a745125a9573f003045ffb47ad25750e509eb993f0fceff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633344969, "uuid": "779ff1d4-9118-4272-bea5-4f18dc1d5769", "comment": "Malware payload (Loki)", "value": "533ebc5c967021a855aad0b642ba7595a3ab8d11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633344969, "uuid": "f977afc2-c9e8-4ad8-86f7-e2d084657998", "comment": "Malware payload (Loki)", "value": "9f44218373201ec4e090e20f3fccf7546cfe26098772b743cc6957a1ba0d9d4305f080ab4ef3d09ba2328fa14606b369", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633344969, "uuid": "484572f8-06cc-4a01-913e-1001cb6c7e65", "value": "T1CFB4E09D23AB8A00FDBE47F9B97490904BB1B8272406C73C5F9068ED1D737E48AA5753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633344969, "uuid": "e8792742-1b4e-460e-81bd-13e4b878b6f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633344969, "uuid": "a86d2ba4-54cd-4867-a409-92dbdfa12e89", "value": "12288:c7oiUgrnFaoxz37twnVTfkIMh0Qk5JT6YashlM0JT6YashlM:WnUgrnFx5tw9fkrhDi9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633344969, "uuid": "15009807-309b-4f29-8542-e6c7e32a1416", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633344969, "uuid": "2bd62eb0-b8df-43d2-9787-019b87b3dc61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633344969, "uuid": "436d76b7-7cb8-4190-94cb-d0359c5444ee", "value": "ac2c99059acb87cc6f8d85aec34f36e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115f4449-24ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633343846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343846, "uuid": "6c85c6b1-19d7-4fc2-bbd6-771aec597fe2", "comment": "Malware payload (Formbook)", "value": "136e080b03cd5048ff58240df85105a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343846, "uuid": "f108f516-81c0-4522-96a3-7481b6dab134", "comment": "Malware payload (Formbook)", "value": "1f26dff77c5abe47b2f1ec6360396fef9b66c18fa7c76629568de2089bc7052f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343846, "uuid": "fb3d70ea-d96d-4191-935a-a156515d828c", "comment": "Malware payload (Formbook)", "value": "6c4344702e83eb754f9b780645c3a813700476e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343846, "uuid": "8d19eb0f-5c11-46ed-bdfc-b1393662f5d5", "comment": "Malware payload (Formbook)", "value": "f7dba8d59575015a0d2b3dc9d0e68c356eb511e0756ee7ce935e86d61082bbee324649ba29e4eadc2b8270d84afb71d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343846, "uuid": "b0a1b3a0-0a1c-451e-b251-df0b8ef3d4c9", "value": "T19505BE1963AC9B4EC6BFC7FAB01350181776EE4A3E0DD6059EC231E81E75BB14A464CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343846, "uuid": "3b697e4a-b736-492b-be10-bc5ec4168ce2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343846, "uuid": "5950c718-2c9c-4a8b-a8f4-85b355cccc68", "value": "12288:2cHF8YAmMqmodEXVV8TorUAey3aom/6tKrPt4fwGfSQJNcahBsvm1IVCrr6PlVsM:iJIFit/GzTLpJz3TFF+V6+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343846, "uuid": "2d6152f2-329c-4834-bb62-60500d5fe477", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343846, "uuid": "d1423a95-1421-4cb7-9906-0d7a75bc4357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343846, "uuid": "90f074d1-e730-41f5-9a53-93bf6917efcd", "value": "E20210917ML-RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ffa372-24cd-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633322572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633322572, "uuid": "272606e5-d294-4552-915c-c6477092644c", "comment": "Malware payload (AgentTesla)", "value": "08297b1dd6ad333b9fc66c9e64cc9b7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633322572, "uuid": "dfc00d2b-193e-4545-b740-ee880661237b", "comment": "Malware payload (AgentTesla)", "value": "2056868a6d424e281762a3b4342bfff041ad23d30744a9a7365e04499788dfe5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633322572, "uuid": "ec5b9bee-ddb6-4f34-bde3-5ab5c1a9b3bf", "comment": "Malware payload (AgentTesla)", "value": "209708257fd04a0f06c0aac35c1c035004ca3356", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633322572, "uuid": "655fef18-2bfe-4657-b2d0-09d371122044", "comment": "Malware payload (AgentTesla)", "value": "e8b4a896c61afd65b6f4366f3f2e28970c5d3b36eddda306beeae8f855ebd6b541eddec0540f7f99bebe31bd545f5e81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633322572, "uuid": "26204726-0bf5-443f-89c5-f0539a4f9cde", "value": "T14C151A9013CB9EC4F03B6734B0211CE7A6FE660DE379CE15699A3AD78DB6740461DB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633322572, "uuid": "686d9d69-966d-494f-9ffa-a72a265b2a1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633322572, "uuid": "c6154a5e-8fc4-4734-acad-f6f2944ed629", "value": "12288:KirOw5r0zGhfGJ2mivi3DpP4iwGHNelvv0RcqsE2K046Mnq0UnsO5lJkKzUvoPU/:7AiIhJd3dz+9Vlr1PPOeqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633322572, "uuid": "e36e3216-a1ad-474d-9c7c-2593c205041f", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633322572, "uuid": "5575a810-c3c3-49d3-874a-c89e5575cf43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633322572, "uuid": "72fefae5-b8a2-4b71-b8da-8636e19f00c5", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.8632.29603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b130ac-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633360654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360654, "uuid": "07770646-bb61-4b56-ad9a-a56a31389c8b", "comment": "Malware payload (Quakbot)", "value": "bd822f8b088df0df6697eb3612d0cbbf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360654, "uuid": "f65f0571-3756-4c46-82db-51e4a49cf93d", "comment": "Malware payload (Quakbot)", "value": "207327b6784ed008dcdd8616aac692eec86667d4de1fa89ff28f4bb5eab7e7a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360654, "uuid": "001ea00b-6d11-4698-85c9-20c27288db7d", "comment": "Malware payload (Quakbot)", "value": "c38cb27d961b7ee71e4ab06fe8e8563e98186f7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360654, "uuid": "9f270776-26f5-4280-8128-1265854ca06d", "comment": "Malware payload (Quakbot)", "value": "c9c41bcc461e1b87498c096657d7bf431460f11eca487644daa003aa78d6e36ab0874422ab7e5c479bb82adb2a92926d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360654, "uuid": "aeb35de7-c65c-40c1-b270-e741d2bd64f6", "value": "T1F9B46C507751E4A1E67D18B18E28C9E90A097E068FB2B4EB79E43F1F6B6D9F7C011702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360654, "uuid": "74b1585f-b861-4b43-a2b3-4682d3e2663f", "value": "e4fbe8cce04bb55a530853e0c72f4bd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360654, "uuid": "af51447b-887e-44d0-9f8b-511b5322af61", "value": "12288:IW7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6bUV:IWf3YTnJLBv2EKMAcOgqxETMNIpM6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360654, "uuid": "449e972c-6cad-4a67-b588-550b5688c086", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360654, "uuid": "ac245ce7-ebaf-4dc6-aab6-bc5b6ceb444c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360654, "uuid": "56036770-733a-48c3-88d8-99303d930f33", "value": "44473.6364791667.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c849ef1-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354602, "uuid": "edb13fe1-1108-4774-ac07-19e938f79271", "comment": "Malware payload (AgentTesla)", "value": "8b7c661a57b067b5a10293ec8d68ff2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354602, "uuid": "8668b96f-eb75-4414-a6e9-1bc55b9ee0fb", "comment": "Malware payload (AgentTesla)", "value": "2076597b7771fc352f750053aae59b472926e0f7886ebc6dd7b676f8e480ff40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354602, "uuid": "7893be41-4ff4-4623-93bb-c36f694078bb", "comment": "Malware payload (AgentTesla)", "value": "959a710717aa8ce6739ce5e1ec63dce6e3bd2954", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354602, "uuid": "2b0d0058-eda4-46d9-b426-75ceba3be7a6", "comment": "Malware payload (AgentTesla)", "value": "c18c352441df17f7646a03c85e72f9406d55e744dc801fc0341c3922b60f77f6a9ed539683fde59f243da3828ec35fba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354602, "uuid": "95214022-7bc4-4f07-ab09-2870dd608980", "value": "T1E494016D2363A308DD7987F13D64D2925BB56473101EC3786E88A0DE7F63B781AE0993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354602, "uuid": "bc8570bc-9fa4-4c44-83de-5245b9c501a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354602, "uuid": "997a8ae5-5533-4a2e-80d0-23c932932c8b", "value": "6144:xtQcdQ+3HwOQnshZqw3QZrgEcO7gioa3lEWkmgtAzD4lgfbjn/QgwTN7zme8B1NL:RWo+snX3i7HBiWk7Af44n/uZz8fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354602, "uuid": "1041e2b4-4be5-4e65-898c-0b15fdf89131", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354602, "uuid": "69103945-a44d-4e46-8c6c-cf6cba838c9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354602, "uuid": "d39bfdf2-a9fa-4707-8870-258f4257ee96", "value": "WaybillDoc_7807431483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df99b706-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633339468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339468, "uuid": "4a16e8fb-2447-4a02-97e8-85f8e347af1f", "comment": "Malware payload (Formbook)", "value": "3a73c9c4a1e78e49f8b0649de5f5f8c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339468, "uuid": "1e5009b5-96c8-47d6-bee0-efd9393cf3ba", "comment": "Malware payload (Formbook)", "value": "2152a980e864940db36cde90c649f66e7c2da15790e97703a28cb378fb7b5ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339468, "uuid": "838b719f-c5af-4ba6-9986-751aa73c5c71", "comment": "Malware payload (Formbook)", "value": "7582cffb3f24fb6a15a99a67986d980d90f52d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339468, "uuid": "b3e82de1-e45f-46dc-a604-b73de349d686", "comment": "Malware payload (Formbook)", "value": "9691c85afe4c5049f3173fbbc88f99f2c5224ccc87b0a766e245ff6aae5130b4fcef2f3dd729b960f8c3fde82cff72af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339468, "uuid": "afa22123-eeb9-41bf-bb2c-dcce3a67a0b3", "value": "T1FF9401A823679354DD3983F62C28E2815B75B41A201DC23C5EDCF4ED7EB2BB459E0A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339468, "uuid": "31e6b7c4-9c70-4b40-a5dd-741bc30f6569", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339468, "uuid": "cc4896dc-9fdf-4742-9e5c-213f0e215e5b", "value": "6144:UhtI9ERQ+3HwOGy3cyiyQ6AnXrUOGXc97ylrpcQwiCdl5WBI/w9nBrj4+T0:/ESoGFaQ68XrnGXsOluQndBI/w9Bw+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339468, "uuid": "0c893d44-1406-4dd3-934b-21aadaaae308", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339468, "uuid": "60d5fe8b-00ae-4337-b8e6-65eb8591b38d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339468, "uuid": "ef70680c-4d80-4652-8583-13c0cb2d114b", "value": "Comand\u0103 nou\u0103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c925c4-24fe-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633343511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343511, "uuid": "7d52a209-3acf-481f-a827-4c612a803bed", "comment": "Malware payload (AgentTesla)", "value": "82bdc2164dc4ca4000a57765fa0f3af1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343511, "uuid": "b93f9f47-bcf0-471f-94b8-59e7508ae355", "comment": "Malware payload (AgentTesla)", "value": "2159a5fe890c12ad6869f24c7e2a100e0712723c99fd7c48284cf9c28a6fee45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343511, "uuid": "fc1d0482-8f28-4768-8e15-36a66bbab809", "comment": "Malware payload (AgentTesla)", "value": "b0d3d00ac4373cbd7e13c221e636f9d6d7d14a59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343511, "uuid": "dca834e1-2e85-4eb5-8b5e-72a3cbfff069", "comment": "Malware payload (AgentTesla)", "value": "3e94952c97d4a04f148d92813bd253eb137dd42423b7f29e5f8425dfde442e318829be61c1f8ed324afe0f118089fa67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343511, "uuid": "a1adf11b-67b0-42f8-bff3-3bd5bd434be8", "value": "T1F3151A9013CB9EC4F07B2734B0121CE7A6FE620DE379CE15699A3AD78DB6740561DB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343511, "uuid": "7290c687-c7da-40e7-9b85-ceffc9e08769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343511, "uuid": "071831d3-2844-4da3-8836-046dd06fa87e", "value": "12288:E83G4p3oHi9zK9C5WfWLflDU+EaH9+pbvowpcvxRW2K046Mnq0UnsO5lJkKzUvoS:cQXWrS9yvmfyJUioUPtYEBf3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343511, "uuid": "cbc141eb-24f6-4184-9941-896669f3323d", "value": 960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343511, "uuid": "e4f0f1ad-ff22-47e1-bcca-46f7a79c7944", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343511, "uuid": "f62d95d5-3a8a-4db6-af2c-40992bed542c", "value": "REQUEST 40ft Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab3c2b4-24ea-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633334843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334843, "uuid": "9f116b21-b467-49ba-9e98-8e31d24126bd", "comment": "Malware payload", "value": "97ce1d1ce2ddcd8bbd6e0c7aa394875e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334843, "uuid": "7ca91afc-e66e-4a42-8c0b-5fa287e247d0", "comment": "Malware payload", "value": "22c292ccc93ce650fe4d9d40f1f5d0c6e457bda340ac5546a236886ed2a6b345", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334843, "uuid": "0e17d922-d5ea-4b60-9fa6-808e46cc08ea", "comment": "Malware payload", "value": "00fbe83cd793358b8eed9be9b811bb9e4abc1c71", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334843, "uuid": "21a2c7eb-7a54-4ba4-8378-5f7cdb198536", "comment": "Malware payload", "value": "af40677c314bcf1e4c4827f6d9bfa0244d77f2d103b80346eebc66496bc6aed830716a454d75fff2a0c4111a96866f6b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334843, "uuid": "fdcf270f-17dd-42df-8348-8f5523066a38", "value": "T1CBF53378C7A6C463CB1FE7BA5CF4924B74C5A42E4032D6572762B0915CE701E2BC2ADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334843, "uuid": "ec1d6f1f-3649-43b1-8f20-8a99ee776dee", "value": "49152:SSE6Eg6bNyU/rvx7lrfojmuigqEyPCTQBVSUS67VvofrGwXxzzR/cI:S6Ad7lrfojhyPCWqDGAHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633334843, "uuid": "ec5ce163-be0c-4881-890d-3d45a9ff979c", "value": 3497944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633334843, "uuid": "cf06a7ed-aa1d-420a-abe8-738b8250cf0d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334843, "uuid": "21ec72af-39db-434b-942c-67d696036822", "value": "RFQ#0001781154646.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a590059-24ec-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633335728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335728, "uuid": "fed7b6eb-7753-492c-8c6b-e955a273513e", "comment": "Malware payload (AgentTesla)", "value": "7e9f8115952e3a8a9d340fbaef1345bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335728, "uuid": "f35572cf-78d9-4f18-b144-1595c3427cb5", "comment": "Malware payload (AgentTesla)", "value": "23529dbe413fb915b0b2a9804278269485a73f6940c383e15b159cb0a090f823", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335728, "uuid": "ddba9529-8e8b-4216-a9f7-a3afebe8e5ce", "comment": "Malware payload (AgentTesla)", "value": "3e7b6457041a97a2ead1c2daf43c8a4919900c3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335728, "uuid": "bc4cf86a-ea35-40b3-afcb-f03d16f19f28", "comment": "Malware payload (AgentTesla)", "value": "addcc31487f0bf31e0e34483c472d4cf7c653bb88ea11f31d681846b5a81d8790ea596a6a40e8f3f6083d50675bb82ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335728, "uuid": "8dda7deb-4c9a-429e-a389-168bdf149f89", "value": "T14264134A5BD08DF6E8D667B1D733B378B7BB1188015A3E478F506E343A2B28B550F192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335728, "uuid": "5ebe6520-e249-4011-a5db-64459b1b451d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335728, "uuid": "3217fc08-78e2-4388-bbc7-1e3649ea8e96", "value": "6144:F8LxBsUb5xdSi08S+JkxUH95rjJ7s0fXCgHRPQuUoK84NwdA0TplojO5:/6xEhmoejyqRPPNdd8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335728, "uuid": "8da4f5b4-6f61-40b0-a3f1-9b075415b5c8", "value": 310049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335728, "uuid": "8a629ec6-d49b-4fa3-8830-314601f5ac5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335728, "uuid": "166af23c-b4f0-4111-85f2-107362a7bd91", "value": "PO #2034500.PDF______________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1d0d97-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633348455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348455, "uuid": "0bedffad-b5df-4154-80ad-d6f3e37c44d7", "comment": "Malware payload (Formbook)", "value": "4c261f9e162e1d86be1b7106ff5fcba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348455, "uuid": "f35304d9-18cb-456e-9049-6061fdd14a38", "comment": "Malware payload (Formbook)", "value": "240ed2d2ad13186c06123612befe2a592cb2484a7bc6454f84be7f8bee850ebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348455, "uuid": "4599e9e1-4098-4213-a07d-49bf26ac4859", "comment": "Malware payload (Formbook)", "value": "77901cea8e050bcd11dc413cce5174346e698819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348455, "uuid": "aff8420f-ee05-4d49-b2eb-4c823df1412b", "comment": "Malware payload (Formbook)", "value": "e7cf40ea96bd47197b40a2f4d3cd5225d46b1be6841a2f538b595adc2068f9470b9627f56ea98f586772c3a2f6a484ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348455, "uuid": "f8dc53be-2578-402f-ac4a-118bd74e1c6f", "value": "T13C44E02135F1C5B1DAA79D3004349B50997BBC67287C618A6F642AFE6F323C0AA77707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348455, "uuid": "36960ff6-43a3-437b-9c3e-bd0252b2cf2c", "value": "e0383fee3aa7c9c4dbf3a05a98d01075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348455, "uuid": "2c838af3-7a43-4dcd-af9b-334894ea7ba3", "value": "6144:Tf0H03OKTdOnIvJFN8qqG+2FvgvTpDNsi:z0H03OKBFFP1CvTlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348455, "uuid": "1efdb1d5-6c20-4b5d-9bf4-f01ca0efe613", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348455, "uuid": "85053553-40c4-4170-a466-0df16ad66a86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348455, "uuid": "d806877b-be08-4a72-a8d9-bdac65d19ffe", "value": "doc012_jpeg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7a5155-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633347813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347813, "uuid": "91d1b2be-af1e-48fd-9fc3-51789d8c0b0c", "comment": "Malware payload (SnakeKeylogger)", "value": "e8601e876012f73fb9ce02f1c8f2c4c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347813, "uuid": "22fd9611-aa93-40b2-adca-21980f7fc00f", "comment": "Malware payload (SnakeKeylogger)", "value": "240fb0bf879ad5155b7841608a51d81da3945175bc84bbac169904f1179ab80b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347813, "uuid": "40ad230e-7c57-45fa-a324-240bc729706b", "comment": "Malware payload (SnakeKeylogger)", "value": "4b736b4f48c7cefb604d3e7c731e046bdfa26814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347813, "uuid": "43dfdee1-7455-420f-bb12-6e4e7be256b9", "comment": "Malware payload (SnakeKeylogger)", "value": "788a5d2e2b31ff3b14082b3e20ae04c327a0fef5f1a65b8ed855abab3ff5fb75088841d460eddae2c452e681681f09ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347813, "uuid": "7b12d56a-9acb-4105-9582-2c45dacb47f9", "value": "T1A074F2A823F75710DD38C3F53855A6922BB4E62B211CC3B85E9C90DE7B63B7849E0943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347813, "uuid": "494b1d45-10c2-4694-a2df-6eb2f4673fba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347813, "uuid": "e2a74b61-0d37-4898-9c4f-e33ca19ccd84", "value": "6144:3tp0ERQ+3HwO1mfMkX9kFqVrRieH/00hxHjiKGt9ortmDl+v0:8ESofE9kFsj00HHy9oBo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347813, "uuid": "54994264-1648-4a82-822c-2a9fc4a782f9", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347813, "uuid": "5d6417c4-c922-4b51-b00c-1ec91760ce69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347813, "uuid": "fab45768-00e8-4971-af8e-8f74ace92fdc", "value": "e8601e876012f73fb9ce02f1c8f2c4c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45069431-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633348228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348228, "uuid": "9afc20c3-8bb4-4eb3-8e53-c9f7281ca19d", "comment": "Malware payload (Mirai)", "value": "9ea9d2faf4fe7437f71deb2abcd913fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348228, "uuid": "2cbb653c-517f-4e89-bbaf-9cf94e227cfe", "comment": "Malware payload (Mirai)", "value": "24ed07e1d40288aa860c1f9431ee4a1bdd2ee0db7ae9e3fee8dbda8d680d085b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348228, "uuid": "29ad9e13-bc35-4fb6-908a-ed9e0a1dc171", "comment": "Malware payload (Mirai)", "value": "9080853a4ba6a0d4eeae2dbe1092d37d842c28e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348228, "uuid": "9fa07816-2cf9-421f-ac1f-561cdb5b0518", "comment": "Malware payload (Mirai)", "value": "557083b12bbe84d2065387fc46e09b8b028d9a000042e30bc0193d70f68d6b6882d0557135b2432e3075e262536ac1f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348228, "uuid": "785ab9c6-c57c-405e-8879-d0b50a714f68", "value": "T16B230748A8412D1CFBDBA8F951638F5D8E526701A0939A0FA3EBFD832C3723CAF15155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348228, "uuid": "572f60ef-d9b2-4608-a963-052511a65df5", "value": "768:9JGXzKKLwkB3SjzcQNudcmPe3tcDEueOC+OPO0+V94g:9JGhLw83gYQNudcCKteCt20+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348228, "uuid": "16e5bdd4-51c2-4758-8cd8-0777482f7f5d", "value": 49988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348228, "uuid": "6ce4b2b1-7097-443f-b8e6-eaf1ccce8cdc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348228, "uuid": "a933bd51-9cbe-4664-998d-c32d210d9cfe", "value": "9ea9d2faf4fe7437f71deb2abcd913fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2402112e-24b2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633310806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633310806, "uuid": "72197293-027a-4134-b5fa-eaf6faa21e87", "comment": "Malware payload", "value": "2f4a8d33233868b688540d3a618c09de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633310806, "uuid": "bb06817b-5000-4e7f-9eae-46f062288f04", "comment": "Malware payload", "value": "2520eefe40e1ce79d19ec005deda345612a3d767bfb9f5b5992f957142b5e5f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633310806, "uuid": "0a8d894b-ac39-4d22-b673-9d2ec49f14e2", "comment": "Malware payload", "value": "2ae10995a780afb745e80a84b5acd270db030499", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633310806, "uuid": "7fd6e14d-64f0-47ee-988d-4d88a05705d0", "comment": "Malware payload", "value": "4f498545b033281a043aa10d0957a740fdb9d391af86f9dbe45025dce5dc4223e88bed80907ca9060a776221b630e169", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633310806, "uuid": "4f51d206-e8de-4477-a3ec-91c248de92a8", "value": "T13192D0B0E78E9640D0F10C30DD6E965377870A7CC6F9313D7CA90BA895C94967638A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633310806, "uuid": "6a2c92f4-1101-4deb-9622-c64b1f3d9ca0", "value": "384:2MbnUja1mxBjnRy3xTmqcS0Sxrk6dTVMHCOjluMs83jU6hymdGUop5hYF:Jfmx1RuX/CgZIhHs8ns3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633310806, "uuid": "d9d165ef-3d5c-4788-9a25-6f8a7843e20a", "value": 20848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633310806, "uuid": "b22a16d0-7381-4ca2-80c3-e91b85be18f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633310806, "uuid": "b5f186c7-7d02-41c8-adcb-703b37434550", "value": "armv4l-20211004-0126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a7d742-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633335405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335405, "uuid": "9ca07397-0cc8-400d-a957-37e6d7806998", "comment": "Malware payload", "value": "f4be0ed1c42d3236cf40a3434035f1fd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335405, "uuid": "2acb26f9-9833-4138-a114-18d629a45352", "comment": "Malware payload", "value": "257644f905f12f4336dc9c3400425f225f45b81eaef83e347d58c4cf140d4306", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335405, "uuid": "6c879d77-b3de-43d8-97b3-3cc81b0e32a4", "comment": "Malware payload", "value": "266d2c7fdef70ec6bf23231df252b3eaec5532f9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335405, "uuid": "51351e98-ad54-45c5-8e61-d6cf9d19b48c", "comment": "Malware payload", "value": "5e1cd9685025b2399fe34a13ba2c69cb7cd0242fc54e39d17abff7e24889522e1dcbdb2b8b9b6f6e9c893e8083868399", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335405, "uuid": "5c80fbc6-f1db-4dad-baf5-098c758fac47", "value": "T156A58E22F2C38977D1772B3C9D5B6768683ABE102E38684B3BE41D4C5F3964139292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335405, "uuid": "5cb63aea-24e9-42ff-8099-881bac268666", "value": "24576:94fW9cP7L4XpW5AzYj6R67hdt2SGI6A1t5DIw4csNDovTtw49jsjTdt1TU+/mafj:94wUqR67hfnjPsZSqVTP//OYLEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335405, "uuid": "102c9806-cef2-485f-b851-421437ed1671", "value": 2080256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335405, "uuid": "91e313ea-d065-48ae-b194-962feb09710e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335405, "uuid": "7a4cae1b-48dd-4ba2-89a4-c0ab95164da2", "value": "wlognwkyfqspsopmdxiqrunvnrfltytkxzhota.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fee977b-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633347817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347817, "uuid": "7b05526e-22b2-4103-ba1a-f0b0fd3d29fd", "comment": "Malware payload (SnakeKeylogger)", "value": "ebb0766d2b3da782f018f85f0cefd464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347817, "uuid": "8574c1fb-5e6c-45b4-ae95-4cafae3da66f", "comment": "Malware payload (SnakeKeylogger)", "value": "258f9b15dcf9b9be2b491ea56faf0e971e2086d536a6955b5c4fdc1450bec17e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347817, "uuid": "2e44616d-198f-4a89-a1b9-40a043413b26", "comment": "Malware payload (SnakeKeylogger)", "value": "31b2ce8894efb958794dddb1d9843cc76c2a24eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347817, "uuid": "c7e4b470-0664-454f-9a7e-a620f2192797", "comment": "Malware payload (SnakeKeylogger)", "value": "195ea4e8bbbdbdaf9664edee1b6e97be352d8f505fd2be7804862d02119be1fe29e8b08480d9d809e64f58a9e7203dfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347817, "uuid": "dd3fc881-95a2-46d5-9136-6be918c28bba", "value": "T1A164F0BC23779348DE3487F43D24A7911BB6902B115DC3785E98A0ED3E63BB44AE0997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347817, "uuid": "3901a434-f241-430e-89d2-7522a5f2daae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347817, "uuid": "185ce8f2-836c-4d0f-94d9-733a0cc0d3f4", "value": "6144:YtCwERQ+3HwO3j3K5u3SvkLtYA4SDOFOsa6yNuSVhQ5lJIsYmx70:cESo3zK5uPtB4S8oT2GmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347817, "uuid": "85f89983-08bc-462e-9cab-8b112e1a8cc8", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347817, "uuid": "74daac12-e97d-4022-aae6-afc375d6010f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347817, "uuid": "832ef95b-b6cd-4d02-8126-2e1b2f891581", "value": "RFQ MARINE SPARES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49fb363-24ed-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633336416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336416, "uuid": "45a8cae2-982b-4d79-bfa9-bcd9515da9f8", "comment": "Malware payload (Loki)", "value": "eb35f0f8dcd37334d7463c18f9c72cdf", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336416, "uuid": "138ead75-8467-49b7-9268-db8ccc889e2b", "comment": "Malware payload (Loki)", "value": "26582c8d644e04b5de45b129ae85c18278bbbd0e9958e5e77e94067c46844d73", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336416, "uuid": "a758a6dd-292f-4155-a45a-6a8e10cfec6b", "comment": "Malware payload (Loki)", "value": "0eb9c4dad147b20e409e4871c40639d35c7a7ad4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336416, "uuid": "0bd0509d-87ab-4657-b90c-19cec78b15e0", "comment": "Malware payload (Loki)", "value": "2cb126616fedb6a62bde79fdff8185a764062ce8b40e815aa62dd0b09291fbc1d6f8f8b24c81e73710e6bb6dc1d280c6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336416, "uuid": "134e3040-a7ff-415c-a1dc-8063c390d245", "value": "T19F6423C83ED8AFC7D5832875E4648321A6C1DFB6B5A491627A63387713F4E0893A3D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336416, "uuid": "306ba7b4-3ec9-4b31-841c-e067725a8f28", "value": "6144:OyqioY/dO6kz+NbGCZ7vIMBPOeENMVn6pdNCb+Nt1uHADwkBH3:OJY/M6kyN5b5zEKVn+K+r1DweX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633336416, "uuid": "b592768a-c675-4cc6-a380-29339e62de62", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633336416, "uuid": "99ad9e2a-ea5e-4d66-9cfb-81fbb227a524", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336416, "uuid": "3cf10905-2efd-4934-bf3d-396c69397ab6", "value": "PI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edcb13a-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633363223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363223, "uuid": "d99e6213-9aa3-4084-952a-3b410d643501", "comment": "Malware payload (Formbook)", "value": "f368cd250e313612a8dfe5604aa44c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363223, "uuid": "a26d365e-ac69-47b4-8a03-ad84eed9e345", "comment": "Malware payload (Formbook)", "value": "267f66c96b16bd52ee383b06d728abd7f395e244cee4ab6a77caa319ae2c7996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363223, "uuid": "9e4b121c-12a5-4d29-873e-d184f84a0787", "comment": "Malware payload (Formbook)", "value": "4a2cfe4b057b990f56a862e7b766e289bf526a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363223, "uuid": "635f3077-20c1-4bd9-900f-81e6ec1eda7c", "comment": "Malware payload (Formbook)", "value": "e9700a9e90d0466327d4d1cd0fd13b83ca011a74ab53c04b96549f7719a91bc95f12a14f67105d0d71afce7ad61ef6d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363223, "uuid": "e5cbad23-e2af-4c17-8cf0-8db2a93601d0", "value": "T1C6A5D81123ED2608E07E6EB95A75509947F1FF277AB3C6CE010C675E5A61B02CE63B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363223, "uuid": "e6e145c7-4099-412f-adb0-6469996bb8ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363223, "uuid": "e2113567-08b5-4d5d-9b9a-7ffba1a3d401", "value": "24576:TZzd/zy0ifLh84QPNt1MdYswzl+KC7FUTXqKdDF0eIsr4kUQcWCWtIgQowi:TZXZIA4kUZWHLQow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363223, "uuid": "21f8fddd-f50e-4cbf-bad3-93735daac0f8", "value": 2150400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363223, "uuid": "7159e598-0051-4843-aa43-50dd3fecf431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363223, "uuid": "19e67920-e755-45e6-85ef-49ab5908aee7", "value": "f368cd250e313612a8dfe5604aa44c16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1db21a-2532-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633365906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365906, "uuid": "3601fb0c-e303-4b82-b447-7f5c0e843f51", "comment": "Malware payload", "value": "bfc7c93964cf84f5023f48170763f6c4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365906, "uuid": "49ab3431-63df-4e54-9202-ae70871ea069", "comment": "Malware payload", "value": "26d0da59b1be24983bf1a92c2220352f524633dc48b6be0573d7ebcc4b904f4a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365906, "uuid": "e6bceb90-58a6-489b-be0a-50e45f40ca95", "comment": "Malware payload", "value": "d7be38e330f1d167046264653817d85e96d7fc46", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365906, "uuid": "288a4dc2-c001-47a4-bcda-174c53fe2460", "comment": "Malware payload", "value": "bb288dbcb4115073557485d34b24cf30389060d084c3004b1bc5b9c07ea4df8c3478cb3726116c53c84dd214afa2038b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365906, "uuid": "16d42362-53de-4179-8087-6ac005cdff5e", "value": "T100B412993BD8F967D17F483C6044E42A745C28CDDD4AF94B29F5A4AE0924C391B0BACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365906, "uuid": "98cd8d75-835a-47a2-b6d2-538804872d0c", "value": "12288:5Bx1HuhZy+3DkOlu6V745ixEdjGGV8I0a39mknX08BUYD9pOr:n7Huny+3DLl/09GGVCW9rE8jOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633365906, "uuid": "d1608a91-8009-48b8-80ff-72d5295c6015", "value": 507783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633365906, "uuid": "68ef48e8-325d-442c-8821-8264843f00a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365906, "uuid": "d1770e97-b762-4bdc-adfe-9d3633d68561", "value": "00SI886_SO_0169256IN_20210925_000.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a187518-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354572, "uuid": "bdd59743-53c9-41bf-9471-667afad2d331", "comment": "Malware payload (AgentTesla)", "value": "81373b6cf578a94c75e44a67ef1a929a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354572, "uuid": "7f6b4d82-2780-4448-8d9d-f72f4e47d8c6", "comment": "Malware payload (AgentTesla)", "value": "274d9bc67aaf8dcfe8c97779f01137e5bbe1907cc8e4a0dd150841b9d38cc7f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354572, "uuid": "ce66513e-672b-4cc4-8cee-fb629184f8e1", "comment": "Malware payload (AgentTesla)", "value": "f035ea6a6afa0d5858289e71174ae58948a177c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354572, "uuid": "9ba0644d-2c74-4b48-9a54-1336c0e1d47f", "comment": "Malware payload (AgentTesla)", "value": "13a45ee0848b0ae0c1eec9fce45d6f567fdd3e1bb2ea3f4568a49bfe35d106222f3b1084acce03be8a8340dcf4fe4074", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354572, "uuid": "f305a9a4-a2b4-48f1-a536-2e1a0d19ede7", "value": "T1A284BF50E94EACD5E7D9D1B3B53A9B101176BADB82F8809F13663B1026B37C32077D1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354572, "uuid": "7c6451ec-de5a-49d0-b82f-c80ac2e836e0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354572, "uuid": "c3fb47c6-b149-4e21-a2a0-12982df86c20", "value": "6144:18LxB/CvsWVPTf69w92A2GxDEWmCh6Vx0HbZknGVXsvN+15gv2GMeJEPQN3:Js879b2Gx4TCQkHOGX8+1mOG3E23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354572, "uuid": "9a898629-b785-4aa3-850b-bd1b775892ec", "value": 382159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354572, "uuid": "ae8c5732-8992-48d4-86fd-e68e20bde836", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354572, "uuid": "60e30760-739b-430d-bc02-09abfb51c85f", "value": "Daman_inquiry_0345,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15bb46f-24e9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633334773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334773, "uuid": "45123135-1b88-4c91-b0df-169813b0d56f", "comment": "Malware payload (AgentTesla)", "value": "e26d7be6048d0c785f65f77b012ee715", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334773, "uuid": "e5877680-190d-4593-9b85-b04155746566", "comment": "Malware payload (AgentTesla)", "value": "27570dc435f85d656611a92a0a64d2a01c89a5f9beab6b4306276e056a36f13b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334773, "uuid": "978a638b-2c7b-4b32-ae51-5e99ab0f7623", "comment": "Malware payload (AgentTesla)", "value": "eeb6d42fbb960fcadb0290444ecdb7f4c80d9ea4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334773, "uuid": "d00e2b4b-9cf3-4be8-9605-f5f526750c61", "comment": "Malware payload (AgentTesla)", "value": "bb812470e61410b803cb73900f1655391385fb6677090a3fb597867e1dea940680ff9efa4ea6c1f293b96aa97d19ee79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334773, "uuid": "b36b30c4-5b48-41a7-a33d-94b30a9b5385", "value": "T197D4F19C23AB5A40FDBF87F978B054904BB1B4135016C33C5F9164ED2DA37E88AA5B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334773, "uuid": "2c16ef54-b87f-4626-963d-f4ec9b4d21ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334773, "uuid": "2c62afb4-5e73-4bdb-a717-c58c2eacf59c", "value": "12288:ssocSptndh0EIehMgb6cjWZqNeUXaTsrmJT6YashlM0JT6YashlM:hpSpJdh06b6cjaEoTx9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633334773, "uuid": "e3ee51f3-8580-41e4-8a22-85c345188122", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633334773, "uuid": "4089243a-c737-4612-a4a1-319d90bf4d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334773, "uuid": "9204b494-61bb-4e98-9e5a-801766c77f5e", "value": "D9cDKWVcOmCaS5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8028f0c-24e7-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633333845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633333845, "uuid": "206af43c-2d87-45a7-bb2f-3882d0174725", "comment": "Malware payload (STRRAT)", "value": "c4a38d07773d619f73abad13ed74286f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633333845, "uuid": "2f705d8d-a708-45ba-9f93-38641cae6a5f", "comment": "Malware payload (STRRAT)", "value": "2799f78dd51fce411e566d428cd2f26bb752370f1be1fb2f4ffbc23ae1fd6504", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633333845, "uuid": "6653b6f9-fe69-42fe-a822-ee0cd676d149", "comment": "Malware payload (STRRAT)", "value": "5199ab6257db0d690b7a08566bf8f032c74a22a8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633333845, "uuid": "fcbabd9a-d00a-4557-96f8-9042ddc8ed87", "comment": "Malware payload (STRRAT)", "value": "0c8eb62d4a48752cd0d3d22e8ef8dcac393b115e669ebba2d492dc254066deda8408cfbfbf4103f4d78cbda2b2e8a03f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633333845, "uuid": "ae74205d-0586-4463-a324-002a22293d0c", "value": "T1EFA3CF6FBDE9C8B8D0079436504A8A22A78D059CE05E953FF6FC049A7CB4D2C4725B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633333845, "uuid": "444207da-18d5-4e5f-8375-e7c31daf0a87", "value": "3072:W1ugSIpJlEYiuzgd5wfe8/qoYwLJdRjatMFrzq:d2JlEYiZwW8/qqNdRjaitzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633333845, "uuid": "7fab5160-1aee-4eae-8d29-1719a899526e", "value": 106128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633333845, "uuid": "a28778c6-615a-453c-b621-0231134801ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633333845, "uuid": "3ab02c31-91eb-4d00-afce-20dbd1a4b097", "value": "dataURI-1633317718912.jpg.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6502205-2502-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633345465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345465, "uuid": "ce177f34-9692-4b97-a64b-dd97e5e733df", "comment": "Malware payload (AgentTesla)", "value": "6b88054dd9f2382536894d1775a4b7ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345465, "uuid": "459ca98e-f9da-47d7-8020-15de5757c64c", "comment": "Malware payload (AgentTesla)", "value": "282d6681e5e1304bd29f09402203553e6d0ec03a4c9a55496bf6f6f7a8efae01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345465, "uuid": "3dca1859-cab0-486f-bccf-d8a5fd7091d4", "comment": "Malware payload (AgentTesla)", "value": "1c8d6a76cb1510ab38181ffa502a26cf313a638a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345465, "uuid": "3f2a1d0d-204e-4947-89a1-28481a3b7706", "comment": "Malware payload (AgentTesla)", "value": "e1619a7364f1bc34002737622717df3b85b136c09e9d9a02608655bef3faf94ab206f5ef45cc28ad14b06ec719a0bf75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345465, "uuid": "3bd9fb2c-da76-48cf-8c60-acc84d7b53c1", "value": "T16E64BE457799EAA5E18848753502EBA381507C7D4A2FE407F3C0375F3939ACE9A22F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345465, "uuid": "c89617ad-5701-4c49-83bc-d9906a172553", "value": "2c58cc87277520c45be866d28ef20045", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345465, "uuid": "71d1940c-e4e6-4792-91ab-96309081aa04", "value": "6144:eT3ZmAlmZejWqsD8WckiF3KRknTkGs5PLYgg2H388J9BiaMq:9n8WqG0vF9Y6C3T9Br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345465, "uuid": "f1254b21-f637-46d7-bdba-8f4d6569e887", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345465, "uuid": "04d0f3f6-0a4a-4e53-aea6-a0ae34b4617d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345465, "uuid": "31a04892-ba08-4b3a-ab77-bd2331e4974d", "value": "mann.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92bbc5f-24ec-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1633336021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336021, "uuid": "5c6fe519-3a1c-4f82-9de0-c301299e6bec", "comment": "Malware payload (XpertRAT)", "value": "4ef6b1fa16f352e1969080579b832ee3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336021, "uuid": "fe47a75c-4679-4a5c-96c4-35d7a6bb7ba8", "comment": "Malware payload (XpertRAT)", "value": "29327d8089389d96e7ae1abcbd7c300ab587c59fa5841b748ef47e279d0c526b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336021, "uuid": "cb3620e7-5773-4928-8356-9a7f64e585b5", "comment": "Malware payload (XpertRAT)", "value": "d4b85b188ad50ef69c1a238b979a1db7f0d4970d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336021, "uuid": "ce82a825-92b1-449d-9032-0e519a71f95c", "comment": "Malware payload (XpertRAT)", "value": "866a442bf1b8c4a25e375c30f0fe21da8a28b07cf29ed996004c63ccbb7c35e07c0049050922cddb3bf745a581a497ae", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336021, "uuid": "0fa3d1c6-f69e-4fdb-a976-47f83ad4cb67", "value": "T1B1C4AFD458DA80A6B98105DDD9C0F44D9820FED1355FDE28C7AECC73AE596F8AEC408B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336021, "uuid": "562afecf-20b1-4397-96ba-4a576a5274a6", "value": "12288:X////////////////////////////////////+dzFHRsU0:0RsU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633336021, "uuid": "c5342a04-5d0c-419c-8151-f8d46af91a14", "value": 548271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633336021, "uuid": "036aecfa-f75c-404d-acf6-751a4ea2777c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336021, "uuid": "4f5e93d1-6bc2-4197-b6a9-d9cec7abcb87", "value": "Inq PO-000202120741.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30be91cf-24da-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633328008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328008, "uuid": "03efe863-b087-4443-b087-48f17de37661", "comment": "Malware payload (RedLineStealer)", "value": "0774bcc9576feb72e4f02fffa6d0a52a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328008, "uuid": "adf9059b-fc14-4efb-a4fe-8bb2fd821069", "comment": "Malware payload (RedLineStealer)", "value": "29c5c275e47a1a894fd7f8b068a74f164763b6eeb6bddfc19b641320f381049d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328008, "uuid": "ef35d07f-3473-43bc-9239-687d691307d8", "comment": "Malware payload (RedLineStealer)", "value": "d3ff6ea86d8eb2a6f3a334fd050e2ddc7875a7cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328008, "uuid": "7ec48de5-6a86-4430-9d27-1b77a22d13ad", "comment": "Malware payload (RedLineStealer)", "value": "ce318ba653cb2ea8293fd1ab4b1e9fa00bdeeb668959ab85783604ffdaa6eca1ab9b781f1d04e752d8c26257e25466a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328008, "uuid": "3837a263-e0f5-4318-a64b-a52788ad92be", "value": "T11C23E1B3476A4DB4D86A463185769360C7B7F320CDE6EEAF5DB080076DA775042B3B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328008, "uuid": "9a4c0700-a82c-4e00-82bf-0d1715ce6e78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328008, "uuid": "fb9b5fd3-ce4a-4463-9a8e-51f4b3899ce2", "value": "768:bJ7+frwFO3Xkn4AavgOG7ZMa2Ug7Db6Saqp9LX2VSWGwJ5Iqd3F:N+j0O3bAQEO/GqISWGO5Iqd3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328008, "uuid": "0ca29d8c-7a4b-4b43-8438-8cb5b124b1e9", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328008, "uuid": "38bd687c-1b94-412d-9895-fef0a30c09d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328008, "uuid": "8469ac50-892a-4534-b299-88163ced1a05", "value": "Saloni_0734,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf269a1f-24ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633308517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308517, "uuid": "52b1fa1b-f9e2-4d6d-bdab-b742c1e3f496", "comment": "Malware payload (Gafgyt)", "value": "46785f89301f885f2628de43f99f4b78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308517, "uuid": "3fffd00a-44a9-4797-a0e8-8e681ce2d0fa", "comment": "Malware payload (Gafgyt)", "value": "2a11cc538dc2ba1aed6f0995d34e5423abd53f881a3bbeac85e36077cde3f69b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308517, "uuid": "0b2b4119-fe0a-4c33-94db-86b18db5c979", "comment": "Malware payload (Gafgyt)", "value": "91c9fd18191bc12665a0e93735a1e97c20ba6dd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308517, "uuid": "3c76d4de-59b3-4ad8-8631-23c82a3d2249", "comment": "Malware payload (Gafgyt)", "value": "18b672c2bb3fe1eb77ad43aa7d067f640ef677afe46a6b31fafc8133a622fc2b811a2ea76888846ef50f0b99965e82b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308517, "uuid": "9efa2ac2-a353-4add-978f-20dff490b924", "value": "T16BC3F730E8044B2BC2C227F6E75A469E3F351E9797E733115638B9B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308517, "uuid": "ab72beb9-38b6-4247-8e49-76da648c728e", "value": "3072:7jV61VXVlCH01BDgg/ubKlOwiumP46aQyfPlnesNb:l0DlClg/ubufmP46aQyfPlnesNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308517, "uuid": "394194f5-95b5-4b53-97d1-b3872df32ed1", "value": 129897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308517, "uuid": "bf82cafb-8951-4e2e-a5a1-f94ab8048f59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308517, "uuid": "386c9e3d-76d5-421c-a238-efb1b01871dd", "value": "46785f89301f885f2628de43f99f4b78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d958ea08-24ac-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633308534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308534, "uuid": "e46d957e-4876-4a8c-bc59-ba190ea94384", "comment": "Malware payload (RedLineStealer)", "value": "ce2d443139a660f135b2a9a721dd71af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308534, "uuid": "0fbd9820-cdd5-4505-99e1-3fd01aff217b", "comment": "Malware payload (RedLineStealer)", "value": "2acb4c85d29625922f70b618144eb81f4427998aa52c06e2130527972a8bc0bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308534, "uuid": "f23f2fc4-93d7-4b37-bdd2-69ccfbc86966", "comment": "Malware payload (RedLineStealer)", "value": "06dcd33b64d5e9d0f2a036d78d328446fcc2b24e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308534, "uuid": "84205a84-424b-44dc-adae-c54e78ff2ee9", "comment": "Malware payload (RedLineStealer)", "value": "1932b1d5fd5351589c328898f8760b7a03655862a4525e48e2583ebeaefa4b6ac724dc3286f4b9c5c43b5e5eed9691ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308534, "uuid": "97797f39-bd0d-4a78-af14-a7ecc8f66105", "value": "T14784E0097280CBF2D7751131AB16C7E0092DBC6C6C1A664F6B98273E5FFB7D19A22B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308534, "uuid": "170441cd-e9bd-43f5-ba2e-e48a6079bcfb", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308534, "uuid": "d2c04754-1c55-46c0-bda6-e5798e4b3563", "value": "6144:BIJM2/cLI84crzz34igmOficBBDO3Yw3XDBpfk87gCUgMROhxxpeTr/ekI:CMlF4cj34igmOlBBDOPDvr71zxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308534, "uuid": "8f33cf82-c9da-437f-a7a9-bfe7437cfbb4", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308534, "uuid": "72625066-4694-41de-8b8c-bf8c3262e5e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308534, "uuid": "cfe4b807-f882-40ff-8612-e0e6f6f51335", "value": "SecuriteInfo.com.Variant.Fragtor.28226.23024.18119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70519706-24af-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633309646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309646, "uuid": "cec9d943-5c20-46d9-bae9-bbc255baef8a", "comment": "Malware payload (Gafgyt)", "value": "301737a2aeb753b2a846d2d28eceebd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309646, "uuid": "f745f40a-ef1f-4ab4-a6e6-a9cfff006545", "comment": "Malware payload (Gafgyt)", "value": "2b8c9ccf57031831c130f9e025be529ad9fbe957d5c9af3060f9a7807a5a9d59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309646, "uuid": "9bab821e-21a4-43e4-b205-749c97150177", "comment": "Malware payload (Gafgyt)", "value": "535ca628c7fbd701790d9dbdd5d75ad35e57507a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309646, "uuid": "d7f814c3-21d9-475b-bdd8-fe92808da17c", "comment": "Malware payload (Gafgyt)", "value": "b97d3b4d40faa02fd96700536ae111b288c534018aaa0753c150ac4cc58298404564d8d0a99477381cef14c8d86648d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309646, "uuid": "be3f1efd-c9aa-44d8-bacb-85f363dd5e5e", "value": "T151C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309646, "uuid": "a262e251-c999-4f42-af90-01f9b92e7d70", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Ep6+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8E0+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633309646, "uuid": "714cdb77-87c5-4737-b3b2-79dd032fce28", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633309646, "uuid": "6dcb34d3-34e6-4ef8-a435-699dc0cc29a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309646, "uuid": "bae587da-5059-4807-b64d-3c99b6ecae81", "value": "301737a2aeb753b2a846d2d28eceebd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4077c30b-24f2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633338342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338342, "uuid": "1317afe3-2ca6-424d-86a0-3bbfd11f4fa6", "comment": "Malware payload (RaccoonStealer)", "value": "1f3515db0d5b5eb92ca2ae7eb52eecf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338342, "uuid": "bce76986-f48c-4f56-98ed-ee26e2ec687e", "comment": "Malware payload (RaccoonStealer)", "value": "2d6599174555c52c6ef25cfcaca155a7288a183972a944e6e22a1de4de85cbcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338342, "uuid": "7dc49577-1f62-49c4-afdf-bcada7dcd5d4", "comment": "Malware payload (RaccoonStealer)", "value": "3df3869fcce57e767d79b99300b17b2546335efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338342, "uuid": "6534ee63-f548-4649-8fce-8895dc81eb9d", "comment": "Malware payload (RaccoonStealer)", "value": "3c94c92a3229d1efe3f39106a57c48c5adc1d08ee9cf7538bd51db59b3a07833bd269bdf6805aca576c4c523ad7d0c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338342, "uuid": "b01a5f9e-4553-4154-81ec-40a2ce6c1bed", "value": "T1AAC40115F1A3D7F1D67241B1A7A6C7F8096DBC5C0A66468F2B94271E2F383D1932223E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338342, "uuid": "06814742-8fa7-4f3b-aae7-3373c21901aa", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338342, "uuid": "5a311805-f568-4325-b958-5328a8418d56", "value": "12288:YatDjNKZkzPZ0vXMIGG6XRzxopqlGvesr0+Szxp6L:YUDjNHx2XDOB6UlOvi36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338342, "uuid": "2026eb07-e7a9-4a34-8e43-cc741b98eb8d", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338342, "uuid": "abcc93c4-283a-4d37-86a0-8e84984e768c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338342, "uuid": "34bf0932-3bad-4f82-853a-fbcf54f4d53b", "value": "1f3515db0d5b5eb92ca2ae7eb52eecf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828f486b-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633348331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348331, "uuid": "c3d3f0e1-101c-436e-b525-a6d61b77d482", "comment": "Malware payload (AgentTesla)", "value": "4227523bfefb1d350aa3935ce4b89dfc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348331, "uuid": "3ba60b7a-f890-4bcd-a3b4-1f55b29fd348", "comment": "Malware payload (AgentTesla)", "value": "2e193e5bdb8c96b567f65f85cc77a6e334947b09ab081684adfecdd70c3d3c17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348331, "uuid": "bff3e694-d016-4293-94d5-99ee2e92bd73", "comment": "Malware payload (AgentTesla)", "value": "e0aaed432eaf6e8fd0cca472f49dc1b6940f72af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348331, "uuid": "e2ebf3b0-48f7-4a41-a6c8-435084d54cf3", "comment": "Malware payload (AgentTesla)", "value": "a3ab9fee84facdaa688c04512b1b83d1af390b8b0c2fa2181b08e62bc36632f6927dd8b546ef1e25317fcc95ad9606a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348331, "uuid": "6c32ae9c-92b2-43b0-a179-ce1d187b35fa", "value": "T10F94026863779304DE25C3F92C24A361177AB536206EC7389ED8E4ED3E63B745AE0943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348331, "uuid": "2797e55e-610a-45b6-84d1-f40a783ac4ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348331, "uuid": "ef94d2dd-c8ef-4742-ab6c-ec9338c62567", "value": "12288:nESoqWR5B4zatMiORZzWlQCIAhtnbfTSn:nESUR5Jty3uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348331, "uuid": "2718b1f8-31f3-4aec-9128-58c557047aa0", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348331, "uuid": "810ac6db-eb59-4d25-b206-a72c1b09fd2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348331, "uuid": "520ce0e8-8f2a-407a-bd9f-60896346df64", "value": "bSOKLMvDDDF83Ya.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12b71b7-24ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633309379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309379, "uuid": "a59dce27-cb7e-40ba-a659-92d04fe27419", "comment": "Malware payload (Gafgyt)", "value": "636aa23955c56f5a7b10e330dbd366fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309379, "uuid": "68567ef4-d213-485b-8f86-42b9eaad1407", "comment": "Malware payload (Gafgyt)", "value": "2e1bf4f04246ba25255b72d476d4c7d8dc6d2e915a93aa89b4806696b958bd04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309379, "uuid": "d23cd9d5-d93c-40c2-8c27-cd43933d4f1f", "comment": "Malware payload (Gafgyt)", "value": "832aa02320ec476b0f1b3bfc7eb1e841da40a87d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309379, "uuid": "254e3853-d6b9-4557-be74-9eb88025da54", "comment": "Malware payload (Gafgyt)", "value": "d4f9ada4b6037242f7eddb71b14dc742b250c9de9b210476974ff6503f537575070a4264ec1a19b902bde83a7aea7984", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309379, "uuid": "4d772624-73de-4e49-97b6-0a62403902a9", "value": "T1D3B31977A4654F73C045A5F125BA9A310F12AD931B1F1A88673CB6B04B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309379, "uuid": "1be2cfde-b605-4ac3-ace0-58fe55b72530", "value": "3072:sDVLSItZbxXQxIJRtmoa+pVrmH1cuEgvP6uN/:sDV+ItZqGJmoa+TrmH1cuEgvP6uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633309379, "uuid": "0438a29d-1c70-445b-b35e-0e5874019118", "value": 112632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633309379, "uuid": "e07ac42d-f822-4f24-92b5-ff4ecb0eb87d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309379, "uuid": "4b72f62f-3aef-4aa6-8253-bf1df908d79c", "value": "636aa23955c56f5a7b10e330dbd366fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab665303-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633360855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360855, "uuid": "d893127f-c556-4d9e-8de4-e4ea330f28c2", "comment": "Malware payload (RaccoonStealer)", "value": "50fcaf9cd15957f0c6fcd5e9c102ab76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360855, "uuid": "819804fd-3daf-4813-86fc-7d32f6d62364", "comment": "Malware payload (RaccoonStealer)", "value": "2e540a83e8b9b88316cf6a39f1da5ed9f397a760a9aac59725487e31e903c0a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360855, "uuid": "46337977-a792-4611-a3f0-b598a1b21ca9", "comment": "Malware payload (RaccoonStealer)", "value": "517d500ceb7294e854dc34c5f376de54305d32eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360855, "uuid": "31b20e11-1b87-4eb6-8c2b-a609d10cc865", "comment": "Malware payload (RaccoonStealer)", "value": "4a90a95f0568698acf0e6149c46519c32e652db463476a30b3bdbb7bf76cbbdab8a0e94676c245a0bdb452c3c6f2d94d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360855, "uuid": "4204cda4-0b40-4305-8a5a-32941dd58c1e", "value": "T159449D0931A0D7F3D77A05706BAEC7F0693DBC6C0D65524F27A8271E2E38391962D27A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360855, "uuid": "eaea5bcd-ec6a-4995-90e9-bb50f3b42e07", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360855, "uuid": "c8140f6f-e31f-44fc-915d-101911be6460", "value": "6144:IfYWR5BgBYiEoVoFEEeSygROhxxpeTr/ekI:fW1P66SSylzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360855, "uuid": "413f3236-b7d5-445e-a356-312e12c14982", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360855, "uuid": "7c7b1da5-6bd3-45f5-8c54-3b030ed5e453", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360855, "uuid": "343ad02c-2f8a-424e-a444-f3103d7be20b", "value": "50fcaf9cd15957f0c6fcd5e9c102ab76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745a8ffc-2520-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633358186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358186, "uuid": "390e53b9-6d5d-42b3-bc63-af2fa33503f3", "comment": "Malware payload (AgentTesla)", "value": "8598f9db43ffa26ef5d4e26e2793bf36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358186, "uuid": "ba3195d7-593d-423e-8af5-e21847764c91", "comment": "Malware payload (AgentTesla)", "value": "2f3f08790bef60753db358cd534349a59a4d5d4dbd56f1d19e9e678bdc5f07c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358186, "uuid": "cc3e2b20-73f7-4c20-a0b5-d909994fbcd9", "comment": "Malware payload (AgentTesla)", "value": "1e8648512a0f602b1aaee31c3b4b9650d2d48d62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358186, "uuid": "94ec2ff0-f2d4-4d80-86dc-9a8d006c463c", "comment": "Malware payload (AgentTesla)", "value": "ca5fdd33ccdf02a86693924b2f8ef7700fd442b60bc4917a03355154c7cc7085ccafaea31979184b299bad14aaecef76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358186, "uuid": "902cfdb4-8d14-4f2f-854d-323b5a27cd60", "value": "T130159738ED0B21BBEBA6D334E4BA550AA5F418BB33349D5EC192774D090760374DA3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358186, "uuid": "f570b91a-86eb-4e8e-95e4-e00976cf2f5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358186, "uuid": "a5b12d3e-e1b0-4812-91e5-4559dc02acf5", "value": "6144:Ny87fViis7lBGNOBBczAhQAQFJUK+Iv4Xj4Bc8IQUPQIFM4BFYrg+TGTHybkyVeS:sBS3DJvJg4Bc8IDhu4BF/R05WLjhPj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633358186, "uuid": "969657e6-482e-4015-9b1b-f765b4587ba2", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633358186, "uuid": "fcfa7007-91dd-4f74-8245-b83e8905c31e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358186, "uuid": "58fd06b6-02b0-4343-89cd-62b614df622a", "value": "rem_34432_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f7dbd2-2505-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633346760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346760, "uuid": "60a706ec-041e-4b03-a0bc-5b496d8719d3", "comment": "Malware payload (RedLineStealer)", "value": "a76e2cdba762de201e0668178b03bec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346760, "uuid": "15aee9c1-5f46-4d58-a007-05da4635a3a6", "comment": "Malware payload (RedLineStealer)", "value": "2fd9985380a92fa918df25189e1023c27052355dc1c7f8a2d11339be7ddfc7d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346760, "uuid": "f7af61c2-4c57-41c9-83d8-2cee5b998c9a", "comment": "Malware payload (RedLineStealer)", "value": "4068065df0d806c05b1bd6138bdb32f483c816a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346760, "uuid": "5576862b-1674-44eb-941f-bdb9e918c7cc", "comment": "Malware payload (RedLineStealer)", "value": "be865100f4cb963d9dbe6cd10b453cdfc7f5ee7f22975e7c7c8120a9631b797880f58ae842d02761f074429aeb160057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346760, "uuid": "bd453b9e-425a-490a-b78a-89464e888fb9", "value": "T1BBC33B3553DC8A28EBFE1F75B071120047F0D1CB6512EB5B9EC26CEA5E73B825A512E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346760, "uuid": "6b99fb97-dba0-4656-8c30-ae2b85de3276", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346760, "uuid": "e9dcd89a-fbe4-49d9-b03f-fae4fbcc69fc", "value": "1536:5e1zHb1iaNk5mXKSr7y9zjbuRNdsnhuyq/dMV1dbknEjG6qTaoigNK:0S0X7y978snYyOdM9kEW9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633346760, "uuid": "92613959-60ca-4aaf-80e4-e01ee5692e69", "value": 119016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633346760, "uuid": "7b22959f-fd02-4362-98ae-ed0cb7536558", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346760, "uuid": "170ac9c7-7401-4d1c-a47b-04afe6b5ae5d", "value": "a76e2cdba762de201e0668178b03bec4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2705d46d-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633354620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354620, "uuid": "5a99fa5f-3dda-49a9-b4cd-cf6fdc253725", "comment": "Malware payload (SnakeKeylogger)", "value": "4bfcf5d77051e617d4c086515ce768d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354620, "uuid": "f5013665-a15c-4079-9b02-1658305dfefd", "comment": "Malware payload (SnakeKeylogger)", "value": "31e043b30bab7ee511f1f901f7aa6e7db51a1db905e005ad12116a56f9410490", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354620, "uuid": "24d729fd-7e12-4dab-b7df-3d3971fb2b1c", "comment": "Malware payload (SnakeKeylogger)", "value": "e57421be64de4dc39e4d222a5a3c09cc558272c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354620, "uuid": "06f2f2a8-0c09-4a92-80c8-edbf4127abc9", "comment": "Malware payload (SnakeKeylogger)", "value": "a8202c49cab7442d1a986db5fe4df9ff7ef60fe75981bdaab8d220031e9d3762cec4b36ac359a574bf5b656f30b8854a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354620, "uuid": "0f724b06-cfac-471e-90bf-71e99fd94adf", "value": "T12374E0A963639388DD3987F12C34AA5107BA7C2D246CD37C1E98B0E97EB37B145E0947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354620, "uuid": "fbde8a52-79dc-4a12-93b4-77838cde75c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354620, "uuid": "17638e98-f060-4476-9d42-9f91000b8170", "value": "6144:atp9ERQ+3HwOEf1K2BUw8KVU78O0XxEQLCdggtQKnf3ctUzSrzIKE0:cESoSK2BH8KV++B+FtQKffSfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354620, "uuid": "e232737b-a832-4387-99b8-0cca330b578e", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354620, "uuid": "8fefe627-f63a-457e-aac0-725c75aea113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354620, "uuid": "ced4d275-4ea4-4515-9cbd-cdaa162f2d3a", "value": "Order 4102021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9cc808-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633343276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343276, "uuid": "56161ca1-fcd9-4f73-bdd5-bcfb835409a2", "comment": "Malware payload (RedLineStealer)", "value": "b153fb7e3c389ea77b489faf835b11f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343276, "uuid": "1ab3335a-5a22-4544-a84a-68d26e05bee5", "comment": "Malware payload (RedLineStealer)", "value": "3204893e4ca6c06b774a07b92f9a021fc073f2c630d0a62ecb2efeaeacc89556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343276, "uuid": "e4ce23e3-df28-4015-b03c-f6756c347a43", "comment": "Malware payload (RedLineStealer)", "value": "aa9c8e45872597171e5ba21da6111b612ff51c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343276, "uuid": "7384394e-0db7-44ae-9ce5-e782acdc7b16", "comment": "Malware payload (RedLineStealer)", "value": "6e4fa291588866912df7d11b4defa15df83d2d802aa233ceb7461cb4214fa4d03d33175740e1c9b69b9dc535602db8c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343276, "uuid": "349f5ed2-c836-43cb-b50b-affe6e710d4b", "value": "T12884D0083590CBF2EE710132BB36C7F1452DBC5D5C6A568B7B942B3E9E39381961235E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343276, "uuid": "570ef42e-d903-4dda-88d9-112ff317e7b6", "value": "7c0ea9b9018530ea377f1e33dcfa32b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343276, "uuid": "a630f804-0044-424b-9652-a325307ff3ff", "value": "6144:VebmkXPWL7gBOAgaCdCTeVMMF1+k05feCRdE9yEcZ0gsnAPROhxxpeTr/ekI:Vke4BOAg1Cxs1ihrdjEcZ0gyAUzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343276, "uuid": "13de3565-3878-4a6c-bd5a-cc261d7e6501", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343276, "uuid": "d3caef54-5d32-4356-bcb1-f40033cbffff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343276, "uuid": "8f9eaf8b-98c0-471e-ada0-64d2b5bc1f21", "value": "b153fb7e3c389ea77b489faf835b11f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6c9802-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633348479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348479, "uuid": "b99f056a-5af4-4223-a231-c2a99553a074", "comment": "Malware payload (Formbook)", "value": "caf8c91acac193cd05bc111d59a99fb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348479, "uuid": "c4d7f84d-a28b-4a08-b63e-762a3ce576a8", "comment": "Malware payload (Formbook)", "value": "339d247c2996138c0c008480587b435f7d2e54267288c6bee353746062314cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348479, "uuid": "212852db-4f9a-4568-b5f5-cf971e28662f", "comment": "Malware payload (Formbook)", "value": "d583c07a10cdc477d79c7dfb57b4b1787c8af152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348479, "uuid": "cee30e15-8323-4ca6-8a6d-11433ce2d83f", "comment": "Malware payload (Formbook)", "value": "3ff2cec28f00b8546c9563c74415d8bf179a8e07d3426ddb6450058e628e97dfa8ffe5687d3981d145ec4ee58fbc7ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348479, "uuid": "8acb58d4-1984-4397-b2b0-a06fe85201bd", "value": "T14B14E9203F1C0795C4C94F73ED065B6B8EBF19AB3A396E04B7809EB835532D796C5988", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348479, "uuid": "8a8c9bfa-fbba-4650-a0ea-7cd21c9f3fbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348479, "uuid": "1eb66c98-b793-4fa8-b389-ee763f988c0d", "value": "1536:psKuytw9LsKV9WKKKqyVl/5gsU3twtQuIIncKklZ0zsVKmxwx6VT+kBara:pZEsKV1KEVlZitwtQuVnzsVWx6VTYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348479, "uuid": "773ced4f-8217-481a-8b80-6ede12bacd14", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348479, "uuid": "5ae3e755-46bd-4527-9330-2cdeaaf807aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348479, "uuid": "6dd71d9a-91e8-474e-9d5a-4ba56c68171d", "value": "Emask230921doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6736ba-24d3-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633325321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325321, "uuid": "97faa9b6-5149-41eb-a1cb-f64d3121c43e", "comment": "Malware payload (TrickBot)", "value": "5081001980f7010cfc96b13d7c3392b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325321, "uuid": "0c195895-d69a-4faa-ba94-b735f7d602e4", "comment": "Malware payload (TrickBot)", "value": "352d86804166a32518de61db00a237676320341959d212ac02ec574f56f0ef12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325321, "uuid": "bd8b7630-26da-45dc-be72-2a2ade4dcb2e", "comment": "Malware payload (TrickBot)", "value": "70c670c92758acb0b2434eb39f92aa299d69ba9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325321, "uuid": "617631cc-4963-467a-8231-dd57d5a127ac", "comment": "Malware payload (TrickBot)", "value": "c827cb086d1238d8d48a34d84f558fd964210d1e2334b3cbc2af04a9ce6ddbba4249c87befeb82ad2ed7390069846842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325321, "uuid": "fe33fba4-781d-49f1-8b6b-113e1629c5d2", "value": "T1D594E02236F0D877D16715309FE59BBCBABAF9104F724A4F33880B0E1D31A525A26776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325321, "uuid": "35d09c6f-73ff-4734-b54d-fd73c3440e49", "value": "220580f49c2724e661575b7bf3bd58ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325321, "uuid": "c4906ac6-e979-4819-ae38-432594c24823", "value": "6144:wkdJN4c+ePGc6r1tJ3VQl/XE3dAPr3x7835OPeFPQimA6Vk58qVEb9pE:wkdJLbPEtlCl/XIIx/lbVMlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633325321, "uuid": "2d82b0a2-f3f4-4ea4-beff-2f6f9e58b431", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633325321, "uuid": "aae6510e-dceb-41a6-aa5d-c1b34ed2a53a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325321, "uuid": "cd2b73ae-23e9-44c6-9502-0735716cc8df", "value": "5081001980f7010cfc96b13d7c3392b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133f262e-24e6-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633333112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633333112, "uuid": "51ca201e-c349-423d-834b-a6812677594d", "comment": "Malware payload (Loki)", "value": "d3222e254e6334f50f5abc766bb12514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633333112, "uuid": "17858c0f-e6f9-4bf2-91e2-f796416d4ce6", "comment": "Malware payload (Loki)", "value": "354e0aadf9872237b4ab76f7f3706a0515dfa38a5c8d65a90193144613ea7901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633333112, "uuid": "e733d5fd-10fa-4cb3-9d0a-9a11728cd5bb", "comment": "Malware payload (Loki)", "value": "0bdcd605c4b77eeee912f9ea1d3c025437ba73a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633333112, "uuid": "1cd6d63c-cf98-44fb-bfd4-df5614d0d6bd", "comment": "Malware payload (Loki)", "value": "11c8882c21f2053849cb5d31ec10e6258d1e00248a4e298ae80354f16e549ed638714898967cff126dd4f9767ba39f5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633333112, "uuid": "eba7b522-cbc2-47f0-9f59-479262c29434", "value": "T1D2B4E19C23AB9640FDBE87F9BC7490904BB2B4271516C73C5E9064ED1C737E48AA4B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633333112, "uuid": "02c96214-5dd1-4d8d-adca-0f7977cac1a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633333112, "uuid": "843cabf8-31f6-469b-9314-684711e299de", "value": "12288:Kcgo5W5zIFp3ZDCB4q+k9uodiunyJT6YashlM0JT6YashlM:bgwfnzq+Sur9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633333112, "uuid": "a5604ba7-3304-416c-aa0b-7b4ed11b4052", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633333112, "uuid": "8aa6f97c-26c0-4c98-8536-19ea5eb2e55d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633333112, "uuid": "253cdb34-85ba-4da6-95af-bb578d926b0c", "value": "Updated SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5291af9-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633338940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338940, "uuid": "a59413b1-8187-4aba-ba6e-c865c4343e76", "comment": "Malware payload (RaccoonStealer)", "value": "557344f4616197ded5b6feaedcd2e749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338940, "uuid": "01f8a34f-90a6-4846-b556-d9683accd73a", "comment": "Malware payload (RaccoonStealer)", "value": "354efc97e4a680e6b6fceb03d31ead926205efda8d5e0f28abe1c3381aa1991a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338940, "uuid": "04f9e110-8863-4abd-8b5f-2bfe2cb84317", "comment": "Malware payload (RaccoonStealer)", "value": "39de80375325e1184b5631bedd011f06a4c6aace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338940, "uuid": "9a4e4ff0-ccb9-4601-ba1e-9f381419dd13", "comment": "Malware payload (RaccoonStealer)", "value": "56145d35ece768f3533a64948b7bf0f141c8209210722d8ebc60b98bb63317e23dd741ae8f394eef1a6016d52017beb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338940, "uuid": "613ef935-2244-4014-8f36-0a5389599d3c", "value": "T1FEC4F10931A0DBF2E5B25BB1A726C7F4096EBC690DE555CBBB88271E2E3C3D1C721251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338940, "uuid": "423f3a48-566b-4425-bc57-af9b58f49ae7", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338940, "uuid": "f17b8681-3cc8-4431-bf3e-b10e9a48b8f4", "value": "6144:bJS28cORbZ0aMUHOv5vJE4RIW9ewd95WeqZ3LPoa8XoOEe8vNiIFYTLCv5nzVGny:E2DEZ0MuxPx9d38nODciIK/UNzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338940, "uuid": "257a918d-337d-4940-afe8-b502c061e126", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338940, "uuid": "73d377ca-77fa-46e6-b9ae-29b5f356d1c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338940, "uuid": "8c77221b-8b8f-456d-84d3-a5a7dd48c025", "value": "557344f4616197ded5b6feaedcd2e749.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84a6791-252d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633363991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363991, "uuid": "2c18088f-eb63-475a-b826-1e0c312d0f5b", "comment": "Malware payload", "value": "249a1f3649a9ac61a5eda41c87a57f25", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363991, "uuid": "5ade3e25-91c0-44ed-979e-5d06003a7b76", "comment": "Malware payload", "value": "3665bc607e783acc3dbba5b4fee2ba6ce825ca1c2ac188120ac25c7b6ae06632", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363991, "uuid": "13169fbb-ce8a-423d-8d00-0ff83ac9c70a", "comment": "Malware payload", "value": "96261ed77520b994eb8ff3090ede7adb1643c305", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363991, "uuid": "84b98c78-d160-4640-b96a-3bb9721c3428", "comment": "Malware payload", "value": "9b9422148843ddb1bdf57ba766ccb0d94aef5357ea95a2052a9fd590760ee7b2b01e59d6863b1d21509baa8cf90dfc7a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363991, "uuid": "eca2c6c1-387e-4b8a-a1b4-681d5eefa45e", "value": "T11B43F80573CB4375C9BC16BAD5E306A003F2E7472273EF493DC8D1A54E523989E96BA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363991, "uuid": "06ab1533-550c-4e40-89eb-6958d222a090", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363991, "uuid": "1bdca796-2f61-4905-8bcc-5f1ad7d51d8c", "value": "1536:0PzGEqKIm0kUoVry1YEEH15FRt7/l3/NmTo:QzGEqKIm0kUoVrUrEfvt7/l/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363991, "uuid": "b0a1854b-ea8c-411b-b86f-bbace58914e7", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363991, "uuid": "dc2fd923-32c1-4037-b734-064b6bab22ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363991, "uuid": "4338ae64-bec1-4bbb-9dfa-d7057ce6a293", "value": "249a1f3649a9ac61a5eda41c87a57f25.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92c49b9-2517-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354409, "uuid": "0a08bcdf-9d52-4b9a-9f5a-6ddf8dbf68fe", "comment": "Malware payload (AgentTesla)", "value": "93fa9615b5b68cb4d4c85391fd1f3565", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354409, "uuid": "6f87483b-bd58-4b5d-9242-866da826009d", "comment": "Malware payload (AgentTesla)", "value": "37537b375b09bd2759267373a10103310975ecffdad8f00885b7be609d30c2b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354409, "uuid": "627b2d64-a7f6-4147-9928-e6ec54ccc086", "comment": "Malware payload (AgentTesla)", "value": "c8219c359f1f39fdb02e35280999176cce48f2d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354409, "uuid": "5b9a969b-cdca-4372-83c5-7444966f1caa", "comment": "Malware payload (AgentTesla)", "value": "a3392ba65121ebc8bae01a67e5f9765d3d7fc4b1fb6a94cd2847af5964e9b1f1ce9ee6525fede02667481ac67c60892c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354409, "uuid": "fce28d37-8d1d-4718-a147-55b45ad108a7", "value": "T16B736D82F684E7B2C83C4636D45781821761BD6A9AC16FDB31CCF33A1893145C76AF7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354409, "uuid": "69e7ae0d-b877-4c82-a6e1-aa4abe5afdd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354409, "uuid": "e32ed7ee-98f8-43d1-87e9-33899fc20bbe", "value": "1536:AHN5u5fejAeXpmFM0pJAvckOXw72AtY4fAcU:AHNcfpesFM02BY4fS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354409, "uuid": "cf1d1c44-a646-468c-a37c-dd7a05aea5a3", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354409, "uuid": "b2e0b703-46a1-44e5-b860-ce659bf19ee4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354409, "uuid": "8c38a688-4f02-4277-bc43-de98c74afc53", "value": "Efectos_Navales_Corona,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd2ef67-24b9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633314098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314098, "uuid": "306868cf-ceee-47ca-bdd6-605de1d0902c", "comment": "Malware payload (Gafgyt)", "value": "792cda598d0858b5bc00a641c48af2f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314098, "uuid": "1b8add92-44d7-4351-af7d-dec6cb1d0c6d", "comment": "Malware payload (Gafgyt)", "value": "380adf4a61bbb985188f22026ef74f84676ae4b2302f230abb284706c00a26fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314098, "uuid": "34f9c8f8-e116-49eb-8ba0-2327387ca2da", "comment": "Malware payload (Gafgyt)", "value": "b3a8af35182b4ca31773c31a54a0d3a734ac584a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314098, "uuid": "6a33d4ba-afea-42db-b8a8-1e30b960af17", "comment": "Malware payload (Gafgyt)", "value": "fe78d76544d692b765655a38d79858e2beed923f8801ce79b7e30e4318287be464664a90d58020b5961549ed378726ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314098, "uuid": "92f1b2a6-e396-4121-965e-4a03bfc10b83", "value": "T127C3F82BBB270B23C0C6007116D71B32BEB5D3D935FA52976AE06DAC6F165843416FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314098, "uuid": "2273d2d9-d588-4cfb-b252-5c9e88b24ea4", "value": "3072:o3GN8mgKqzKFhTORcNcmKYFV/esFLfpZe:oW+ZeFhTORIcmKYFV/XFLfpZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633314098, "uuid": "5f92a9ad-5c44-4c22-a166-fea861b531e3", "value": 125918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633314098, "uuid": "e59b3da3-8642-42e5-aafe-29c7c93be1c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314098, "uuid": "ca52c3d3-070c-4ae6-8b20-21c9324a03d5", "value": "792cda598d0858b5bc00a641c48af2f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddee7bb9-24e2-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1633331734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633331734, "uuid": "67ef9b49-f207-4b61-9d8d-8f515c1a0a8f", "comment": "Malware payload (Tofsee)", "value": "3b48192c10cd25c7a7d5b78ec0f5d9d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633331734, "uuid": "218e5d18-affa-465f-a49d-81a3a722fc7c", "comment": "Malware payload (Tofsee)", "value": "38257c3d69782840c59666cffaa4b12af19a9e7c28834298ed55d201f59efe9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633331734, "uuid": "1a47beec-f687-46fb-868e-38225c2925ff", "comment": "Malware payload (Tofsee)", "value": "aa01cbf8afeb4f01fff51b6db7f412f53386ed16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633331734, "uuid": "d4870f36-e60f-44f3-a1fe-724e99244334", "comment": "Malware payload (Tofsee)", "value": "b2116e2df1c9ee37ea7fa5ad2962e4671aaa0004fe2c9b70ddc49eed363247e3fbb811c26a24c9c8421e6192110744a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633331734, "uuid": "a672c311-bc2c-41e5-bf0a-405fcc987776", "value": "T11944AE1931C0C7F2D7760174A796CBF00A2DBC6C8E5956BF2768275E5E38BF29231292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633331734, "uuid": "23e32917-2bf3-46a7-866a-03d2f590284d", "value": "ea6e9add4feec4142f4eaf80b256f47a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633331734, "uuid": "3218ed1b-1650-48b2-b3ce-ab7cecd50123", "value": "6144:89MqmzL2v3eid7L5EGcrl0ROhxxpeTr/ekI:HquSv3LdpMRzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633331734, "uuid": "84287800-10aa-4fd0-9220-1dda475c6935", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633331734, "uuid": "74adbfc3-ae7f-47c1-b0d7-5863676b910e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633331734, "uuid": "1364c5a0-e96d-42d5-b27c-2b0d2e42c4c2", "value": "3b48192c10cd25c7a7d5b78ec0f5d9d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824ffaef-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633347901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347901, "uuid": "7e569f0a-8a0b-48c6-b046-a069e6a3b95e", "comment": "Malware payload (GuLoader)", "value": "00afb74b4737c8488168a5423dda9800", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347901, "uuid": "e3205c06-f6e7-4e4c-bf63-f502cc837213", "comment": "Malware payload (GuLoader)", "value": "386fdb68955d82c9d1d15857b53efcc6157f2e29b1501266e05bcb5008b030a1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347901, "uuid": "c4a7ef29-506e-46a3-bee1-14ccd67d21bf", "comment": "Malware payload (GuLoader)", "value": "a81fc29731e8abb3518848817a5aac84461fea06", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347901, "uuid": "0ed66bbd-04f7-4c50-a9ec-ae5f17e9e8bd", "comment": "Malware payload (GuLoader)", "value": "7d3a70ac5ce37b1cc93178660f9b1366bd38976e25db13539c154b9220f25aeb07e5c63287072a4d2e7adbe9b8ed4727", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347901, "uuid": "a5ff1ab3-1db4-43b8-922c-598765e9b0db", "value": "T16B93E09FF232EDD7E06AD6B74B53E503B99DDE149134A82B363271A010BE3614508E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347901, "uuid": "78a0773b-6c97-4d56-91a8-5767982ca12f", "value": "1536:EypywvObzs6W4V3SH3u7IwpwGci+pMBkWqY72LvuPuurIbm/b9Zz7:Eypywmfsz4VqGhyWcLOnX/b9Zz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347901, "uuid": "cb2564ca-b595-4f15-b0bd-c789789bb823", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347901, "uuid": "483ea848-2457-4c30-a688-c3c758db64f2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347901, "uuid": "d0d846b3-16ae-4dc6-974b-c269192337d0", "value": "DHL Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c469fe-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633343097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343097, "uuid": "605d3b44-6aef-4b63-9198-cb00eacb7ba0", "comment": "Malware payload (Loki)", "value": "4c8c2cbbebfb23a7833b8be61fe1bd97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343097, "uuid": "284e227e-9696-4868-9f28-5b15a24c0ffa", "comment": "Malware payload (Loki)", "value": "38808b0c27c49a59ba6d0abf74102335bf7cc28539cd5732034d06d0911eeef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343097, "uuid": "c6f1a60c-faad-4f28-ae33-1f4f00fcc43e", "comment": "Malware payload (Loki)", "value": "be009e8a358527aec4dc5ce769e0df18c8223587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343097, "uuid": "087fb518-81b1-459c-8afc-2e6c68fa35da", "comment": "Malware payload (Loki)", "value": "d371d3959eb3501efb258897a8da02f9f9458417897e896851a27babc05a1b70f684a20ab24bf3d0c14dc622084c943c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343097, "uuid": "4623b9a3-825f-4ddf-a2c2-fc8e8b4f8bba", "value": "T18564E09A322B951BCDF995F43C94D29227B4802B215DC3B85DC8E5BD79D3BF909E0183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343097, "uuid": "b22be3c0-e5b4-4918-a6e0-589317368f37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343097, "uuid": "abfff41d-569b-4ddc-a4e6-3bb9586f9094", "value": "6144:a3+OvTMIjod6ggsxavZloY/BI7X8gIwDXK35Q+3HwOk42:a3+Ov4IkdLgseToYusgIwDHoz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343097, "uuid": "68cfab34-ae78-425a-9828-841090c81ac6", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343097, "uuid": "d2381d19-4c5e-4507-b4eb-62844a1915ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343097, "uuid": "22f87e11-c465-4990-8a37-4f49e907b8a1", "value": "4c8c2cbbebfb23a7833b8be61fe1bd97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c3ea83-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633363528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363528, "uuid": "09dd8746-fb01-4cf2-9d0a-bd62e4eaf099", "comment": "Malware payload (ArkeiStealer)", "value": "bdbabdcef9ef06e0160229bcc4f2aac0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363528, "uuid": "efe9d6c4-5132-466c-9f70-a6365650b1fa", "comment": "Malware payload (ArkeiStealer)", "value": "394646ca98b1e87a90aea239a5744eb08394fad75562f349d5c5ddb35776cb1c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363528, "uuid": "7f47b709-866f-4dc0-946a-ef78dd2a3be7", "comment": "Malware payload (ArkeiStealer)", "value": "ff462f101a6b2b5889d9ca06a079663e2f3333b0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363528, "uuid": "133a6179-2f7b-4de5-ba60-5520429087bb", "comment": "Malware payload (ArkeiStealer)", "value": "c34bd05c07c947f1eaca191f4c789843e49ee2205586524781ab95b2ef23f0d6120e8dead8889e3921f50e9b43b7e4a4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363528, "uuid": "0cb409b3-da9c-4147-afd4-3ae6a0c0de9f", "value": "T140F4020E75C1CBF2EB751231AB56E7F00A7EF89D5A26524F2B586B1E6E3C3D08615302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363528, "uuid": "dcf4bbea-5077-494c-a4fd-c7390b17c374", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363528, "uuid": "6262c49b-f1a7-4416-8222-b27c4c530df7", "value": "12288:IWa7nEuwewAobG3EMoc/WhYbhXdNjBu7PpnkMw22+dzxp6L:Ih7EuT2k7YqdtBOPpkMw22O36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363528, "uuid": "e29cf3d2-a569-4e89-8a2d-b6cfc3fd8c09", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363528, "uuid": "c9725875-296b-4be1-9d6f-5e8da3a2d718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363528, "uuid": "cf649c2e-faf7-4831-925a-d135473b7175", "value": "bdbabdcef9ef06e0160229bcc4f2aac0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e468c44e-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633335610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335610, "uuid": "fc55d1fa-b0a1-4902-a1aa-d9918d77ddfc", "comment": "Malware payload (a310Logger)", "value": "391d8025ebeb784e53f76c6536aa6fe6", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335610, "uuid": "cebb12bc-8017-4679-b7ad-082bd192e715", "comment": "Malware payload (a310Logger)", "value": "3a400fbdc47f573a48a5f3052b0b4e67614b27607232dc448d11acf15b6baf8e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335610, "uuid": "5d273e4b-b7cd-428f-bc4f-9f868728b7ab", "comment": "Malware payload (a310Logger)", "value": "e9ac084345ba307473cbcf82846e0fc4be8d26e6", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335610, "uuid": "d82236df-0ff0-45ab-8d64-300119124edf", "comment": "Malware payload (a310Logger)", "value": "63c26cd18dacdd94101bdc935d22a72783a41445e1d561293c0bdfacbf73dfabf39e6fc655ca903a73cae6ede4cbe9b7", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335610, "uuid": "30eb2db9-509e-4280-a57a-c282962e5fb5", "value": "T1F3942311A2E6DCC3D0D4663A1A7C5BBEE7BBC04243551603E3AE0F9875842D79B06FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335610, "uuid": "b2882c38-adbb-4164-85c5-4825671f1b41", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335610, "uuid": "c80908cc-e0e4-491f-9b60-4a2447aa65ca", "value": "6144:b8LxBBXsdAsRN+ciV3RGt+CgPq2ZvrnfIT6GcUYVo5DaXYuWwxR8FjoLGzxbecQU:ysNN+cilRTrfI2Z0s7hx6tzgBQs3ar7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335610, "uuid": "2e405e2e-84fe-4c87-81b0-bf2a803b4246", "value": 442826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335610, "uuid": "7470ce4c-1eeb-4de7-a6c5-f55ee985599b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335610, "uuid": "e6cf9a2c-36e2-418f-af26-fcc487048976", "value": "87654345670009876512345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1ca67d-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633347834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347834, "uuid": "2542702a-ec1e-48ca-bd1a-7f6ded3f5252", "comment": "Malware payload (AgentTesla)", "value": "48484c58c3e56cd49689cb83a0bd8525", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347834, "uuid": "186f615c-326f-4962-bac6-252e86f19d13", "comment": "Malware payload (AgentTesla)", "value": "3a535814023d01b99aec8e98e291a9e96dec22036f6ddf32155f47e5e4af93b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347834, "uuid": "751cecf9-e647-4be9-ab47-62c0a9aafe04", "comment": "Malware payload (AgentTesla)", "value": "5f29b98dfb8c59f1a0a0e46d5d630c8f9e160b30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347834, "uuid": "fbf42fe5-0ea7-487e-b7f2-37b01c9a08ca", "comment": "Malware payload (AgentTesla)", "value": "8292f3365843b91dffdd9e3da30144f998c7bc67c6b5785aaba73df5d9bc534e6b10734b37d90a5d2aa540299fec5303", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347834, "uuid": "e63f2acd-4a96-468a-b737-1f3e41eb7cc7", "value": "T188642310676A0C2A1DE11917184A38718F78D9F7FC92F2A5CCB65377CA05BAE6CE1CD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347834, "uuid": "2085627a-3848-427f-8117-5f608b46b7c0", "value": "6144:Xl0zdsLd/BnlXR+frAgx5MoldfHKPqeRcyqj3:GzdsR7XRPIMCdH+TTqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347834, "uuid": "5a7ef2f2-240e-4d38-a70f-12ab12e9058a", "value": 334642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347834, "uuid": "935a9093-2c96-415a-9789-4f32d0a35c35", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347834, "uuid": "ae5d2129-d37f-498e-b444-26e74ff4a724", "value": "P.Order02662736.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799294bf-24ba-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633314386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314386, "uuid": "fe409d12-f529-480b-94d4-3577788004b3", "comment": "Malware payload (Gafgyt)", "value": "a048a3d06177cee85429237d3b5c6d04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314386, "uuid": "96858da4-52ae-4a3c-a52b-7e2883d40745", "comment": "Malware payload (Gafgyt)", "value": "3b30a8758e6776c5d6fd71df3f7b1ac44fc7ddb21ecafdffd2bd37207359165e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314386, "uuid": "2b165627-98d0-41f9-9431-792c8bb5838d", "comment": "Malware payload (Gafgyt)", "value": "c25f88932e000e2e760b582d39a9b1a71f13f933", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314386, "uuid": "499497f0-c0dd-4613-998e-25268f8f5aa9", "comment": "Malware payload (Gafgyt)", "value": "486024a1d3c34e55592da85ae537dcb61f3eeb4cf1cf5faa839e2d060017098dc8b4253b9fdd61621b35fa969865eb83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314386, "uuid": "4ddd7fc6-5737-489c-b1ab-54d753b6369a", "value": "T10CE3A62E7E22ABBEE169823107F7AF70C79521D227919342F16CE6185E7124D1C5FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314386, "uuid": "2ab4f099-74c0-44e3-b8fa-5588f43144c5", "value": "3072:1Atu6SxI/5ZIUj6QP/5NOX6sILJ+DAlwgqVIjFhq1TB3OotUmkmZF01TpM2ke:omclhjFhqfUmkmZF01TpM2ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633314386, "uuid": "f315cb4e-d63e-4aae-8646-46e95454052b", "value": 146926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633314386, "uuid": "4f997ab5-b4a2-406e-98ca-72598909564e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314386, "uuid": "4d7329bf-eace-4ff1-857e-a8675f52384d", "value": "a048a3d06177cee85429237d3b5c6d04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b7f01f-24fc-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633342803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342803, "uuid": "28626d5b-7c85-4cb6-9cf3-84f88e46ab35", "comment": "Malware payload (RemcosRAT)", "value": "a85e4d0bd78b10cfc9453a68b379b9ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342803, "uuid": "7c97b423-51ca-4b86-a09c-7e0b91e6785d", "comment": "Malware payload (RemcosRAT)", "value": "3b6ea75a5628564667996ba672f4f8289d62a73aac96090024238f223db87e4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342803, "uuid": "813dd4ab-0c8d-4ce9-875c-ba4f752cfee1", "comment": "Malware payload (RemcosRAT)", "value": "405e027013bf65e1df550b836b7ddedea4ccff09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342803, "uuid": "2268621d-a6a2-471d-a39f-78f55dbaa4bd", "comment": "Malware payload (RemcosRAT)", "value": "ba22796b984ea329a7654913cc03e4266799d3ca67ae01329d45a8f7f50f4ecfa500d3649605f229a23bb4b250d7754b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342803, "uuid": "83b4c248-9f22-4599-ab2f-867cd63e7420", "value": "T147C3BFB16C71E993F345C6381837E12061E53CA7EB245B3B301875E8ACB575D32A62BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342803, "uuid": "6a8cfe81-ac9c-4bce-9587-18bf263d861c", "value": "3c727df5dd5653a8cd06df0c3a130336", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342803, "uuid": "2b3b0919-a00c-44cb-b400-b54a44cdc792", "value": "1536:vbTWczFRX6KrRqADZ4KzJpi3/LS00zy1P0IcgLMLgvZx0FpSvZpD5M7GP8c:3WcznX6KqAu0A3uUmkwER2noz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342803, "uuid": "c0a5a020-1931-4860-97b7-447cace71b85", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342803, "uuid": "72159253-79e1-4d5d-adb4-fd8a44a63c3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342803, "uuid": "3e2c2468-5e3d-4c5f-b88f-75e29c2a0b24", "value": "a85e4d0bd78b10cfc9453a68b379b9ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927895c9-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633339338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339338, "uuid": "b781d160-163a-4c98-86e4-27421485cbb4", "comment": "Malware payload (RemcosRAT)", "value": "c0315b8788c527bdccb9592bd867701e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339338, "uuid": "3f5b51af-e81b-4b89-a375-dd952b37ba1d", "comment": "Malware payload (RemcosRAT)", "value": "3c3a004e14a349a3b716570cb7e40f6334221bf933e4b55dd0be75138faaf362", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339338, "uuid": "f0c8092c-8077-4216-863c-6e54c33caff5", "comment": "Malware payload (RemcosRAT)", "value": "9c58df272e6112c61a74d33e20cea922ad39dd1c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339338, "uuid": "ba9f5d0b-2039-4b6f-b38a-9b3ff0da81d5", "comment": "Malware payload (RemcosRAT)", "value": "3951d74ed71b809b2ad945a979cdcd4edbcface03339d89b71e34ef79809c2855693f489902bd56444cc35866cbfd1ca", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339338, "uuid": "728b50fb-ebfb-4450-9515-773a55dd82b5", "value": "T18505D42654442B6AF1173B32DD1B084063D16D3C2E682B3DE2A61B4B5B2FBC59ED187F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339338, "uuid": "fb24ff11-3ab1-47a2-90c0-2e235d0c5e8e", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339338, "uuid": "82428eff-5af5-4270-a120-7ea40244c63f", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyN6YAycjL7YiEFXXXB:Naeq3gF1Sf+WIyFAyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339338, "uuid": "e90170e3-fd67-4787-b40c-9299f156f2ec", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339338, "uuid": "fce0ac49-6a20-4592-9474-24b11600f1a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339338, "uuid": "18529720-b928-40b4-b58f-02bf8db528c6", "value": "DHL_119040 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442 \u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07c85e6-24db-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633328732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328732, "uuid": "39c816b9-e7fb-4c7c-8f10-babf5b512888", "comment": "Malware payload (RedLineStealer)", "value": "56b337898d860b796872da2b0fd7478e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328732, "uuid": "5242e6d1-a069-474e-a54d-7fc853d79078", "comment": "Malware payload (RedLineStealer)", "value": "3d955c1628b68fe14ae09ca198d3b48776af1a49299e45d5b774ee7a9acbb2c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328732, "uuid": "63834840-a4f7-4bbf-85de-78bb1e7005ce", "comment": "Malware payload (RedLineStealer)", "value": "c5ace19f20d3b3990a765df23bc6ea80bc252fe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328732, "uuid": "a26a14d0-62f2-4afa-a9bb-e1cf003d8a19", "comment": "Malware payload (RedLineStealer)", "value": "249f20dc79840e08ea09eb7c0b3273c2c5cbad3e38f9a80946f104a85897a76210719559dc898f4e182f9d7f9264c5d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328732, "uuid": "4bc7ee56-0bfe-44ab-aee9-803fe891bff1", "value": "T106449D083183C7F3F6728171AB36C7E2193DF8AD5D66528B6B89277E1E3D2D19613242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328732, "uuid": "910c6577-080a-483c-839b-f6a8ab6ff4e7", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328732, "uuid": "adaa4e6f-e5e1-4fc7-96cd-b12b901bcec9", "value": "6144:YVF34fLR5mu5aA0k28QNB4LROhxxpeTr/ekI:EFm7mu5aAbrQQ4zxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328732, "uuid": "55cd6f18-69c0-41ba-9949-f27c4a855360", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328732, "uuid": "e2223c0e-3826-4965-80d2-c085eb316692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328732, "uuid": "f295283a-b2cf-4ae0-a484-acfb45582035", "value": "56b337898d860b796872da2b0fd7478e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5cacff-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633339518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339518, "uuid": "9ba9251e-735e-4bdc-a41c-f141778ec112", "comment": "Malware payload (AgentTesla)", "value": "7a073be16bb4fa6ad4794c3c8fbd3681", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339518, "uuid": "bd7f449f-3805-4201-a94c-c282121140dc", "comment": "Malware payload (AgentTesla)", "value": "3df41f50c7583bab10f2285968a7940e03faedd2767c48294890473d89006858", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339518, "uuid": "5c17261e-f0ce-44b2-8bf1-36b1c80d4238", "comment": "Malware payload (AgentTesla)", "value": "8ed2177cafeedb5fdcf3d4f9bbc584e818000cf9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339518, "uuid": "58027168-1b32-4a1c-ac91-308ac548d692", "comment": "Malware payload (AgentTesla)", "value": "19d92007ce14d15d003cfdcbf97db3ee98d8fa23d29e81e867e96bd836a74bcc7693a3feda3006715b2999ffbee408b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339518, "uuid": "678fd089-d82b-42a4-b5aa-86f31f6ed09c", "value": "T1F494F1A863B35348DD38C3F03D24A2D197F5B52A205DD7789E88E0FD3AA27B469E0553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339518, "uuid": "088cd500-1f17-48da-a97f-798e21f818b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339518, "uuid": "f0835eb1-ef67-4f2d-9940-259852e10e5b", "value": "6144:lftCEERQ+3HwOCeu+U1WO3dx02vMmuKHH4hV5nC4VdUFRL8hz4c0Tfl7Qhip0:lfESoCeunrtuhV5xdUrXTflUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339518, "uuid": "1dda08db-b544-466e-9f36-d4a420ca5dde", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339518, "uuid": "cb5524a9-7403-415b-ba4d-439cd41b1f46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339518, "uuid": "bbe17681-40c6-4d79-8780-f864c034aba3", "value": "T.HALK BANKASI A.\u015e. 30.09.2021 - 04.10.2021 Hesap Ekstresi.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268f6695-2504-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633346029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346029, "uuid": "7353e306-bcff-4fd7-85cc-d0c3a0526642", "comment": "Malware payload (AgentTesla)", "value": "ca13a97b94b0e17f5d863a2290f10931", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346029, "uuid": "7dc277bd-2c01-4e6b-bfca-ffd5e0110a25", "comment": "Malware payload (AgentTesla)", "value": "3e1a48cb4283d83c729670dbdc69d6a8d5290a50bebc621baf7e0a72cd56ffb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346029, "uuid": "a6e1a48f-eceb-4a4f-8ee2-e8e50ab7f75d", "comment": "Malware payload (AgentTesla)", "value": "a5035ff9bd7264431a254a0b973864febfb19c7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346029, "uuid": "2d0439d3-3995-46af-a225-c4489f687ef0", "comment": "Malware payload (AgentTesla)", "value": "1104c8634247f86d15f3e61faa68d7232f797936e3cf838b21052d4a9ebf52a6a523462e9e1ce3bdb9a13f5e51a5da86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346029, "uuid": "abe75289-fd77-4bf6-b29a-218b53a546ec", "value": "T15A842305488BE237E7433679D60D0A4173D9399B0F15F6FAEC1B9B67AE811108EF49CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346029, "uuid": "a68583ba-6a19-4a46-ae99-5fc70617f38a", "value": "6144:aI84xUdNqsB9+U1eq7RUSdROy8g27o8qpv5hM3N6sAIEPmh7hF8:Z84xyUA9gwUNng2avz2ZAImA/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633346029, "uuid": "debae8aa-cda8-4382-b81c-1ddac78ba1cf", "value": 372101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633346029, "uuid": "01799c3a-1584-4aca-9fe8-ca144f3234e4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346029, "uuid": "904232ce-87c7-49bf-be88-ca96bbabec2f", "value": "swift art.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f7199e-252b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633362752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362752, "uuid": "81e235e8-0009-4a87-ba38-82b459b2591a", "comment": "Malware payload (AgentTesla)", "value": "40d2f4c3ac6f235c3355641acf4ce31e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362752, "uuid": "29e38175-40d3-4124-a49c-14cd384b0a50", "comment": "Malware payload (AgentTesla)", "value": "3ea6e97c4c9f2cae66c5ab08e0159a7f83134185fa57c8423a5c42cd26e058c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362752, "uuid": "e29f89e5-3a9d-4489-a5ea-04e88aab234a", "comment": "Malware payload (AgentTesla)", "value": "f2e9d5e5084573398e4167c94c1061a50719841e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362752, "uuid": "4cb6c87b-dfb6-4220-b008-d2d6ec2e5417", "comment": "Malware payload (AgentTesla)", "value": "0fc1b4ddb917ee557d2915de8b7c868a518eaa2dd910440dc2fb144c8996139e857baf8fe578f73ff0d1aee3bd8fcd58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362752, "uuid": "2dfb5c06-ad81-45b4-8694-235d46973bd4", "value": "T167A405D33D1047B6EBA7E9BBD00CABF106674F39AD904951A9AF3222C785213BCD5631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362752, "uuid": "3c785746-5762-40d7-942a-e5f617359cba", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362752, "uuid": "54df6da1-622e-4b2a-9f8c-198a0e301e9c", "value": "6144:68LxBp6pnFrFeLuOWulOOsNzlMk0NyLV7smfYmB8wrsIiHcXKgdao61X1r/MxE6/:ueLlkW/yLV7JOS7afz/MxE5yDss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633362752, "uuid": "d2774f20-3ed4-49e1-9909-038661d5d009", "value": 476708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633362752, "uuid": "053a14cd-3efc-495f-9ee3-7208223d2669", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362752, "uuid": "7db55d80-e48d-425c-90af-4f7bfbb82adf", "value": "Aviso de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35da2201-255c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633383851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633383851, "uuid": "981dd5a0-95c8-4428-95d5-6f83296228bc", "comment": "Malware payload", "value": "4105b6a32b90180cd3dfe3c359061f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633383851, "uuid": "45a66082-e233-4363-b2ef-57d7cbf50aed", "comment": "Malware payload", "value": "3f1f0dce8eb0b1a98912a8c08208c5d4425e013e20719aca1d14ca4924f841c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633383851, "uuid": "c493b096-9ec9-448c-a7d4-134fde4ac9c2", "comment": "Malware payload", "value": "ea131838d1e1ed495d75c76b956c790f071e002e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633383851, "uuid": "955eefe3-6ce7-4b2e-a1cf-1cd57f77e2ef", "comment": "Malware payload", "value": "7dce2b50f82362ce58cbc43080a510a1830a410273864b08a5d106d5443ea3031b0d0ebaa4d393cb508216ec9e8e66df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633383851, "uuid": "78e0112c-5ae2-4c5e-9c52-80ded6909e72", "value": "T168251A9053C79EC4F07B2734B0121CE7A6FE620EE379CB15699A3AD78DB6740461DB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633383851, "uuid": "e2868813-e6af-4bbd-8df9-d8135de1fc0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633383851, "uuid": "d98b32e7-9fa1-4a29-8bb9-83600b4e3dac", "value": "12288:fO4jeQ5jsruJH+ReJqvqfLRXwK4+HNONnvsyl5RODp2K046Mnq0UnsO5lJkKzUva:2HXRYFphm9vFrPMOiPRVZIRfBiBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633383851, "uuid": "349e87ea-66c3-493b-a6f3-239c0cb5c5e9", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633383851, "uuid": "f58da14d-dbf2-4d75-a6b7-399490c9e88f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633383851, "uuid": "c188e258-7e3b-48aa-bdd3-dadc7ece5b77", "value": "SCAN COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074f32c8-250c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633349413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349413, "uuid": "f5adf486-c039-454c-afcf-8833700b1e10", "comment": "Malware payload (AgentTesla)", "value": "44dbc0b4c82ab5027ca0beee6bef5b3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349413, "uuid": "e447fb7c-4ddb-48e5-9d7a-fab491203991", "comment": "Malware payload (AgentTesla)", "value": "3f5bd96c293cb80ca6662ac5a385449403adc86fdc4bb55571637385fc2842cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349413, "uuid": "887afa1b-9508-41ce-a3be-ae40d196eb5f", "comment": "Malware payload (AgentTesla)", "value": "ae27a4a72c904bf4df7946cf065bb4d8cf8e2694", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349413, "uuid": "fe519a35-cc18-4fc6-bd68-9486fe69acb5", "comment": "Malware payload (AgentTesla)", "value": "73ac98bd983a303b3a68553da457cae4aa0e91ccf2c7b35bc90cdd0b4b31fea1316c534229f034037f51bcbe832f5fd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349413, "uuid": "9ece427d-7f60-414c-8aad-adfbb1e51a3e", "value": "T19AD4F19D236B8600FD7F47F9B87490904BB2B8265456C73C5ED024ED1D73BE48AA9B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349413, "uuid": "80def79a-1e2b-4317-8e28-c712d247a545", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349413, "uuid": "3bfbd2de-081f-44ac-869a-6d5c5781d2d7", "value": "12288:TEqbotmUgMi6FJm65fiA5uxL2AyO8c+kJT6YashlM0JT6YashlM:wssmURTF9fydxl9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633349413, "uuid": "dd09d6c5-a90c-4e50-bc24-10e69544374d", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633349413, "uuid": "e0100be3-969a-428c-aa43-f0babd7a1304", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349413, "uuid": "760d942e-9e0b-4224-9748-24b2281c9e01", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd1027c-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633338685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338685, "uuid": "922d5e33-833d-4f02-996d-764eb6099623", "comment": "Malware payload", "value": "1aaa5eaff2f014fdaa21cae65a3502d7", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338685, "uuid": "cd2ac0b7-293d-4442-97fb-fbd6b1c224d4", "comment": "Malware payload", "value": "3f93539cdd387037a6ae5444092f7735449639afe88e89c5822de704d13f61f0", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338685, "uuid": "ec18a72d-61f4-4720-9ef2-5f709bb165bd", "comment": "Malware payload", "value": "efb896770f0a46e9f16acbd9ee1cd35646ce7b81", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338685, "uuid": "de3a2bb9-4882-44ad-a0ab-543ef959904d", "comment": "Malware payload", "value": "bc051feb86cab0f616373801f0e9051aa3f4abcc4bbd9a93dcb6d28fbaf27cc03b4a39503d8ce7f37f8164cc57634c0e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338685, "uuid": "44cb9a33-7108-439a-8713-dceb9869d00f", "value": "T17F6412B475D4038BE957F3B429A1BB36682DFF2C093A84C4121D7DAA18B676353437C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338685, "uuid": "7c2ae6a2-4c36-4ee3-80b3-d56ca82f592c", "value": "6144:2oF9udCyVu4YDQkFdXRO0SaViTMTNShUQ0vZYZ+ZThKBrbH4h:2oF9udfYnu0SaVi3ii4KBrbHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338685, "uuid": "cb50c868-d6ff-46c2-8afb-bd2224b5ac5f", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338685, "uuid": "7a0f7a72-3ddd-4c4a-8e93-8161fa41ce95", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338685, "uuid": "9e5ab311-cb84-4a2c-8a36-ccdc0185e797", "value": "TT form.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897faa93-2513-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633352638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352638, "uuid": "4902245f-7ed2-4fe6-87e0-af310a489ba1", "comment": "Malware payload (AgentTesla)", "value": "543f39229a984fe815ef6f2c946aa1d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352638, "uuid": "a7d77bd4-d3ee-4067-80e8-51af2e0808fd", "comment": "Malware payload (AgentTesla)", "value": "40c4a0c90df1e476022fee40bf60ca6b7a1007adc73bb18528097104f2cc752f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352638, "uuid": "853ac047-e36f-411b-8c3c-cee650ce8127", "comment": "Malware payload (AgentTesla)", "value": "1cde941d3390a61fefdbf05dbd0e779d7af6d145", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352638, "uuid": "3e2ec7df-1134-4869-9f6a-86c8f6aa8d8d", "comment": "Malware payload (AgentTesla)", "value": "a21622ecbd1cb8bcec83eeda5c9345cdb54b32245f61627229361e4b8b79d9fd55b10a6e12a084396ff7dd00a0024f34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352638, "uuid": "2cd17063-1507-4a32-9e42-78567323abfe", "value": "T1C634122662C1D4F7E34359B14DB6BBF9FBB788148041D287E3280D7F2D6558389972E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352638, "uuid": "e3434ce5-717d-463c-935f-628f525add55", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352638, "uuid": "fd335b3c-6e91-4629-81bb-46d6ad7ea0b8", "value": "6144:Z8LxBWe/dCz0MFiU0n5TS24kRz667gFxOPCCxMy4yiI:R6dC7FiU0nZm6oxOPwl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352638, "uuid": "4e977990-1439-496c-9b8f-45d9b8094e65", "value": 243573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352638, "uuid": "3220f03c-53a5-45af-bfb6-b620125b8528", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352638, "uuid": "3b392690-1ed0-4bb1-9bb9-23b06f17de23", "value": "RFQ#3111998.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af11713b-252d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633363868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363868, "uuid": "c4c3725b-e367-4e75-bfd7-fc2820f55b67", "comment": "Malware payload (RemcosRAT)", "value": "b0e4386956cec0e9ba31fc4ec4fb19b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363868, "uuid": "69efa0c9-e00e-422d-9056-ccfc0d6ad353", "comment": "Malware payload (RemcosRAT)", "value": "40e46a14bd43bf7abd25211692990f2a5c416ec6dc060eb20e4bfddd207012d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363868, "uuid": "2d97e109-254e-4334-8bc6-4723e6009013", "comment": "Malware payload (RemcosRAT)", "value": "d6229c3215a6b5bdaa275d03f4dc05d6045a87b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363868, "uuid": "967d1354-249d-419b-ad32-773ca9dd3385", "comment": "Malware payload (RemcosRAT)", "value": "cf60266804ad5ca8babf536e521f1242210df11263753021ff37ad46450aea710caa5034fad5b49e351bfb556e8f3deb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363868, "uuid": "cd474581-e3f2-45f9-9081-bef45d1e9a91", "value": "T1AF05E7A291549769F116373BE843420487F8693C2E148B36E3945B1B0F6F782EDE987F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363868, "uuid": "1eecfc08-73ea-42a1-90ca-b79afe6c9d98", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363868, "uuid": "1f6e9593-6f3b-4157-b8f0-418daa9d027c", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyNqYAycjL7YiEFXXXB:Naeq3gF1Sf+WIyFAyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363868, "uuid": "96c28bf2-bcb4-4281-a8a0-61d0e01c26d5", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363868, "uuid": "fc2352d8-d4bb-481f-a350-2f5f5bb752dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363868, "uuid": "0679f912-2004-4dbd-8cca-eb96728959ca", "value": "RFQAP65425652032421 urgentes,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2de960-2535-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1633367190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367190, "uuid": "191808a7-e2b2-478e-ad90-0d24795a0b1e", "comment": "Malware payload (njrat)", "value": "aba309cde7801d52d82898085394fd7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367190, "uuid": "5bc0c828-4f7d-4a2c-aec6-4338b44c9b0d", "comment": "Malware payload (njrat)", "value": "4159e161e24f40bd4964eb53aaea050b685a4aa2b3bac12631180a6a9a403ad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367190, "uuid": "cae6d665-952f-49eb-ab89-911c429150fd", "comment": "Malware payload (njrat)", "value": "5ca6bbeaff94b94ad7e8c54029d3096bcd4e914e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367190, "uuid": "74f04294-31db-42be-b243-82c7435d9972", "comment": "Malware payload (njrat)", "value": "eea48d0ec83317e087d55c285e0c1011f6bffda971d1337c8d1d575919b42dac1a71912b112493235e9f77ed2da41ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367190, "uuid": "d0e994a3-fca3-4a9c-b284-834b6990c261", "value": "T1A8A4120623E0C626D6A907B4453242A483F5EF42D333DA9F3F5479FA2EB6B45CE40796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367190, "uuid": "f8932788-121b-4fa8-9f51-5fa0c830a54e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367190, "uuid": "25779440-0d04-4883-b001-b3e7ff3df0a0", "value": "6144:Od2/yLTYnbgz2q/ZyKphVdvoe77GUZqKCXF1x3HOb2YyPPD71lhNlOQ5Jmp:F/yPYb6wGv+U7cXOBQD3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633367190, "uuid": "915be257-493f-42f6-ba8d-db1a24c2271e", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633367190, "uuid": "2241b1e7-a333-4b5f-9f15-11362dee495f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367190, "uuid": "30e2457b-8175-41fb-8bcf-b21bb989bfbd", "value": "4159E161E24F40BD4964EB53AAEA050B685A4AA2B3BAC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624f51f8-2506-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633346989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346989, "uuid": "252d4d31-c7cf-4a3a-b974-aeeec2b8afe6", "comment": "Malware payload (RemcosRAT)", "value": "abf8b2891f333e11ebe3e8d0ad884a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346989, "uuid": "5938a63f-9681-4c99-990f-4316d6b2134b", "comment": "Malware payload (RemcosRAT)", "value": "419787d8a4a00760e1cbf2d6e30e83b38fd19d2cf3f551d22997256b08295ced", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346989, "uuid": "b1a40ea2-b47f-4a91-8c1c-650b96c2a92c", "comment": "Malware payload (RemcosRAT)", "value": "17923783bdb43b464e1afebadea79900e9464f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346989, "uuid": "db0970d0-a33b-42df-a3a8-539e592584af", "comment": "Malware payload (RemcosRAT)", "value": "07c10c606420e8347d6b2d01a0342cae46ae3e763f6073c19a990f38ec99c1972a3c35c8ae4fa95f119b6a64dd7848b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346989, "uuid": "8b2eb5b3-673f-4f2d-8757-dd44188733ed", "value": "T1EFE49D39F7F6897BE05107F65D8E8158851E3EA92C24E2577BF85D492EB92802C3C353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346989, "uuid": "da35e501-cb89-413a-b790-a076642a7369", "value": "2687613b03fb396a0f631022313de465", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346989, "uuid": "39fe6396-22a8-4329-aca9-c01d78966394", "value": "12288:ChI4qj0QG8mlxWJjPeoeXfgLzWGizdoqM+YdlyHvTv:i/1QG8mlxWJjPeoeXfgRiRoMYjyPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633346989, "uuid": "f7fbb5cf-b8d4-466d-831b-11e573b48b16", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633346989, "uuid": "fb08c82e-e3ec-4f84-bc00-22809a695c85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346989, "uuid": "e48694a9-cc20-42c9-a7d9-af5f9ad0813b", "value": "Orden de compra de PO_M IDE,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d44abd0-2508-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633347893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347893, "uuid": "65d85ae6-1a8d-44c1-9a46-7cd317554d4e", "comment": "Malware payload", "value": "988addbc96a38f36784f68b87b5fce7e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347893, "uuid": "449a6a06-60cc-4952-99e4-2be24c8bb3bb", "comment": "Malware payload", "value": "41a0f0f8f10907c6d66be9fa76f4e23e2f69cfa58f19f3e0c6ac084777fd0e20", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347893, "uuid": "6800fa4f-9cf0-417f-b4d0-01080e72c3d3", "comment": "Malware payload", "value": "68c058f22f951d89cdf25f406c6d4f551c15160e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347893, "uuid": "8134cafd-cbcd-440d-bcc4-c3426c4ce12c", "comment": "Malware payload", "value": "203d430ff5604385ca5ec3bfe4e30e30a45ef4ac4a5c1001148e0e6e722595ae504bcc0463a39b7e8bd0d87b4920cc7a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347893, "uuid": "dbf2798e-6756-45a6-ad86-47df6c497b03", "value": "T181F4334572A28248B7D14C5303940D988BAEEF9B5E54425DFB1C88BE12EF6EB16CDCCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347893, "uuid": "82e3008d-02d3-4bc5-a9f0-b485d6c2def5", "value": "12288:aei8CWiPJGfAuRtIcFAP4IFLvfAGBru2asPn3Jupw9FTXNlzBUyJ:aeqJPJuXtu4ItZAsRH9hXzVU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347893, "uuid": "92b59913-e320-4fb5-8156-eecca8c45a3e", "value": 729327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347893, "uuid": "67e0dd0a-8986-455b-9c8d-4c23fa1ddb33", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347893, "uuid": "da1c2371-72e5-46c3-8962-df75e76a7b80", "value": "Quotation Sheet.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc057440-2544-11ec-843c-42010a9c0014", "comment": "Malware payload (1ms0rryMiner)", "timestamp": 1633373795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373795, "uuid": "c7abc38b-4178-4d39-ac91-c470a145b389", "comment": "Malware payload (1ms0rryMiner)", "value": "b7468904155157b5f8cd9cb3782686de", "object_relation": "md5", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373795, "uuid": "23fc11b0-4a78-45c0-a4fe-751b44071e68", "comment": "Malware payload (1ms0rryMiner)", "value": "41ad6f9aaac40ebe7d35ad9caa46ceafed790ca57d7c4e283fa87ce1892a088a", "object_relation": "sha256", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373795, "uuid": "a596f571-b3a3-45e7-9559-edb3eae7e2d8", "comment": "Malware payload (1ms0rryMiner)", "value": "3b1fa2908150cc6a7d7764ee82ec37755984bba3", "object_relation": "sha1", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373795, "uuid": "5a885089-a4fc-4ef6-bf7c-9c0aac4b9eb8", "comment": "Malware payload (1ms0rryMiner)", "value": "c4859508d74d2dc04a698fccddf63cf4aaa61e29faa78edfdee1f994c9dfbcdbf6609f9b7aefc2a1ca41ae7c535773c2", "object_relation": "sha3-384", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373795, "uuid": "6d32e0a2-8c74-4b86-be4d-dd1ec7666f9a", "value": "T129F533C7F49BDC66F1F00DB64B68C3CA353A2023904C5176BB3EA524DE1249F565AC6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373795, "uuid": "e3fd8efa-9e4a-4c3d-8985-49d0056b539e", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373795, "uuid": "9865a2a7-908f-4d52-b70c-03cb2ab96bef", "value": "98304:y9SA9IVfu8JcsQ05Dsw5C92bLLl2zgXsjOmpzRTUF6YKK8NSIxu:yafJF+SFRcOs+iK8NSIxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633373795, "uuid": "619b3b7c-5d1a-40a0-87f1-206315a7094c", "value": 3602257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633373795, "uuid": "6620490c-04d4-4ea0-a2a1-a9854d934603", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373795, "uuid": "0c68426a-59f7-4904-9b84-781eaa76ca64", "value": "41AD6F9AAAC40EBE7D35AD9CAA46CEAFED790CA57D7C4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f043901-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633347815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347815, "uuid": "1b275ccb-a078-4f76-b34e-9fd33b55c85f", "comment": "Malware payload (NanoCore)", "value": "6722b3b0ecae04f6abfeb720e1e55d1f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347815, "uuid": "6df97bb1-d2b0-4286-883d-9eaebae57720", "comment": "Malware payload (NanoCore)", "value": "41b97a05eb10023008ea24154634e2207166f0bdef18d11c86279470e23ce888", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347815, "uuid": "35f60cd9-6b7f-4fe0-9f65-f233719c24b5", "comment": "Malware payload (NanoCore)", "value": "9357a1c4250384fc25c84c0e49c8f61011aef923", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347815, "uuid": "fe6e625e-1d94-422e-a545-2a4119a6ff15", "comment": "Malware payload (NanoCore)", "value": "731f2293505dabc42c08f1a98ce9bb12da0b2f558a9821a5df8417807b77ad52af4c1f2bcb7dcb64cb8753715faef8b5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347815, "uuid": "f9643dd4-8ff2-4eb7-966c-9ef43f39b431", "value": "T1A064E5E8259F86BDE708DD0CE9953046ADB2FBA630C44E20535D8460CF5DEF7DE88692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347815, "uuid": "cf907f19-2672-422c-8675-e160862ae0fd", "value": "1536:ia3bWhTBE24hASexo9kS59U7xlvVTLywdzFz76mAg5eeVhMDw5wfL7:idCYdzFtr5RDAw5wf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347815, "uuid": "7fdc9c82-6ded-47c8-bbdf-19d16da5312f", "value": 314664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347815, "uuid": "c9c9e57f-46c8-4062-966d-e314e034c549", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347815, "uuid": "328b61d6-6d27-4a1e-b3e0-3476892cce08", "value": "especificaci\u00f3n 0021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea37f04c-24a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633307273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633307273, "uuid": "99650f3c-6db9-44ec-9d8c-22aedcf97123", "comment": "Malware payload (Mirai)", "value": "5675a3b495d4676395edaae27acb275d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633307273, "uuid": "2e3bb9ad-d23f-4b3d-84a0-d272ef7c26cb", "comment": "Malware payload (Mirai)", "value": "41ec514f0847020169abf8f9b186e9d6e53fa6a7a392f6f8586c907d909263ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633307273, "uuid": "68ac03e5-2c33-4cc2-ae58-03380717ea49", "comment": "Malware payload (Mirai)", "value": "9cc6e5ef5b450346deeef063508fa9fc375567e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633307273, "uuid": "ca04ceec-970b-4c5b-ae27-90101868a11e", "comment": "Malware payload (Mirai)", "value": "65ca9f67ec4ec1369419791761becea1277ca6e939065476b6803fe46a49da812a749437168f40278a77893bf7b8ea30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633307273, "uuid": "e25442ff-3a45-4b00-ba1a-6d7cfa345fb2", "value": "T154B34B376251C97AC08356F427EBC5729C13BCBB1B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633307273, "uuid": "7f158f12-6ba2-43a4-a558-1215b66adc72", "value": "3072:kiry859acy1Jf9wHYqbgFFo8+Herh+TZHdm7FnVqfJXtebNb:T9ac6Lqkr38tdm7FnVqfJXtebNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633307273, "uuid": "c8003892-6a88-4c4c-84b5-78398ffa8e56", "value": 116502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633307273, "uuid": "2d4b8622-8ed9-4bd5-a6b3-2ed3ed26cb4e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633307273, "uuid": "7666c0e0-e9e5-4723-a8f6-4b110e21d063", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239415f5-2519-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633355044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355044, "uuid": "a316615c-a027-4c0e-a2eb-9f3275ac86f2", "comment": "Malware payload (Quakbot)", "value": "bd9d4783879e02862d919ea345180077", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355044, "uuid": "0e3682ca-57be-411e-ae96-5057d79a32a2", "comment": "Malware payload (Quakbot)", "value": "4282612879c57ba4dd32713af8a97f1f776b75bc48f492c8e57a6c445dbcb87b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355044, "uuid": "1eab486c-c7af-4449-b79f-6b4e04779b0d", "comment": "Malware payload (Quakbot)", "value": "e0231aa5588a4c4aceaa50043b47ab201ac0cd96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355044, "uuid": "a3602821-636f-4362-a17a-759530ce0c80", "comment": "Malware payload (Quakbot)", "value": "fdc77dcd0b60234083c55a42558197eb66e9d8d00ff3f4cbc3d10b0b5fd703324673b133f45234b64a9afb6e0b71d14f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355044, "uuid": "8739a476-9ccf-407f-98c3-47e4be2cc01e", "value": "T1DC351F543A54F410E6A96972CF6AC5F907157D09EFF1B49B78E03E0F2AAE8B3D512302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355044, "uuid": "4f926a22-74cd-4f09-96cc-8fa18970b0f3", "value": "a3bc22a368f54d0cca765cf58c7ea10e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355044, "uuid": "9ed5a664-adf2-4c90-8673-ed871cc37fad", "value": "24576:tsSQSXRSFsPWWkVotdc3g+5coB4lzWrHtGOGpCXSenrO+1Zpf9vYxkXcJYCEC3AW:W2IFsOnCdc3g+6G4lsHtYpCXFnrOKXl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633355044, "uuid": "9a40d5fb-9b1a-4f7d-b5bd-7178f0403f31", "value": 1103293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633355044, "uuid": "e8b3304c-133b-4683-94b3-f7e11c6404b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355044, "uuid": "fc0bda78-aff2-4121-b7ec-369eea714899", "value": "test.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f592f6c7-251f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633357973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357973, "uuid": "0b12dbb4-73d9-441d-9d66-a4be144db2e8", "comment": "Malware payload", "value": "675c8ea77cd486fa307bac0b51e2e0d5", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357973, "uuid": "15cd5318-7e8a-48c3-be38-ec0f66dcef02", "comment": "Malware payload", "value": "42856f09e85a0ceeafe168fdfb3668c79a17d91e76d16104b3d06b5aee5c289d", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357973, "uuid": "abc51635-510b-4ba0-a88f-a007a74420c4", "comment": "Malware payload", "value": "491cd98b417bb95e7497ef6cd23fbca1706f1bcd", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357973, "uuid": "5205f58e-d5ee-4a0f-9330-0688ce599302", "comment": "Malware payload", "value": "2cdeef222bcebc8f50dd3d6dd0f8306611589ef3bb2f79bc7bb70212d6bde7738096aef7f2b298f381f74979f2cfa659", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357973, "uuid": "47285131-949b-45d8-ae68-d1891635c59d", "value": "T1F983080D77C8C962C4BA96374CD7C7D92731FC00AD91831B33A4732E6D7A6A19AB2784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357973, "uuid": "1cf43ac7-d227-4e32-a064-513fc94563ff", "value": "384:2pbmn8FktGaae1VPrliTrKSAcIIn+OYOsUTD8vR/FhkiDn5uPxNJgr1jRptxjclq:xnUbaapKvTIlYO56FcNJgr1jRpLcjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633357973, "uuid": "412f08e2-28ea-42a6-83de-754529a0d6e4", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633357973, "uuid": "c8a7d12c-a308-4265-a69e-e2f1f892a6f1", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357973, "uuid": "b6e3d565-c4aa-40ae-8ad4-5e70b1db74c5", "value": "11729154.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9285b7-24ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633309104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309104, "uuid": "21c7048c-beba-41aa-a106-4d183dc6729f", "comment": "Malware payload (Gafgyt)", "value": "557ce946ae21e3858a7ed0c956d0a8b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309104, "uuid": "57a3ca93-b7eb-4c4e-8eb4-c477b9804ad9", "comment": "Malware payload (Gafgyt)", "value": "431a8c5e1111efa7b1d050fbbed5df4ad736f01cb7f4bfb48f20c645871ac6b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309104, "uuid": "db55703b-0abc-4064-b9a4-05ac177e4dd7", "comment": "Malware payload (Gafgyt)", "value": "303ef07b1f12902487e6ec5793c60250be2623aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309104, "uuid": "0703df44-5926-4d79-a0e8-cab5bf27527d", "comment": "Malware payload (Gafgyt)", "value": "9de8692372ef4a517ccc62eab208463cffae7d4f67b96962a403a0bd507102346f76afe31d1e468c2d11cd67cf6c9e46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309104, "uuid": "b2928947-2b2c-47b7-b324-2b3b21622962", "value": "T1FCA3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309104, "uuid": "4fcb818b-6b9b-46d9-829e-868e4e954ddd", "value": "3072:Vgdr2vIBAxMyAOLRcftJhOemuxVqDr78fz1e:Vgdr2vIRyAYcPhOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633309104, "uuid": "682fccbe-3e0e-4d06-881c-5534418e93ad", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633309104, "uuid": "2b408487-9689-4965-b1ac-a092de8bb355", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309104, "uuid": "50d2992a-7eb0-45b5-bd37-81a5f1d2e9fd", "value": "557ce946ae21e3858a7ed0c956d0a8b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e18ab2-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633342966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342966, "uuid": "93dfaca3-7225-4782-a94e-5ba7682d23f5", "comment": "Malware payload (Smoke Loader)", "value": "065cab8521905a81146e35474108639b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342966, "uuid": "08a1bcfa-3710-4170-898f-ab7ff2803501", "comment": "Malware payload (Smoke Loader)", "value": "43449645fd2098353521e7d16b9db407c92a23fe627d01cbe5c658c5dcfdecfb", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342966, "uuid": "3eea38bc-0f51-4c37-be93-45f8890077df", "comment": "Malware payload (Smoke Loader)", "value": "a4373a5b496c61c74ea0423e95e7a955bc27c2dd", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342966, "uuid": "ae1dc5e4-27c2-488d-a9b8-228795db4247", "comment": "Malware payload (Smoke Loader)", "value": "f676439f21f4ae92d017afe28f0e3ececae32cbcfdb4bfce8476ee7c1dfa5ae265d0898c2c9731090d9d97e13ad51f96", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342966, "uuid": "431381d3-0f47-4af9-9660-5fbebc8233cc", "value": "T1D844AE0935C1D7F3E673153067A2C7F01A6DBC6C4E5A564F3B99272E2E3D3E18629282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342966, "uuid": "c8f578c5-1ab4-4567-98f8-27d4376b11e1", "value": "ea6e9add4feec4142f4eaf80b256f47a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342966, "uuid": "79a6e0b5-c277-4f2f-aa93-a4789ec12716", "value": "6144:CxswQALQUxmkl5mxthBdROhxxpeTr/ekI:5wQAMUxm/0zxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342966, "uuid": "e44227d0-491b-4593-a8c4-a5f7d4d157d9", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342966, "uuid": "69fde669-ba1f-4d26-a393-6cf2b48e1287", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342966, "uuid": "8c62a0d7-04ef-4572-b324-abde37a85c27", "value": "065cab8521905a81146e35474108639b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb8cb08-2510-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633351462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351462, "uuid": "c1adbf95-886c-4bad-9720-047482c608e1", "comment": "Malware payload (GuLoader)", "value": "013d4cb9c83ba31bfb0c9041f565acbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351462, "uuid": "470ae243-35f5-47b8-afaf-414d449b9669", "comment": "Malware payload (GuLoader)", "value": "4387b1c679623e8f2430732c0ff94e3ad733b23d7ca6f5be7f7d79beadd40a68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351462, "uuid": "d640e855-9387-4d1d-9333-8701ae36c363", "comment": "Malware payload (GuLoader)", "value": "560797dc56b238e457011719c8cc4f2090e12aeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351462, "uuid": "c7564328-499e-4f52-87bf-ee4ee593eef9", "comment": "Malware payload (GuLoader)", "value": "8f461e3235255594cc5bca971269d564eda291ca332534335b5f9e361822ae5d18f0934219fefc49bd5d9a59a0549c8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351462, "uuid": "571c52b4-9476-4cfe-bc55-3a407f864cbc", "value": "T198D319E5F221E1ABD05980F6ABE0502418F1BF3459B2C67737C2371A3E3AA92D355793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351462, "uuid": "b36162d7-275c-4757-a775-bfc0003199b7", "value": "cb4f8c840affb61160ab1afb91e9cfb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351462, "uuid": "99183054-2989-4e24-aa77-74965f20229f", "value": "1536:HVAy0bKPleQig7OvPBuvJ7pdDlkM6ElpA5rRpaIaR6Lid5vX3WzkmGUkm:HoK0I7j7zDaUlO2RUid5vyG5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633351462, "uuid": "609acfce-068c-435f-b790-72ce0b292cb1", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633351462, "uuid": "0d11eb6e-8bf6-4a6e-8050-c121d4861a14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351462, "uuid": "d6e5c63e-5565-484d-b673-0b6d365c7ce8", "value": "013d4cb9c83ba31bfb0c9041f565acbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219d7f09-2504-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633346021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346021, "uuid": "4c152108-d301-4d73-9a0e-8b96a7438ff3", "comment": "Malware payload (AgentTesla)", "value": "57839bc386427b48d022ec7868db9d36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346021, "uuid": "6508e126-f157-4bec-a370-49b4f2e2ce86", "comment": "Malware payload (AgentTesla)", "value": "4429d5de4d9e544c06beba52b737a29e93ae559002e0aaacf532839678cdf7db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346021, "uuid": "c04f9b90-aa26-4f36-b6e1-9cb474ee150c", "comment": "Malware payload (AgentTesla)", "value": "399d9dbbd7b26430826077280c16253c678f2384", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346021, "uuid": "88afa24f-0667-447b-9fe6-e885410bc703", "comment": "Malware payload (AgentTesla)", "value": "a1e42b2cc50f432b1bb06973891c2e2d9766c6bddd4453876bba1c5e028bb5d386899bf08e2b9eac23ef4bcfc0bcc73c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346021, "uuid": "1c5ac472-867e-49a5-8d8f-1fa8176bfd04", "value": "T172D4F19C63AB9514FDBF87F96870A0900BB178275546D73CAE8024ED1CB37E48AE4B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346021, "uuid": "a1e227ca-363c-4d52-89f9-5e9f76902037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346021, "uuid": "b1bccf73-dbbe-4222-89b0-cd11534e01ab", "value": "12288:MzoNFd49gnpnmL1oj+9yY1/h0ORjDY241JT6YashlM0JT6YashlM:WY/AgpI1voORZ4n9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633346021, "uuid": "d94f074d-c555-446e-8b20-6eb220a10475", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633346021, "uuid": "d13bc887-44a3-4a07-bd8d-2796da4352c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346021, "uuid": "4163da48-34c6-43f9-bf25-80cd3a394fa9", "value": "UIB094322.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb7f219-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633353152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353152, "uuid": "2a84b31b-215d-4c06-9fd8-85ac42afebd6", "comment": "Malware payload (AgentTesla)", "value": "ea458e04ebc0d6e63cce03c389b3a378", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353152, "uuid": "31dbb1f7-cb4a-4b1e-8365-fd98cb4e5d5b", "comment": "Malware payload (AgentTesla)", "value": "44cf0a31ade706f4fd38ae5d4ce746fa737b741a2cbd21f4ae271321d0858bd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353152, "uuid": "1254bef6-db30-4136-8cbd-6d0147949f0e", "comment": "Malware payload (AgentTesla)", "value": "58126efb1e2a78c5b44bf8c5f17ee0a7dfd8017d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353152, "uuid": "013a503f-54d0-4423-8fbe-ad21c70922ac", "comment": "Malware payload (AgentTesla)", "value": "427609697292e57e2b83c6c06a3c7f557812bf6ddee8ce48b28179bfa5830409341a2ff94405ffba26c5cfff06a75fc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353152, "uuid": "bd2fa863-7b11-45c6-8db5-ed6cf1b19623", "value": "T19715C0202254C16AF1FBF77CC46294718B7EFA86A036D99A69C3C8DE0D25341851BF6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353152, "uuid": "83fe59ad-a6ba-44a7-9bf9-f636b8e8bce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353152, "uuid": "1e22a699-9ba2-45e4-a7cb-a23f040a0071", "value": "24576:TA6XFueRzibx+TD974HxUUOF9mXS+Fo7:hXFur4N7T7F9mC6o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353152, "uuid": "445b22e3-145d-4092-b771-928708869d2d", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353152, "uuid": "976de251-7a5c-42ee-9fc1-8a498e3a5437", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353152, "uuid": "a2e68656-72d8-4904-94bb-9a269aec6e37", "value": "AWB_21092021_Invoice21092021.pdf(190KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f876d7-2547-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633375122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633375122, "uuid": "b6f94628-8c0b-4c4a-b66d-bb86342a0c68", "comment": "Malware payload (AgentTesla)", "value": "bba5e41c8053bbd991b08057036666a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633375122, "uuid": "ac2783f7-b414-4536-be17-e662f4e402c4", "comment": "Malware payload (AgentTesla)", "value": "451d72ce79372f12d5cb76bd3bdc54ab126b70e3499834c0be8069c84378bcf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633375122, "uuid": "b2342a4c-3b76-49b3-8d53-779b98970146", "comment": "Malware payload (AgentTesla)", "value": "ac0d8d01226a52514e0a7f2d326c5a81390b61dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633375122, "uuid": "01c9524c-9bd8-48ea-a4b7-d23eb66d5868", "comment": "Malware payload (AgentTesla)", "value": "61ad017840e48df5b147721c83578de2257b35388ef9000259eaac9f643c16ead957cbd8516e1c4207bf4a827775f180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633375122, "uuid": "59177ef8-0517-4b0c-b278-8a23c6529c67", "value": "T1A82417166714D461CB5F417FC016C20831F1DB07A72AD68F5AA6D8FA1F812CEFA2B9E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633375122, "uuid": "821ecabb-ca20-4876-8444-936bd801da57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633375122, "uuid": "84f3c830-b3bf-48b4-a2d4-3c826ce3d8d5", "value": "3072:6GW3f/rsUzQ1kS7VJLnu+iUiHV5B3h25H4SG3siXowl72SgsL+TxOtpkFP:6jJJSZJb8Ug1C4c8bdNL+6pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633375122, "uuid": "d5d6746a-4449-4590-ae9c-d4fc2122e507", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633375122, "uuid": "838c0150-42b6-43bd-aa22-ac4212b00a4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633375122, "uuid": "040dfb65-a695-48e1-943e-e6784bf6ae21", "value": "bba5e41c8053bbd991b08057036666a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8eb0295-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633363428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363428, "uuid": "2b5cae26-cfc9-49c8-b610-09a73f79f668", "comment": "Malware payload (RedLineStealer)", "value": "2c4fa583724925a71a42b2fa0df7fe9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363428, "uuid": "cae78df4-2a68-449f-9973-ae3d383a9b21", "comment": "Malware payload (RedLineStealer)", "value": "456322f2294df3b13e243170fcd360068d42ebcebf13a481f9e837f031067b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363428, "uuid": "6db94cb5-d63a-47e8-acd0-ea378c4f11b6", "comment": "Malware payload (RedLineStealer)", "value": "ac9753238607950e3c180b9952bc7f5b468721ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363428, "uuid": "7d5ad560-e28e-4b7a-8555-c6c058710d93", "comment": "Malware payload (RedLineStealer)", "value": "2fd41b693cc1c4ccb3247531dd68fc6a696e7bc5a7402bc16abf3e9c13bd6c7b12a5bf20cb0f7b0d312c983fc4a55e82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363428, "uuid": "a3b50590-fa16-417e-b0e5-783a3eb20a3d", "value": "T1E763A477006591A6C5491734F4B50F4B3A7CD6391A80B698F04FB2EAEC1D69D8EF83B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363428, "uuid": "c668b659-06ee-4f04-a7d6-4b04726e4273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363428, "uuid": "3c0d785e-f99c-4a63-86e0-e33e51a062fd", "value": "1536:fgvoTA6Hp1VOcW1IVpV5I8e8PWTo0W2qc:fFTASS440WTL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363428, "uuid": "046e5cd9-7c76-457c-93a2-e0440d42f0fe", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363428, "uuid": "b08919d9-7c0d-4ed1-9564-ae55e0992ed3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363428, "uuid": "a966b802-ff52-493e-a325-f1e5a17bbb0b", "value": "2c4fa583724925a71a42b2fa0df7fe9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577c2ecc-2513-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633352554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352554, "uuid": "17c38543-925c-4d4c-ac02-9596bdb01d86", "comment": "Malware payload", "value": "03bbd37ebde906471d346602c0c70fa0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352554, "uuid": "d68922d9-4c1a-4a5d-b0d0-85dee8d8a7de", "comment": "Malware payload", "value": "45b269b1978b7662a46be31fc750fd991c2fe2dfba029b0d82b6e7840a15901d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352554, "uuid": "7a6f0fe6-6241-439e-813c-652721e78af5", "comment": "Malware payload", "value": "285fb1c54454cd222807def26d10d4641128f6e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352554, "uuid": "1a8c48b2-6d2d-4bc2-b0f7-c8e006d69e96", "comment": "Malware payload", "value": "cb05f5a6f9b8f38b1d60cf5f701926b79e64cddbf4eac048622265e43efc2297e46bff494e6011c903e7a95bf1105097", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352554, "uuid": "1739b59f-f7d0-4128-8ab1-d40508bbb5da", "value": "T17832A6976AA428FBD58D5FBD0D71170ECE51FB22C42B31B419C0D88F065EAE2269C3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352554, "uuid": "90850a5e-62b8-4ac5-9487-027c2ab79a2a", "value": "765bca1f5b63714ef6726d737c2f3cac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352554, "uuid": "192276c6-f13c-43a6-9589-c09fa2153662", "value": "192:PViWqL5wviWqE1m10s+hWHXZrSgBEWYumfA+5oGKv39S3kmrcAhikNCh1w/E/vl6:9iXLWiXEeEWYpZ3NlikNChpmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352554, "uuid": "de55c398-a921-44f2-aabf-f3d81075bd45", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352554, "uuid": "f27f62ea-06c7-4992-9581-3ead915298a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352554, "uuid": "2d90ea6b-90bc-40ec-b067-50d58a809970", "value": "PO205110DX.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb96757-2538-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633368347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368347, "uuid": "1d9ba0bb-2080-4df5-a5f7-27de061f6015", "comment": "Malware payload", "value": "128a2d6105360896238515c941c67f88", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368347, "uuid": "82fa5ca9-8f22-4360-982d-ffe98904c317", "comment": "Malware payload", "value": "4648edc370e61a52c95d3f525391e0154406fd661d01d091f2d9dba9f8a485f2", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368347, "uuid": "f5dd23db-add4-4040-a3bd-67d01e2be66d", "comment": "Malware payload", "value": "b602a512b58a089d5b2df45cd43f778e811a9b83", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368347, "uuid": "a483bc97-bc5b-4dc3-9926-cc5f590a2dff", "comment": "Malware payload", "value": "75645ddbf06701c08db8ab33b8d82583a6dfa107f24065d074809dbcc094c2c3db12d6aa79ec3fec607dfb29b2abd94a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368347, "uuid": "a71be121-ab23-4c13-81b3-9da5367ca9bf", "value": "T1756329B7F3A1D846D95493310DDB83D26622FC945F7EA74B3280BB1E2F386D49D02686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368347, "uuid": "ab9a4f1e-f95f-4874-98a5-60bbef9ecb46", "value": "1536:Gvyk3hbdlylKsgqopeJBWhZFGkE+cL2NdAIG7SPtKoSDu33ufGbD:kyk3hbdlylKsgqopeJBWhZFGkE+cL2ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633368347, "uuid": "9effbe1d-f284-4d90-8f17-6884dbce6e57", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633368347, "uuid": "e7357266-f564-4bf0-bf8e-853686323d6b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368347, "uuid": "63287c8c-f7b5-4072-a3a1-7b52a580324b", "value": "Manulife_policy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf9825f-24f8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633341232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341232, "uuid": "820aa213-b03f-496c-aba1-7793fb46e9c2", "comment": "Malware payload (AgentTesla)", "value": "5d8e1b6a2a16607598f50aab2ea61002", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341232, "uuid": "00fe7018-a155-42cc-a805-b3613067dd0f", "comment": "Malware payload (AgentTesla)", "value": "4667a7f387d44c83ccaa7e742ccc0fcbec117ab439cd1735a4e5831364efc7da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341232, "uuid": "5fb9d258-77a6-4623-907c-56fe674c8674", "comment": "Malware payload (AgentTesla)", "value": "3aea8c59501a7e77eb21e150e909160358e9af50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341232, "uuid": "dfafddce-8d9e-4212-bfa3-1753961b11e7", "comment": "Malware payload (AgentTesla)", "value": "5e070260fe1f1b79ed4a68adb8202decbadbe5596a34c5d210d620a901b81e4e0e0286bb6210e3d7399aaaa777a7495e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341232, "uuid": "d873a56e-2c0a-419b-82e0-f1f90ca6e651", "value": "T10C45016913A79304DE7887F53D65D14227B5B126219DC7783F8CE8ED2F62BB40AE0847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341232, "uuid": "2a4bd1ba-b300-4c37-8c2a-26e9a7f19e2e", "value": "6144:sotMDERQ+3HwOAS0fc1Y316T8rza3VFwKZQxmon4QdFD6aeO3N2gcPPzMu2ArUWw:qESo71Y3Vrza3VbCIl4O1rdTMuXrUwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341232, "uuid": "55156e41-74c1-4dbb-a346-0e2564a3f6b2", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341232, "uuid": "6a5f5e24-9559-4ce9-a79e-68d206c2ea52", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341232, "uuid": "3237d4a0-135d-4a86-9fb1-1edd97b56682", "value": "PO 229156.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc71097-24db-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633328779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328779, "uuid": "3b391057-63ae-4450-9af1-5cb55b2b2a3d", "comment": "Malware payload (SnakeKeylogger)", "value": "435f32113eacbe46d3cf0b9de7b7f9fb", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328779, "uuid": "f5209bef-c9b4-4628-b046-3a90d0756d3e", "comment": "Malware payload (SnakeKeylogger)", "value": "48acccc6de63e6c3998ee2e8f141385c22db79ad40073bd15e49ac73f88bdba5", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328779, "uuid": "f4f318f7-e42e-43f4-9571-2d7715d94f08", "comment": "Malware payload (SnakeKeylogger)", "value": "d115b5acb72c2dab26f6602d25c0228432966a89", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328779, "uuid": "a8ccfc5f-9125-44cb-986a-92175541046c", "comment": "Malware payload (SnakeKeylogger)", "value": "206bb6877a8dc16327d1af976aa969a653bd762f1ac3379799dd3ad0d6e914408b24cac299793e7027bca1b034e4853a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328779, "uuid": "5b08b426-b95e-4d55-9788-42de90ee5817", "value": "T1526423DA412B140DAF20D35746DDA47F47E89FB4ABB47CCA19E2236D01C984836B74EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328779, "uuid": "587d6649-9b8b-4aa3-924b-0c709bfbd519", "value": "6144:kRNThNT/r8YGoOtubn28O2N+3Q/1rdXzTdkiMD9U02nt+MVf:kbTTTj8YJOtuz28O2g3Q9rtaiMhUF+MJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328779, "uuid": "52362870-e128-4496-9848-d75b1191f597", "value": 333906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328779, "uuid": "d3bd84ca-5f13-4a6f-8446-c72519ce41ab", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328779, "uuid": "d7676069-313a-4bc5-8d23-e4b377223fb7", "value": "Order Quotation.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd52631-24d1-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633324406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324406, "uuid": "1ec79516-5c09-404a-be98-6653b29b55b6", "comment": "Malware payload (Loki)", "value": "5e92de9489722f5a8dfa5631415526ce", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324406, "uuid": "1a00e27a-a78d-41cb-ba80-92ebb7f2f2ef", "comment": "Malware payload (Loki)", "value": "48c9bddfba3d0625630fa5d0fbcbfdd1b2fb324c332256cf772b0f25903b4134", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324406, "uuid": "39149009-2cd2-4156-b9f2-21a79d4a0978", "comment": "Malware payload (Loki)", "value": "18ccc1e1003f6eee1c95cc1a8250f816c5c39702", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324406, "uuid": "dc7611ed-0121-41d8-861b-a0bd25b8f545", "comment": "Malware payload (Loki)", "value": "119a1772de060120ffd3393e9a9377d92b5b9c5078d31703561bd71a3fe240eaa9d6a454c28d504f5db1ebf1910194f9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324406, "uuid": "778c80b3-21e7-4f0b-89c6-b326f6c681e0", "value": "T130641266B8582B5BD2BA72774FAE7012E62FDE22E852C08F00DB7395413874CF147E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324406, "uuid": "0b8c4e52-6b9a-434e-9c1c-faa234f41cc4", "value": "6144:nBS14sn5R2ZQlHlxA1apApqZf5SWmsqWhnOMzhVi:nBSjnPWMHlxARpyfqAOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633324406, "uuid": "96a4ab80-9418-42d7-8ab0-3bf0ee047462", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633324406, "uuid": "4cae37c0-74f6-415e-b2bb-ec595f076552", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324406, "uuid": "6d4847dc-1d0e-49b9-94ec-d2531184aaf1", "value": "0789.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6605736-24f8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633341144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341144, "uuid": "db44a6c6-7c09-444c-afe6-32880131a7f3", "comment": "Malware payload (SnakeKeylogger)", "value": "1454d63297f54fac97a7cc7d69cfaf2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341144, "uuid": "45854cc2-fe37-4fb4-a357-8e665912e768", "comment": "Malware payload (SnakeKeylogger)", "value": "492e04190e54a639f1dd9ff77b0d6c2d29707f0367202c613cec98181cb53583", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341144, "uuid": "341f0e2b-d920-4e4d-8236-3ad830474eaa", "comment": "Malware payload (SnakeKeylogger)", "value": "3b7dc8e9f57f103ad717c7eddfe4c3ece4ea10f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341144, "uuid": "28d39c86-2c46-4e56-b725-a3876394d462", "comment": "Malware payload (SnakeKeylogger)", "value": "aeea1da742000b9c287874ea645398f40ea6e6421e82ef6f9fc8057903ec7bf0f598b02b014071876cf4c53bafc39f95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341144, "uuid": "fbc9093f-cdd4-45a4-af8f-157d3f34be51", "value": "T12874F16863A39744DE79C3F53C28E29117B56026245ED73C5ED9A4FC3EA37B80AE0643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341144, "uuid": "732dd90c-7754-4991-99f4-bc10814a7eaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341144, "uuid": "eeb308e0-36de-4727-b8f0-8c57adb782a9", "value": "6144:emtVkERQ+3HwOXaIV4oAGGOnrTbK041EcJz7KzIemftw5TZxsHL0:iESoXaIVVPl41EIXKkLfC5NGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341144, "uuid": "71eaa2bd-e2f5-46be-9ba8-9bc9fc976bea", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341144, "uuid": "73f5aedd-9b1b-44cf-a9ff-c77a4f13011b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341144, "uuid": "2a62ac8e-13c6-4126-ba76-1556d8b60ca0", "value": "1454d63297f54fac97a7cc7d69cfaf2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc84b28c-2503-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633345878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345878, "uuid": "0046e2d0-2433-46a6-88a4-3061246a37d0", "comment": "Malware payload (AgentTesla)", "value": "1bf74dffc0628802538de0922ed14a89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345878, "uuid": "44483fa0-0a14-4f4b-a5e9-dd1268c9f652", "comment": "Malware payload (AgentTesla)", "value": "49c55ffef42b3ed1dd062d395bfa9c9c700f198bfd4f31cacf957b2640f4bc9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345878, "uuid": "5445f310-e5c9-4e94-8cdb-37299c55228d", "comment": "Malware payload (AgentTesla)", "value": "bbf7d9be48007ee6b9f6553586582347aacf1f3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345878, "uuid": "66dbf38f-8e62-4815-a990-700ed7f6dde5", "comment": "Malware payload (AgentTesla)", "value": "b0ed738181f30c60b12ab264b68525ac49b87fcc4620663df720b25bae52430d0c5b4a9ede93fb7b7df9087c6fdca5b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345878, "uuid": "97bce785-7276-4710-9592-f14ec54d5caf", "value": "T152E44A103D968179E47A5F7EDAB863D1A63E7D132F32A03C17703A8627B364D898C176", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345878, "uuid": "42ec2544-0767-4e12-9eab-8dcac2c1b88c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345878, "uuid": "3d8dd622-3751-44e1-b325-7ed841597cdf", "value": "12288:1t8NixtIr+aHRX/5t+KwXIr2k4DbF53e0IUFLcg6:1qUkr+YXn+/XIEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345878, "uuid": "4008beaf-a304-4ade-a594-bc1dc8c50b05", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345878, "uuid": "311197ef-6e30-4141-a5ee-1b312e9e0b8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345878, "uuid": "418e42d7-48fc-4dc6-8bca-e15309581ccb", "value": "Purchase Order KV_RQ-7436819_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295fe361-2531-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633365361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365361, "uuid": "f6574b4d-f903-456b-8dc2-2bbec0f0010c", "comment": "Malware payload (RaccoonStealer)", "value": "028324fcaeb320c598aadb6460183c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365361, "uuid": "34f3d543-7fbc-4bc1-91ca-7f1a7deb0455", "comment": "Malware payload (RaccoonStealer)", "value": "4a4e1a2d468a912cc0d71fc6699d5b35e80c8d1825ff16f3d91130511e653542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365361, "uuid": "1e57e458-a33d-4d6d-a2d9-38a52f5e1a07", "comment": "Malware payload (RaccoonStealer)", "value": "58494c059b60fd0069829de9f1c391d396cc29ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365361, "uuid": "7a7d1042-1c90-4836-abc9-c0ace9d0e780", "comment": "Malware payload (RaccoonStealer)", "value": "9c41bbadde756bc653a2aae3983406b50293c2e64675f0c53406c6e0e28242607cc9f3253e374f9ce5c6522ac0d7e12c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365361, "uuid": "48ed1073-69a7-4fbb-a2ff-f2beb6379c3c", "value": "T173C4F01839B0D3F2E67252B0A766C7F4092EB8FE1D26568F7748271E2E383D19721356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365361, "uuid": "daaa0c79-37b4-4d02-80d6-d672aebbbf3c", "value": "820638e32882fc55584544cedf889893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365361, "uuid": "d63eca3d-b356-4970-bf72-28fa2de01fa3", "value": "12288:WLhpZ9fFGJx+1ILG9+JppzVmX6F168p527JTs7qhqh1zxp6L:WfZ9fFkg9+RzVmX6Fb6Ts7qhqhB36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633365361, "uuid": "aecde1eb-ec24-4fd7-a597-df6665418c47", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633365361, "uuid": "4b0cf337-3dfc-4715-98a5-d3b654074cbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365361, "uuid": "84e8e655-4099-4bd3-8be5-4a8efae6dc83", "value": "028324fcaeb320c598aadb6460183c22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e0ee4f-24ee-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1633336732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336732, "uuid": "193e658d-782d-46d4-a9e8-e975cfefa23a", "comment": "Malware payload (NetWire)", "value": "1ca6107b8c240ddf38a24df58f4a050e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336732, "uuid": "90cc0ce6-714f-4a68-aa97-6a738d2d4e4b", "comment": "Malware payload (NetWire)", "value": "4ade82c3e018beaca2eac5abd9b43266dfe8d3f9ce7d2e66e1f06afe47221ce3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336732, "uuid": "d80b70b1-d8a9-4384-bf02-f2ad250dda58", "comment": "Malware payload (NetWire)", "value": "96fad1dce0c1b57b4c849b70ada2c3a7be6e66b1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336732, "uuid": "85675829-54b1-4303-97b6-f2ece4cf56e4", "comment": "Malware payload (NetWire)", "value": "7f5e88ee3dacf04241ea3157da1212021eda28dd7fe404e04471520f17b5271ce21e0adf85091f6cbd48e2a7d1432eb1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336732, "uuid": "582ce1d6-76d6-40d7-b9b7-5c5ad1bbf3bf", "value": "T1DC65061221405B6DF5123735EC4705A4ABD5AA3E2E018B77F1A8179B4B6F381AEE183F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336732, "uuid": "f9d992e1-a0bd-4504-9dd6-239e1b696551", "value": "12288:zw6jlNSq3W9F1Sa+tiDWIyNbYAycjL7YiEFXXXB:0aeq3gF1Sf+WIy6AyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633336732, "uuid": "87d672e3-2373-4f91-92f7-08c94f7a0cac", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633336732, "uuid": "1577c156-b041-4e05-bc22-239506a1b2ea", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336732, "uuid": "d0bced43-22b7-4280-b951-4cf2a2b3ac8a", "value": "Attached file.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6573c5-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633335412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335412, "uuid": "85b60f92-d184-4e3c-977e-f9a3a7bee8d8", "comment": "Malware payload (AgentTesla)", "value": "41c18fad057867a7b3acda6ebe7b3fc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335412, "uuid": "fbd851ca-eee4-49fa-a8d5-88c26fc0d3d2", "comment": "Malware payload (AgentTesla)", "value": "4af88b1274a0eac4b1adccfde7a51efd4a01c13e668c73dbe61b5678b7d2c26f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335412, "uuid": "8790cd8f-3129-4bc9-a565-79ef26b8e3c4", "comment": "Malware payload (AgentTesla)", "value": "afbd0216fedccffff82a77695c98f936585f0b1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335412, "uuid": "05bf4128-d92c-421c-a85b-634fdf43d8cf", "comment": "Malware payload (AgentTesla)", "value": "675b8eca927f6fc5b319ec0d05bca09440ddd83fdf6d7e04aad31d48fc83cbf7274e75efa970e2836b083ddfe0cf5473", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335412, "uuid": "2af3f9fc-b193-4b30-9745-3fe1f6d33846", "value": "T15DF49E69F60CD29EFD1903B021297CC415EC1CAD197CB92BBEA6B5E230BBD7651F0096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335412, "uuid": "344378fc-77ec-40a2-8c36-2994ca26af21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335412, "uuid": "7663466b-6064-4244-9e59-340989c3b478", "value": "12288:ZlD4VHfQe6ZyWshg+qbZxTZZWunAWviff5mKz9/musoCWn6a8SQNMARGBKSFh4Al:3D4VHfQe6ZyWshg+qbZxTZZWunAWvif8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335412, "uuid": "7d330ef7-61a1-4e54-b927-56cf951c4368", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335412, "uuid": "c02c2752-d728-44ae-bb0f-fbbc82cf03d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335412, "uuid": "45f36304-448e-44e0-9636-410d68f914a4", "value": "9-29-2021. No12300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fe6fc7-24e9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633334731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334731, "uuid": "8e59a252-6dc6-410c-bb38-7dfeb978fedd", "comment": "Malware payload (AgentTesla)", "value": "c61f3d22638cece73c6f4c99fe8b11d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334731, "uuid": "70751157-ad90-4b98-8a18-2b5da76d0d8a", "comment": "Malware payload (AgentTesla)", "value": "4b294934c722d7ed49cf80c56d9ce6e3df5c4406bbdf54c2b3864d1344f13a18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334731, "uuid": "04e983b4-83ef-4a55-9b04-b5fc6e70c89e", "comment": "Malware payload (AgentTesla)", "value": "2f40b522c845ec1e4c71255273162f067c8bc95d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334731, "uuid": "7ca4a5c4-8671-47e8-9309-d378190f5574", "comment": "Malware payload (AgentTesla)", "value": "af2c48265d8fd0c8d95eff3bfb4ad59e986187584bb1c1c877aa6785f52448e0fbb3a33adb373bd9b9fbc0889c1a1a40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334731, "uuid": "380066d5-912e-4440-acb3-e8a22dc50a51", "value": "T10594239B06F1C4A6E9E7C8E822705E35E1F9B29C7107FA1D872477C1A47DDA1C6447C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334731, "uuid": "96f437d5-7552-4dad-9f57-ac958e6ee0a1", "value": "6144:0gVmteKn9vCrDOZ6J+1y1Nytuo02rsbd1j7qeRieLoznFNAti/iQVilOPqPsy7/p:M98rSZG8YKu8rgR7qebY8c/lgOPqPvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633334731, "uuid": "d5ae16d5-cebb-41c5-87fe-e779afa28dca", "value": 432148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633334731, "uuid": "f68ca09a-f769-47fc-b576-57a0401cab8b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334731, "uuid": "3f926a6f-4c97-4b8b-a7ad-81926d894529", "value": "BARI MEDI ORDER INQUIRY 3756653_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46625d14-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633335345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335345, "uuid": "b48c2605-627c-4b1a-9414-971bdeb1059d", "comment": "Malware payload (AgentTesla)", "value": "06ede11563035db3b5a790635a518e5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335345, "uuid": "ce2b48d4-3c1d-4f32-8b57-2732e58aa250", "comment": "Malware payload (AgentTesla)", "value": "4bdea4fc49773052bbe74ad4fbd8edacbc84b4a61725f779dbccda3bd6b9d4f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335345, "uuid": "05772c15-94c7-4542-88ca-e3220d9cc85a", "comment": "Malware payload (AgentTesla)", "value": "0dd2c3d020c7155d9464967a71f04513ae6c0b74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335345, "uuid": "87069504-ea01-4bc2-b8ae-32dd7a487d34", "comment": "Malware payload (AgentTesla)", "value": "44534f1f21114c69ff86568e6900e9846b496757c56cda167d7434a55896c7eb9a1654a94b003cec573388682f0a1414", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335345, "uuid": "e59be44e-92e5-4185-a5c0-1f62205010b8", "value": "T141F48D6DF60CE29EFD0903B021297CD425EC1CA9197CF917BEAAB1E230EAD7551F1096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335345, "uuid": "3bb70f82-3432-4aca-a706-2a2dc3bbe74c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335345, "uuid": "ae3c12fe-ae72-49b7-b2f6-e54ac78c7cc9", "value": "12288:QD4VHfQe6ZyWshg+qbZxTZZWunAWvUfdecL9BTmZyB/7BIM3NfA6toX7Yyy36XYg:QD4VHfQe6ZyWshg+qbZxTZZWunAWvUfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335345, "uuid": "ddd1a2b9-422d-437e-be85-38b6012c89f2", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335345, "uuid": "1a7d94a4-4851-4dea-884b-2c971fc463e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335345, "uuid": "a00348e2-20ea-49b4-af13-1630be53ab4b", "value": "RESM\u0130 SATIN ALMA S\u0130PAR\u0130\u015e\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89cfcdd-24ea-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633335215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335215, "uuid": "27547ae9-8404-4799-b2db-0eec233af2b7", "comment": "Malware payload (Loki)", "value": "e3aecd18c29b2909aec6cd52a6fc5ba9", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335215, "uuid": "64aad411-9bb9-4b77-91a6-591b41233399", "comment": "Malware payload (Loki)", "value": "4c97f713a29c890717f1225dfbbade38deabf8fbae0cb9898def6cf4be8bf5ad", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335215, "uuid": "4da28ebe-d368-46f0-80f8-0a0108cb440a", "comment": "Malware payload (Loki)", "value": "b2b5f6c3c8f26b48530043ba64d0c3cbdf14e8dd", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335215, "uuid": "abc0621d-6dcc-4d37-9976-1566a416dbb5", "comment": "Malware payload (Loki)", "value": "3d0daaf960605a23603e6ff886f0b9f09bb1656cc630634371b2a0a51b506a75fbbe3e4cfd763e2206e96f6ac9863d75", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335215, "uuid": "0395a414-a811-420d-97e6-aae476a79548", "value": "T1566302E28ECF1047CF2357F6C78D2AA6A100044348D6853E159738B57AD57BC686AFAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335215, "uuid": "dc30911a-dfed-4cd2-91f3-4a342c586ba5", "value": "1536:50y3ryfBBGL9unD87qE29EafuEFjOOHD0wRCdEnP4Jd02VzI9:525Gl1iEafueO8DzRc3zK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335215, "uuid": "4571c7d1-303c-4321-9bac-5cf2673ab740", "value": 72252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335215, "uuid": "4341b182-f88a-4fe1-84b3-5620df6babab", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335215, "uuid": "5f227dfa-87a9-4260-8684-ffc558f73b37", "value": "TNT Original Invoice.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67a8131-2522-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633359263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359263, "uuid": "fcaa7425-a5f2-4224-bd33-63c4a5f667d7", "comment": "Malware payload (Quakbot)", "value": "0bca9d9a4e10b794ac05375ebc19de86", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359263, "uuid": "e3803893-4477-4a5f-8659-4d7116c18530", "comment": "Malware payload (Quakbot)", "value": "4cd16d4f199b5f619a377b3c260f8423a9e814cc680edad1505e4038fc38ddcc", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359263, "uuid": "962c54e2-1ff4-479c-9d49-02f9d62517f6", "comment": "Malware payload (Quakbot)", "value": "43983f7c8b45057ec1d732586648f9ac515048f4", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359263, "uuid": "bf25ea6b-6569-48fb-986f-31f132729670", "comment": "Malware payload (Quakbot)", "value": "64edfa2035d1894f018ed4fa82bf0f8600de4cb782e6bc13dfde46761efe43c10b8d86d451f0a953436ce8a6e05f7495", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359263, "uuid": "78dc6552-7353-48ab-9b1e-b2c7ddf4cf6a", "value": "T160D3AD467797C94BE54903398EE3879B3B72FC21DE72470332467B0E4E796A18C16A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359263, "uuid": "5ac60911-3505-4863-ba2a-61fcbf331035", "value": "3072:Sk3hOdsylKlgxopeiBNhZFGzE+cL2kdAxc6YehWfGdtUHKGDbpmsii/+u6ssC06+:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633359263, "uuid": "a11b3dea-20c7-4450-9a0c-9076d8403377", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633359263, "uuid": "1a7718c6-c752-44ce-b5f4-4410fc8eac8c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359263, "uuid": "e71108c5-6693-4564-be09-e3f97f749834", "value": "173536952-10042021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb6178d-251b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633355972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355972, "uuid": "57d6fff2-58fe-444c-8ecd-7242617d59b8", "comment": "Malware payload (AsyncRAT)", "value": "6ab6671c9fbba06f36bf4f655d03f498", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355972, "uuid": "17a800d5-0deb-4e41-8cd9-d582a0e5a5ba", "comment": "Malware payload (AsyncRAT)", "value": "4d5b4eea780ab2393d06f02fc1a6b5f3c490ddd8d768271b7534b75072aaf023", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355972, "uuid": "020bff30-319d-4a0a-8a16-a38c4d434806", "comment": "Malware payload (AsyncRAT)", "value": "02cb1d74714793c5ec3702ca3afbeb45ee7c0588", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355972, "uuid": "4b5c5358-2cf8-471b-a02d-45fc236e2f7f", "comment": "Malware payload (AsyncRAT)", "value": "79d9eef8914429ca2ad4373915b34febe93604179753ccb88f1e614030de6c429a6f446a5589a2ee613672b43510f760", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355972, "uuid": "94e7ea4f-1822-4ee5-a6d9-c8222564050d", "value": "T114A40A3D55282A4CF7A085BCFD719CFF17952C1F88A7B9B3A04CF9870AB97C25416229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355972, "uuid": "d06c9862-5949-4e9c-bce5-a128ea2aac3f", "value": "fd665c8501eb1a152d6b80cff0d63b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355972, "uuid": "2091a7bb-b232-4633-80ea-c5cc1b8710ed", "value": "3072:ySgW8stAeW4guBOvffu6Em5sK4gMs4oFT89lwYX7aVKiEgQ0evwqdV1cxCc8:ZgW8CGu6/yKLLFTKEVKiEg78jcxJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633355972, "uuid": "822299d0-8202-44ff-9da5-552d8331c6e8", "value": 448944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633355972, "uuid": "5cd7b203-bb42-4b47-a089-5e6d30092a8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355972, "uuid": "5a2ba3e4-8dac-429c-beae-2755ae74fa62", "value": "6ab6671c9fbba06f36bf4f655d03f498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842812dc-24ad-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633308820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308820, "uuid": "b4290230-8bd3-4562-bf92-cd2ff87b8c41", "comment": "Malware payload (Gafgyt)", "value": "096862b6c0f9a2a08018982312c30fad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308820, "uuid": "7c9531b0-3bba-4fae-848d-bf4b73caf6d4", "comment": "Malware payload (Gafgyt)", "value": "4e3a3fc0a03cbbcba46d02a55f452420062807a9387f8dc1d0b29585258513d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308820, "uuid": "0cdef806-3b14-4544-b690-5cb682e35922", "comment": "Malware payload (Gafgyt)", "value": "9c59741c80137f3d00dbf42145835a8af6b2af1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308820, "uuid": "312781db-792f-4c66-87d0-2cff0cb53d5c", "comment": "Malware payload (Gafgyt)", "value": "238c0592363c2efc6fe03db7439b3d7785a5c4c3e96ae67dcff4ef8ef1706f81361e53609a24dd877ba8a948419ce231", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308820, "uuid": "fbe53974-bcbf-4663-8951-c453768b4a90", "value": "T128F33905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308820, "uuid": "426411a5-c45a-4ad1-9d6b-156d8738f0d1", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBEYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/eYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308820, "uuid": "1933b639-b797-49d5-9985-dcf3cdc7c200", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308820, "uuid": "238283c4-2962-4f4e-a4d2-7823fcbdf2ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308820, "uuid": "cc324c6b-16e3-4db1-b9d3-150e6c1eaf8f", "value": "096862b6c0f9a2a08018982312c30fad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da33561-24f5-11ec-843c-42010a9c0014", "comment": "Malware payload (LimeRAT)", "timestamp": 1633339572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339572, "uuid": "1db0c3b3-c140-4066-85d3-e1312d04bbbb", "comment": "Malware payload (LimeRAT)", "value": "b48fbc4f8c0f1e01f596e9d336145f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339572, "uuid": "260f529f-7519-4da6-9011-712a0ef4acfb", "comment": "Malware payload (LimeRAT)", "value": "4e658159df74c5e24e1548f5304b1bc881f7986bf43fb687c07e8f5fb531108d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339572, "uuid": "9d3d331c-5b6f-4275-83f3-1ee3b20ef298", "comment": "Malware payload (LimeRAT)", "value": "c55f53523e99d7582365c923fe7dba52338155e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339572, "uuid": "2ba45196-a15e-4b99-92fd-d364a73142e3", "comment": "Malware payload (LimeRAT)", "value": "ba9310d922aab48c52fd52a375fffac03b7b41960eb7a636504b191c0e97d7828296703e817d0aeba31a99c49e3cfd89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339572, "uuid": "96a6592d-60d5-4b4b-88d3-cc52a64cd58e", "value": "T1A3B2F7D2EA9841B8D87A6E3294738E73057F6F7ADA69B44C109DF2377F332824052E15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339572, "uuid": "5107e716-baf2-44d4-90ef-311adb06a330", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339572, "uuid": "3b64ca88-64d5-46f7-b882-2069945da2a7", "value": "384:rx6Bt2X3mgI+Z6ApYAVLK624DJd/SidRssDFmEH/:r1lpY4LK6JZSidGsxmEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339572, "uuid": "83d8ada2-3292-4741-9e6b-13a4a9db4ac2", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339572, "uuid": "3012a0ac-6f0d-4f6a-8b38-1c428dd52a9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339572, "uuid": "899d2c66-19a2-40f6-ad4e-e3e07140ea68", "value": "Copia di Pagamento Banco_BPM_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6996564-24f2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633338621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338621, "uuid": "0385312f-035a-42cc-8c57-9ccd148dbeda", "comment": "Malware payload (SnakeKeylogger)", "value": "8de3f790144bd3aa89553a8d7beda505", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338621, "uuid": "c3e671a9-0371-44f2-98f1-343afd9bcd6f", "comment": "Malware payload (SnakeKeylogger)", "value": "4ed43aa0c0ab7b05cf60c5532d107f30a21efdf9f8d917a07c73d3044494bc68", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338621, "uuid": "fce4b2d2-d610-4c3a-8b16-05399f5634b3", "comment": "Malware payload (SnakeKeylogger)", "value": "ba254e8e3fcd05443ce137bdc1bfd3da0299e805", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338621, "uuid": "7f7714da-616e-477e-9d6e-76eb3ac2c8c8", "comment": "Malware payload (SnakeKeylogger)", "value": "d4ef81a0827dd8c41f9440172b938db5de99125cf56a3c6882f65daffa762254122e96e120ea8507d4051aa6a09b6fc3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338621, "uuid": "ec3154c0-ad40-486b-9112-e5a85b9b3695", "value": "T16E746CFCF24349D18F4A87B653175E88121D307EFBC510A83159EBB929E6E724A09CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338621, "uuid": "352b1447-6347-4670-ad0c-c425ca856bea", "value": "6144:7/0X2D6rhUAurvwn45VZ+Ie53bUQHeNqhqyyYTlNXp:7/uhUhTU45VZ+Ie57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338621, "uuid": "e3e7383b-a323-4620-9358-f246cb840c54", "value": 337745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338621, "uuid": "d065b784-0ea6-4265-99f1-ee95e9259cc1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338621, "uuid": "060f1d7b-bc74-46f6-a431-b45a2d0a6cd1", "value": "PO_662336732676236326326362.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0ed4f1-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633342062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342062, "uuid": "4fad314d-54c9-4adf-ac70-a9ed5a8f799a", "comment": "Malware payload (Mirai)", "value": "92ad36153cfb424dd1b2cab606cfac17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342062, "uuid": "df4b37a6-ccbc-4f57-9c34-985dfb48aa90", "comment": "Malware payload (Mirai)", "value": "4ed69d902fe263225e1dccb4af191272497794966ec0fff2c114adc250382aae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342062, "uuid": "4bd4c0d9-57bd-44e9-b8c1-969b0b7580ad", "comment": "Malware payload (Mirai)", "value": "d46fb822b55240fce81b9ca5dbf20ae1eb2e7780", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342062, "uuid": "096f8420-4fff-40c5-9eb4-e95df3a0b657", "comment": "Malware payload (Mirai)", "value": "28b1db58d42277d0b740f9d0e118adece5eb2d53aee876f83970fa4ae7dd364aab20cacc432590fc1bd66024181f8cb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342062, "uuid": "ec837062-3fab-4f39-bd1b-36320e06f338", "value": "T1BDA2D0B70786BC97EA20593ADE2EC05B27330ABDC3645139065C457CF6C270953BD8EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342062, "uuid": "abc9fbcc-732f-4f5c-9c95-92bf85747a9d", "value": "384:KiYsxYQmXbMaUDOZYCHc4W6/j9mqmVxnAv1iGfvbxJxdYay9iTyhymdGUop5hDi:KtkdgdHk2cqmV01iGl5Ya8Zs3Uoz5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342062, "uuid": "936d0a19-ca6c-499a-b889-bb6ea57b5fc6", "value": 23240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342062, "uuid": "18d85d7d-f183-41f1-9661-f8dea500d965", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342062, "uuid": "696857a3-0bbe-4a14-bf40-b5cff9cae756", "value": "92ad36153cfb424dd1b2cab606cfac17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed0f8d9-24d6-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633326635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633326635, "uuid": "9c7b8c34-b831-4bf9-98fd-67adb3c08a61", "comment": "Malware payload (Loki)", "value": "304e98535152d8d0cd3468101b51700a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633326635, "uuid": "3ea4b061-bccd-4c99-bbcc-a267f6a17ed8", "comment": "Malware payload (Loki)", "value": "4fe846bba1dc6830bde9724ec6046cdac76fdd5db7e885b6356ee4e6d3e3b495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633326635, "uuid": "e8d2d3b1-f351-4fdd-a47a-8183fb7bb975", "comment": "Malware payload (Loki)", "value": "96d63a492090eca34343d2394fca0058c8fbfcf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633326635, "uuid": "f8e4ddda-483b-44c8-bd8f-1d7afd52cdd2", "comment": "Malware payload (Loki)", "value": "383e95fbf746d25117e4d4be6cec56f9519ce015819bf9b025e758409f2dd653e538644dfc34a22abac1a96871125684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633326635, "uuid": "beeb56e0-09c7-4a5a-a1a3-a3a4e4d662e7", "value": "T198E4AE6C3613B9DFCD57CE7699905C60EA61A867430BE313A45319EC9D4EBEA8F001E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633326635, "uuid": "71467d24-1e05-45d9-b38e-2b464614922b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633326635, "uuid": "bc7fa085-8546-41f2-a0f0-e4aaca2e8700", "value": "12288:SdLDc1IhBBBZEbP88aU/uEV1mrJT6YashlM0JT6YashlM6ZVaGiHO5UWeNS6sgjo:SN6IhBDsP88YEg9ashlV9ashlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633326635, "uuid": "462074d1-2a15-4441-8dc0-6a6739613355", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633326635, "uuid": "ee29617f-b91c-4c40-998c-9f08a320f3d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633326635, "uuid": "47940533-fae0-43a3-96a2-ad3b2ffd4611", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2543c2-2545-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633374199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633374199, "uuid": "309fb2e6-a45a-4f4a-b9e1-05a1560621cd", "comment": "Malware payload", "value": "3e27d372e454366e906fe821070608bb", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633374199, "uuid": "8139f425-5047-43c5-98c8-3cf67a851b3a", "comment": "Malware payload", "value": "500856ee3fc13326cad564894a0423e0583154ef10531de4ab6e6d5df90d4e31", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633374199, "uuid": "f4dcfe43-f4b4-4e0e-afd7-2925074b5197", "comment": "Malware payload", "value": "be4d41456335670e78c6e3f19eb2fbd4c6a9a84f", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633374199, "uuid": "07eba645-cdda-4723-ade2-eab326a50e28", "comment": "Malware payload", "value": "a99d5a44e11db1a6bc2030e9a25c8429b85f69f50994e04915a6433f81af7d0d5d9d5209bd94a4dbc777903efc3d3865", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633374199, "uuid": "325c7fcd-f57d-4af4-b056-81fe5f555e74", "value": "T1C9040206B42DE347CCDBC979E84CAFDE12017405CDF52AA5B904C2DC695AFA2379FA48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633374199, "uuid": "2430d324-9a5f-4452-9ed6-b6cace256e33", "value": "3072:J8uM5Dpq6tgBh1fCbX4nhQc+fhwt1YtnGygiB5tpKdAjcSLN8:JeE9NfCbX4nSFhmLc5IG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633374199, "uuid": "f72c6643-539a-498b-8409-031dcaf6f310", "value": 187002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633374199, "uuid": "54736d54-b9db-4272-b351-6a0a1b0d7b84", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633374199, "uuid": "466dffb7-7b8b-4592-86ae-5bdeb401971f", "value": "tn4598151.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0576fc3c-24db-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633328364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328364, "uuid": "64d8686a-c6aa-4163-88aa-6f1216ba4c50", "comment": "Malware payload (AgentTesla)", "value": "bc7220e597649cc5723ab257e6c53880", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328364, "uuid": "915da480-314b-4076-a982-f1b5709bb9a3", "comment": "Malware payload (AgentTesla)", "value": "501ada08eb1cb5a37b23247d47af853a8a1d8e3e78430a9c85ad3db18ca9a263", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328364, "uuid": "5714fed5-9b11-4ad8-98ae-a511e2e091ba", "comment": "Malware payload (AgentTesla)", "value": "a4784d125f02f52d85c9c6b18bc4703a2771922f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328364, "uuid": "a2825565-65aa-4863-8122-6a73b482d982", "comment": "Malware payload (AgentTesla)", "value": "64f2360f6374a470a546f5757c609a9f2ca3953a34b4c33da22e4e3bc40189b825dc0eb13aad2e649b94a26829d6d480", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328364, "uuid": "812ade71-6b2e-4416-a37c-266f3e871d0e", "value": "T125C4231E2B1BBD122435EB7E566B576C332146B9B2709E88503B4EDC33D616871E2CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328364, "uuid": "238692ea-2781-4ab1-82e1-13dc593bec8a", "value": "12288:euNj3ysHBbPUk0fIYmSZ0h26uFVHuHippSQe6iM4kEaRs9:euNj3LBbMeYj0gFV15P4kEaR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328364, "uuid": "58aca9cc-1fea-45a3-b33b-1cd63a8be99c", "value": 555356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328364, "uuid": "4db68b39-c043-4f4c-be89-9ba7418abd1f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328364, "uuid": "6066e851-2a28-4a6b-a7ff-799f6e80a4e6", "value": "DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eec25c8-24ea-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633335038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335038, "uuid": "2fd3bbe3-deeb-45ec-a93a-45cf7d18b0fb", "comment": "Malware payload", "value": "87c5aebc5161603fb6082e18c2a9a292", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335038, "uuid": "e6670397-5113-4696-9f8a-d86720382ff3", "comment": "Malware payload", "value": "50550a54819aba34fc9376f4fe668f8998522ae26184574b0a72bd1c72b27ec5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335038, "uuid": "6dd9c001-8cf1-442d-a270-03a826f760cc", "comment": "Malware payload", "value": "bd2fddb1b74344b261491c22b018e2912eb2833b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335038, "uuid": "545c71f0-4325-4dd4-9a94-b5661792029f", "comment": "Malware payload", "value": "70f7380597804b70771be11ea3098e414a95e03dc708f825f683f7cd6654d36a4fef2f45a39cd7b529d33cf9f1c4d823", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335038, "uuid": "eb600791-b05e-4fa8-80f9-f5c38d278358", "value": "T143D31A20AB3E9FC6D9CA243305B1CA5072716FC46B472393BA6E7B0C1B3DD15556316B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335038, "uuid": "2d204f40-5143-4c66-9861-5bba78da070b", "value": "1536:BDlhhaxEnWYibzrcTXesjpkqt/fdUj7zZaHAyfOH9Sma:VlhhaxgWbs7HttUXzZaHAF9da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335038, "uuid": "22e1c6bc-21e2-4e53-b311-498c756748d1", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335038, "uuid": "1e4d4a55-ddd2-4cc8-8fe2-b3e339d5345a", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335038, "uuid": "5ea86f40-622e-4ac1-a23e-6b25a9a16b84", "value": "specifiche.09.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e413331b-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633339046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339046, "uuid": "b7921ad4-1702-4a96-bac3-befae1e2abc8", "comment": "Malware payload (AsyncRAT)", "value": "22ae26451694b55235d0ba76e2a9c19e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339046, "uuid": "bd8d102b-f637-44d0-9188-b60534bcb5fa", "comment": "Malware payload (AsyncRAT)", "value": "50dec92fbf4aeff0ee0b537a8d94532a0565c79d966d2b726da134691dc05721", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339046, "uuid": "8e1c7a26-fafc-4c34-87d4-78e2abeee682", "comment": "Malware payload (AsyncRAT)", "value": "c5c6702b8a6954a712b5ab167dcfb43ed9086e0c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339046, "uuid": "932b580d-d4f1-4d80-9181-fe48681e3c15", "comment": "Malware payload (AsyncRAT)", "value": "cf001bd790902917113660eebeed7256483c102e1f57bab14c9d005f302c393c9012c068e2648d01956818bfad2ba83b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339046, "uuid": "b154298d-9f94-4edf-a3a6-ec9bfbb4b5d7", "value": "T1F2019EF3E53504D30A22F02856EA10F5907AF7F6A1DCA9C07948A0EF15BC030085D260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339046, "uuid": "7d088f57-93fb-4d21-938e-3d1f6b53fd81", "value": "24:8TTTTTTTTTjb/bCpSsvw8LTTTTTTTTTjb/bCpSsvwgb:8TTTTTTTTTj7bS1vwaTTTTTTTTTj7bSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339046, "uuid": "9c5e66b0-5f79-44bd-b760-8ff5fcce76e6", "value": 815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339046, "uuid": "b7e020bf-bfb4-4cda-8a96-6261afbc0c5b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339046, "uuid": "a2856e0f-9a9d-491b-991c-16ea48b092d3", "value": "State-ment(10.03.2021)BMEI.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb70d9e-2543-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633373313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373313, "uuid": "4e2e1dfe-46ed-4adc-90f3-0ce60377970d", "comment": "Malware payload (Loki)", "value": "67b984f729d6f74590f00472fa67d4de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373313, "uuid": "220908d0-0f5e-4bbc-a33a-711a9e3dd449", "comment": "Malware payload (Loki)", "value": "5145758b55dc0dbd9237ee0c0bb77b54e8b71be82be9f37bb95baa49704f4ada", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373313, "uuid": "75bf316b-aa59-4269-8fdd-6799396e917b", "comment": "Malware payload (Loki)", "value": "f2c05b4f1b526a6932dc8e6155c2ccff82c40b02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373313, "uuid": "310d37ed-19b7-4390-b391-dd4b56d348c2", "comment": "Malware payload (Loki)", "value": "a5ffe67947d0f8030c9912d08249095fca881f5f6af2d316a25a53c0b2351cff8b27905e0e8653f78fe1800602f03db3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373313, "uuid": "2cc16d0d-94da-42f5-b555-74743881d576", "value": "T1C7A32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373313, "uuid": "8d1af9b8-f1c0-439f-8cad-d709bf52e745", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373313, "uuid": "77b0f370-719d-471d-9574-5e19344a012c", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633373313, "uuid": "c4ed6650-cdaf-4566-a9a9-9b7eb27f632e", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633373313, "uuid": "f770f477-d85c-4c1b-b82e-1beedd26b2e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373313, "uuid": "a18c04d9-2762-4e54-8d1b-920d56cce424", "value": "67b984f729d6f74590f00472fa67d4de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4873444b-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633343080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343080, "uuid": "74648787-4e9b-4b1c-9b36-92b3cd2b2dd2", "comment": "Malware payload (TrickBot)", "value": "c9ad136446d215febffbda4c38ff1275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343080, "uuid": "86702721-de81-4034-83ca-7edb18397cfd", "comment": "Malware payload (TrickBot)", "value": "52ad00166829d7c43b67ae8304739f9e5f107467d8e964ba10bcb897f40e7e81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343080, "uuid": "b8fd5e4d-e5d9-41f5-9586-11d0a6cbbe1c", "comment": "Malware payload (TrickBot)", "value": "2c931584bedc75c46d524d063bd307891f1b693b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343080, "uuid": "d8ac6068-8eca-49fa-a4f0-4cc4e26d57e4", "comment": "Malware payload (TrickBot)", "value": "01780a3cfb90ffc414266df064a92a85365211be19570031a3ad19379f7c58e73766294f3691f26536fd73687d0c5700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343080, "uuid": "d4fd1330-4d31-4ba1-ac2a-1d4281694b3e", "value": "T10594F1123AE0C877D0A745314EF58B79B6BAFB504F318A6F23D90F1E1D31A518A26376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343080, "uuid": "97b13993-6f26-4dde-8799-716ab4364c7a", "value": "220580f49c2724e661575b7bf3bd58ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343080, "uuid": "b0005a59-f4df-4575-80e1-0369915e87a6", "value": "6144:h0lJVu5xP+oTEm8NG/wBHRSIAR9687dX9szOHMVT+R6NWPFgQAXaneCrvD:h0lJ4jPTzwn+96sdX9szOHMVFCgaJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343080, "uuid": "2cd3ad52-dde1-4b5b-be23-9de7cdc69038", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343080, "uuid": "f60298cb-c47b-4f12-b588-b6e2f9af5d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343080, "uuid": "1b2c5e7a-12ec-4ba4-9430-ea2046fcc5da", "value": "c9ad136446d215febffbda4c38ff1275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37318f5-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633339045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339045, "uuid": "2da2b076-deab-494b-ae08-ceca0249098e", "comment": "Malware payload", "value": "39a253177f63e36e39d135fd8fa5866f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339045, "uuid": "49b52498-c53d-4fec-83ab-a8229d26e295", "comment": "Malware payload", "value": "5319f05246dea9cafdb59f0c1368aa065ab135903aef136171b8cf2ee5c2b31c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339045, "uuid": "9d8d8187-94c5-405f-a289-7c739fd90637", "comment": "Malware payload", "value": "46b0081b7e91a8ef71aecf7a2b7beecfad833651", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339045, "uuid": "00186afb-aa44-45e2-8484-b633f52001e3", "comment": "Malware payload", "value": "df014d940b4466aa6157b7db59bc768cc56d8780687bcaf0619e5532c0861103e978e657f575f6e21f95242613572069", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339045, "uuid": "e046c800-a240-4e89-a217-32443f9fcf4c", "value": "T1A321233F6E5B80362A1A57CA2569BCDC8982905CA170FC02B945CB4E858976B72B980F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339045, "uuid": "4b6f4702-0c04-460a-b4c5-fb239cd3b97c", "value": "24:CHr+ndJhH+H7amKQbj/R9r+ndY/R9+H7vS1JDovlwPVtf2VVtKyeKQTGVtymKQ93:CHrgHg+mKQR9rl9gDSjMvmVoVVAyeKQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339045, "uuid": "f16c3f7f-afa7-4cec-9353-3fd6c9eb30a1", "value": 1358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339045, "uuid": "c8cfe741-87b3-4827-9dfe-c2f950b649ac", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339045, "uuid": "673fb442-29f0-4bea-bcdb-8b66cbbf25fc", "value": "ORDER_MATERIAL-REQUIREMENTS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b439b15-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633352963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352963, "uuid": "6cddc324-edf4-4b82-9795-bcf50c3a5b9a", "comment": "Malware payload (AgentTesla)", "value": "511c679f5890cfa80749cfd3f6e5aed9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352963, "uuid": "284b9024-0e4e-45f1-8698-2c848afcd85e", "comment": "Malware payload (AgentTesla)", "value": "531db473c8a5e3ec34e29519cb6ceb9b72a8cb3f8dd64b62e1133020f4101093", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352963, "uuid": "0155e549-820f-4927-b450-ae3bb26a5046", "comment": "Malware payload (AgentTesla)", "value": "9238e44f4a4b111bc9e19a4e3a80349a45d97b69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352963, "uuid": "390dec0a-cde7-451d-9c06-8a022bfdfde0", "comment": "Malware payload (AgentTesla)", "value": "25fc165bed3fba03f316227975cc57517018c4c2250128b1990f1f66aadcf6a104f71aaf25674567a00edeaaec576c91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352963, "uuid": "b945e6d1-962f-4e79-9c48-7f6b1cf0ad8f", "value": "T10594016C62A76344DC7C87F22C24A7505BB6686A215DC33C1F8CE0ED7D63BB46AE0593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352963, "uuid": "386af90e-8166-4b7d-8550-e51026c751c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352963, "uuid": "3a2e925e-b370-4aca-8ff4-b4acc5d589ec", "value": "12288:UESozRx60C73DoEfdyQ/xBV0jkeq/huKaNbX:UESqRx6FoEfdB5CZqf4bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352963, "uuid": "7bee4b9e-9471-4dc6-b6d3-d2a4098a59e1", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352963, "uuid": "c9502bcc-ef4f-4efa-a588-c5f40a5f2fab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352963, "uuid": "6b2bf093-0e91-49f6-92cb-19ae7f905554", "value": "orden de compra OC 15936.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f033c42-2507-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633347359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347359, "uuid": "2e4bad7a-d087-43f1-95f4-462b3da72709", "comment": "Malware payload (AgentTesla)", "value": "bf74d85de2c93f586be682de9e3ed720", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347359, "uuid": "b486ee63-85d8-4975-a6a5-ac844c2becd8", "comment": "Malware payload (AgentTesla)", "value": "53aa4eda9c7c8d8ab4f596b2fb108d08628edb80ebfc3a4ceb02bc0595496cfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347359, "uuid": "6782fd14-3200-4dc9-ba83-75d8ce35c618", "comment": "Malware payload (AgentTesla)", "value": "5627fe2b4e83feae3f1d5e7590fa970a67dcaa1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347359, "uuid": "ea60386f-6526-4abb-b589-10391c69532c", "comment": "Malware payload (AgentTesla)", "value": "f7fcc9652fb2a1d32f14fbea2467c751f0f7fb237e16af8cb50ceff5b90058fdd6d4e4ef8345e094079a0d033f5d4fa0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347359, "uuid": "976cfc30-440b-4bcf-9259-a4088915096e", "value": "T14964125720D148F3E1E946F22FB9B0B9E533D658A53075428B7A0F673E32A42A60F375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347359, "uuid": "6f5ad7db-2545-4dd2-b0a6-bf8690971f8b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347359, "uuid": "5c0e48fa-8e0f-447f-a4f7-ff4a023ee646", "value": "6144:F8LxBsv+sXBGda267v+rVroSc+knKBTKktzx1NBrW0:/vzma2KOn9knOH11NBrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347359, "uuid": "66ae7dd3-b6fa-4e8e-a165-9a84bdf7c11b", "value": 310002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347359, "uuid": "3643e1b7-1861-4782-8a00-4b433fe32c99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347359, "uuid": "74d136c9-78b3-4d57-978f-4f0fd6d417d3", "value": "ORDER,jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78601b42-24ef-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633337147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337147, "uuid": "7bc3f885-2948-4338-ad13-0b4180dde4bc", "comment": "Malware payload (SnakeKeylogger)", "value": "463e8b0760e23af941c60cfa1678a657", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337147, "uuid": "62b87028-a627-41a4-b3db-2fb4bf675662", "comment": "Malware payload (SnakeKeylogger)", "value": "5453ec79288142e9f5f65db0f236e9d1faa1d3ffc981491c2b2c771fc04059de", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337147, "uuid": "ecab1a2c-dddd-425b-9934-5c2b50187353", "comment": "Malware payload (SnakeKeylogger)", "value": "5b71e9eef6a49863369be7aad5c977d83a12bb1b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337147, "uuid": "c6f7e909-beb0-42bb-be09-730856524eb9", "comment": "Malware payload (SnakeKeylogger)", "value": "84218f0f43c240e82773a4d52fc0e509aa0642f41550c8e2721436371dbb5b6b664ded4bae174e812bf3d272286e22cc", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337147, "uuid": "601b9600-5b48-450a-9f1a-db8dfb10d367", "value": "T1A85423C5DDF8D216C62D1C3EC2BFA6DF2B4A50A2296D284386E4502BC582707C5F9EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337147, "uuid": "895d2f5a-644c-4442-a689-ffd8b93e9293", "value": "6144:XSr0Xz+i4tuLUawpd4zdZcDXwNgZMj9BR1tco9fIs2N:A0j+i4tRpdHXwNgZMjHZNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633337147, "uuid": "130a537a-305e-41bc-b8f5-5e55eea50578", "value": 286276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633337147, "uuid": "f817a168-7cee-4884-bc10-d94071bfc7eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337147, "uuid": "63ff80d4-ea59-4914-9af1-9c9bef832854", "value": "CHECKLIST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03b890c-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633342073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342073, "uuid": "2e0ee299-cda6-4a35-93fc-59598f6c0a5a", "comment": "Malware payload (Mirai)", "value": "6ff43fd66f5fc1f9d4777e87f3c29159", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342073, "uuid": "cd630435-a296-4787-96f9-3250b0dc99ce", "comment": "Malware payload (Mirai)", "value": "55462c2267fac07e7566481388ead9a262236e789fbcee5be289e4573c13b6b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342073, "uuid": "b297e224-4e01-47fa-a0b6-9efc1d3bc226", "comment": "Malware payload (Mirai)", "value": "0213dcf2027ac61731446d98700b121966364d01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342073, "uuid": "26f73c83-9be8-434f-8ad7-15ada6760462", "comment": "Malware payload (Mirai)", "value": "6a4afb150a2a7a704767aa65617abd461d011fba64a4859abdb53a35280b0c15f99746a0bbf04459fc17e2515e329d3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342073, "uuid": "98cbcc82-b31d-443c-bffe-de0f034b2a25", "value": "T10CB2D090E2951CD5CFB2DF314D02DAC63B81AF6B12B78DA0B15AAA26414702F6274EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342073, "uuid": "888c8717-3548-4110-9043-2e462972d601", "value": "768:TgxuXvVBTzq3WZG+Mv8pyoz7f0G4aoWYQpZ44uVcqgw09t:T1tZAWZG+MvMscRpS4u+qgw09t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342073, "uuid": "c943963c-5852-4baf-be02-cae57cc4051d", "value": 25364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342073, "uuid": "6103da7c-1c44-4228-afa3-1a0bae35e7e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342073, "uuid": "e0c03932-9f8f-488b-90ed-a4019ee6d97e", "value": "6ff43fd66f5fc1f9d4777e87f3c29159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4730351-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633339047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339047, "uuid": "43e3e263-5617-4d81-878f-0347d3820ee3", "comment": "Malware payload (AgentTesla)", "value": "ecd12f46c01d7e107c0fa2b4fd18fd85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339047, "uuid": "81f17f53-2c22-485d-b36a-29e776c88a22", "comment": "Malware payload (AgentTesla)", "value": "55499c3e014c5934066331668e0fdc3976df5affb86ac2fb1d8d08a07a07e95e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339047, "uuid": "81692d24-03a9-4266-bca1-6a79f50ea6e4", "comment": "Malware payload (AgentTesla)", "value": "ab9138cdd9902f0b612af276de9c62db715e8385", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339047, "uuid": "19bec926-0f77-4240-9b4b-995473e2a1a3", "comment": "Malware payload (AgentTesla)", "value": "32752298b17912d25bfce6bbed1fc4e64df8aad82273aa5700a1fb9a204de359be23044e405742c379a6ce718b95becd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339047, "uuid": "c218f9db-100b-4b6e-9ea8-44f182bf9835", "value": "T1DDE49DDA1EB497CBFB0E02F8F5752B8813BA9C28E59BF2C6CA45B07311367544920DD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339047, "uuid": "1bd0b023-389d-4ba9-a570-4d1f48f82110", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339047, "uuid": "49696b36-267d-4524-b8af-660ab4d599b3", "value": "12288:FzTzvNi+hBr7IUAaJNYpY1Vzy+olLAcNLG9+D2+UhmqR4YStWa6dyop:FTNi+hBr8UAwNikzRuDNy9o2pmo4rWaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339047, "uuid": "085e90bb-be85-4159-8da6-fbec70eb9b15", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339047, "uuid": "945bcc8f-7146-4cf3-a2f4-787a4a02ffc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339047, "uuid": "f6c16f2c-ebae-431a-98f4-718725a467de", "value": "PSR Form Rev 19 - 2021.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad905f3-250c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633349687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349687, "uuid": "2caf8cc3-4ce5-4624-877e-552e5681eae7", "comment": "Malware payload", "value": "a978153e57178abca41d538d8f48880b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349687, "uuid": "aff26686-4b17-4a55-a8f0-10040f8e6651", "comment": "Malware payload", "value": "5579765f207c78ba655fcaad29bcee3baf9febd8005c399107eaaa8a95a00cc2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349687, "uuid": "de9f9201-567b-401c-8836-36a16a2c5b49", "comment": "Malware payload", "value": "d5067ad4e98ab7797c2f92a4a052de3af43793a2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349687, "uuid": "d67430c1-abc3-40e7-849a-627467d8d505", "comment": "Malware payload", "value": "47a729b35a7746f5dae1afcebaa54826270d591f9fa532624f5f998da8bc4c594a0fa9eb733c28e9adc6d9fa600f8968", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349687, "uuid": "a44a45d5-5607-4323-9cc8-f3b7d6d566c2", "value": "T19CF0626A0108C55A0FDB87D780F3CECEE2A5B2460430E2583FC4C8CC220836D034106F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349687, "uuid": "66ac4dee-2c2a-4a0c-8cf1-414513fe8bc6", "value": "12:hME9hTx4ZFM599EqPuJY19E7ngd3pjmkevAUgCP5PtpIXyP4O040wXdhQt:n9EI58qPuGEj2xGvAUgS5FpqiD040wXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633349687, "uuid": "65eab4de-36f6-4885-9a91-5b9a314ac3b9", "value": 648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633349687, "uuid": "a8ce720d-81ca-4076-b01d-333a3c172ae4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349687, "uuid": "987c3733-55ce-4f8d-b3a9-32dc6d09f44e", "value": "031254788225.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724c322e-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633343150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343150, "uuid": "fbafa218-7509-42e8-8293-6b1d3bcdcab5", "comment": "Malware payload (TrickBot)", "value": "c9fefc795e16cc9aee3778d6fea34dff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343150, "uuid": "8c5ec7c4-d8de-4175-a423-40222a8698ea", "comment": "Malware payload (TrickBot)", "value": "55a8de65567c29673ebb442c23dadc61356e13dade8c5a2430759ab91d847366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343150, "uuid": "9a1f0799-6d46-4b4a-b9c5-68e873256fcb", "comment": "Malware payload (TrickBot)", "value": "b2346ca46f6aae1d7633f98d413d394c720ecccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343150, "uuid": "4a201eed-9bd8-4f05-93c2-60bda7832bd0", "comment": "Malware payload (TrickBot)", "value": "4afbc08d9d575c77861bcab14a60d97e99c95577ac2e8a0412b2ea2a1f5b46be12026ac50669f370f4f19b9d57eb7dba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343150, "uuid": "fd5b2273-c360-4a43-8348-fa13bd45df72", "value": "T16A94E02236F0D877C16715309FE59BBCBABAF9104F724A4F33880B0E1D35A525A26776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343150, "uuid": "2861ed8e-3f76-4fd7-ac1a-b0ce4b2d1235", "value": "220580f49c2724e661575b7bf3bd58ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343150, "uuid": "67ec5117-cc7e-44c0-82f0-b5bdd3d3fa39", "value": "6144:wkdJN4c+ePGc4r1tJ3VQl/XE3dAPr3x7835OPeFPQimA6Vk58qVEb9pE:wkdJLbPytlCl/XIIx/lbVMlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343150, "uuid": "6ce9338b-8086-47ac-be5e-84b9edea9798", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343150, "uuid": "bab14835-a898-4ffa-a078-ceebf927440d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343150, "uuid": "a578d0b3-8f2e-4aab-9b9b-ed02cd46e401", "value": "c9fefc795e16cc9aee3778d6fea34dff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea81f72-24de-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633329695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329695, "uuid": "42d22344-bd82-45a1-bb74-22c865349a39", "comment": "Malware payload (Formbook)", "value": "89b906ba0b009bfcde36cab9b0a924a0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329695, "uuid": "850a0b7b-6b91-4a23-886b-b256a6df549a", "comment": "Malware payload (Formbook)", "value": "565a2b38ba347067be698438e5d6d56ecfa17d05990cd62332b19887ebe4dbcb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329695, "uuid": "2d76a01f-da7d-4738-9165-d6b27e426f63", "comment": "Malware payload (Formbook)", "value": "d4e1dff4527371e307742e45a8b3077fb0ac0336", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329695, "uuid": "e9452582-9695-4712-9262-148ba7396bd1", "comment": "Malware payload (Formbook)", "value": "2418169eca42e8de92e903f79904f583a4ac9d3310ac2713db6f650406bf3e14dd5203c7aaa73cfbd7b912760f4409cd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329695, "uuid": "385dbc29-dd2c-4e85-a1a5-e8bf55cf5c41", "value": "T1C352BF1DCF870906C6F24A7DCDC707348922164ADE6E8524FB67995BC8ECD8C81B3953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329695, "uuid": "f36e442b-6d9b-452c-881e-3d08cfd8d489", "value": "192:1btWHzHui7XbMiT5k6ZBDSOZeAcyIAAOugGRotdG6eSTpXXCI4MKjz4frOsHNbpS:1yXLYidDBDpoVKoO06XTdmV5GNF2K4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633329695, "uuid": "8fe47c33-f13d-4410-b23f-c095e4dc903c", "value": 13662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633329695, "uuid": "53aa17b6-9d67-4f4b-ab69-b2a6feca5b34", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329695, "uuid": "118d5404-b496-4ab9-8f6f-733200c99d54", "value": "D776885863728261937.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c97cae-2503-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633345699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345699, "uuid": "656522dc-57d6-4f8d-869c-bd836bd1dd81", "comment": "Malware payload (AgentTesla)", "value": "31a70c300f7286f3621ae7836616190c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345699, "uuid": "8ae933d5-8529-4273-9fd2-035448c3b085", "comment": "Malware payload (AgentTesla)", "value": "56b7b7798a01e1bad522a375b7b096efeba0e118885b353b525b44471cdec90e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345699, "uuid": "73001c9b-e1a9-4ccb-9a2d-2ee748282b6c", "comment": "Malware payload (AgentTesla)", "value": "094b64bbd18840512fc9e044d79bb32cf4dc9ca3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345699, "uuid": "af7fdc5c-6485-4c9b-8fcd-79097b34e640", "comment": "Malware payload (AgentTesla)", "value": "64f49c600a8349fd601a180a6dec3ea6b4c4e9afbf0e335f49a0f85f58e72c329ce4c5ecdd924f412640cdb195dbd82b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345699, "uuid": "215fd233-769d-4024-908c-1c1453bc0290", "value": "T1B654E05D9681FEE1C79AD970085243B185B5D4897B30EF73ACD66A47CA237F080ACED8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345699, "uuid": "98b27b59-6e6b-488c-ab93-5ae8783a76ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345699, "uuid": "49e3e215-f833-4f22-ab33-89d970817d2a", "value": "6144:RJe+FBq9MaeSDWKKZM0sExVyGuczaN1vTLpe+5H:RQkRaeSMM0sEvlu+Mv/0+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345699, "uuid": "cdbe729e-1c77-4970-aaae-41b2e6f0c4e3", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345699, "uuid": "63be627c-3113-4b22-8e21-ed93c4a5cd9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345699, "uuid": "c28b65f0-764e-4cae-81ab-25faf75edd9e", "value": "SD LOG BULKER.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685ffb49-2517-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354300, "uuid": "cf02b525-decd-4f2b-ac0f-22f2fd2bd9be", "comment": "Malware payload (AgentTesla)", "value": "cb6a95674bb70235e1f05f93eb9a8949", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354300, "uuid": "c1005a78-6bb5-456f-9761-0fbd7702736b", "comment": "Malware payload (AgentTesla)", "value": "582cbb61a7af84c06255bb0297bd6d0c2084258c57c2aa83e47473ae49cba1c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354300, "uuid": "f64b6219-a8e2-466e-80f8-58ca093bd397", "comment": "Malware payload (AgentTesla)", "value": "e675659ff4724d6ce0143a871b5b96b6993c84cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354300, "uuid": "a68a9fac-e800-48e5-a6d7-2e5a7a5a53ab", "comment": "Malware payload (AgentTesla)", "value": "aac5a70f90b004f3010c5291ffdce3f87a36572abda73b6a5b9660e420085b68ed3994ec94de3ea50a04630cd10e5174", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354300, "uuid": "e37ade29-7fbf-41a5-b383-664ecc3a0fd1", "value": "T11255F850378E8D85F03B2633B01B4CE655B92A0DE3B9C68E16963B974DF67D0413EB98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354300, "uuid": "8702028d-5890-4e54-b92a-d5f5e51969ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354300, "uuid": "cb59eae5-466b-4c38-8c59-e54c11f1dac3", "value": "12288:FirOw5r0zGhfGJ2mivi3DpP4iwGHNelvv0Rt0Yh2K046Mnq0UnsO5lJkKzUvoPUN:5xgROfo7XBukx/oddn3VgwJdzlp3Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354300, "uuid": "d2b7dba0-eb78-4933-82d6-0fd04989b78d", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354300, "uuid": "8a37db11-238a-478d-b0bf-03d353d29a5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354300, "uuid": "6aa38e8d-3c83-4cbd-b3f7-e1a0af04f89f", "value": "PSB2110040067\u53f7\u7801\u660e\u7ec6.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73263f2-24dc-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633329200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329200, "uuid": "1d298a06-1e42-4b57-bf06-e1bdf1719f1e", "comment": "Malware payload (Formbook)", "value": "9b8f96489ef491a4378ae2552ee9950f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329200, "uuid": "78327f40-0726-4b2e-bc37-3da8e4c2c623", "comment": "Malware payload (Formbook)", "value": "5852e0b1479d914e16a2f1cf21d61ff4e1f3d35b6fa5dbcf0055cfc2c9a89936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329200, "uuid": "de52abef-7d16-4938-9108-c407456eb794", "comment": "Malware payload (Formbook)", "value": "276b5857cd4b0b4289660efa6751821df93f374f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329200, "uuid": "88b66303-2d62-4bbd-a45b-c6a023d31aa3", "comment": "Malware payload (Formbook)", "value": "3e897e9246c0943a5a7fa4e8e61fbe221b29a2223c461550d3305a299695380ab74299bc0e6ab67babc4e969ba50bf16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329200, "uuid": "63bbccc4-22ce-46d7-9300-c75cf5001ba1", "value": "T12344132EB6D194F3D92252709C79CF36FBB9C97E119565038F612F6B490168F200A3BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329200, "uuid": "6ab5b671-c881-4caa-aa37-e4d06530a1af", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329200, "uuid": "a5dac8dc-6bf7-4966-a47f-c8b6bee736e4", "value": "6144:F8LxBsMM0ev4yAs/lCDDtCupqxt9smUMHoeE/ZRPCb3tk:/lQuq14xghR4dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633329200, "uuid": "5ea6dbf6-2fb6-4008-9d24-46d32440592d", "value": 263005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633329200, "uuid": "bc7d81db-58e9-43a4-9aaa-28211979e1a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329200, "uuid": "d9f68a41-b72e-4119-b578-7878fa74e9eb", "value": "doc#0210903000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bb2be9-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633343349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343349, "uuid": "a31175d5-cf8f-4a24-8048-9a85b6da54f7", "comment": "Malware payload (ArkeiStealer)", "value": "5bbcfeee1c22e46591cb95eaf9a522dd", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343349, "uuid": "879648e3-1d26-4b6c-8d49-bca2d1124371", "comment": "Malware payload (ArkeiStealer)", "value": "58b28d0fb02804d51d7b723369894311f4c5250af3bd2aaa0b1033d9c3998059", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343349, "uuid": "7264e3a5-6c19-480b-9e45-5b64282408d6", "comment": "Malware payload (ArkeiStealer)", "value": "d31a0f7135256b749edd56b6a00e8ba29631a7d6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343349, "uuid": "0f1c7b5b-5223-4403-8330-1af85b2a4092", "comment": "Malware payload (ArkeiStealer)", "value": "5d2ea0a902f27bf00654aee6a96312fb7a07ba58630b0a5cbb01e19c26989d5f92cd6a3cae3b62160570b6a8c330ec66", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343349, "uuid": "bd691361-7836-4c18-a652-137eb94502ad", "value": "T110F402253591C3F2CB770131BB0EC7F1092EBC5E6F66964F6B98676E2E3E3929911204", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343349, "uuid": "594d66bc-f757-469d-bfc1-8a45e65d8811", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343349, "uuid": "7e35c1a5-36f7-4731-8df1-bf7ca3395d7e", "value": "12288:5w2DBRIUwM3j53t19Xr7kctOisOWifhf/2xf4vuMx6MxWaGERKL/sjxhgQe/+wKI:5JwUHz5H9vjtX5f/CauMxrqEELMngoFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343349, "uuid": "e685b6f0-30e4-4225-8a9e-c771aeca423e", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343349, "uuid": "ee1c3577-bde5-45bc-b401-7dc08446aa2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343349, "uuid": "c9b6ebe9-0f30-4976-9491-4ed799ea8ac7", "value": "5bbcfeee1c22e46591cb95eaf9a522dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd74ce4-252d-11ec-843c-42010a9c0014", "comment": "Malware payload (DBatLoader)", "timestamp": 1633364000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364000, "uuid": "7d701624-0080-48fa-8c89-820dd1612a64", "comment": "Malware payload (DBatLoader)", "value": "48a883923bdeb3d9cd1c2c15a002762b", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364000, "uuid": "d72d3d9b-e936-4360-84db-d11e59560f10", "comment": "Malware payload (DBatLoader)", "value": "58d1175c71df58cf8befef187f0cd6c931ec0a52d8a37df4d13ff867a609c4d0", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364000, "uuid": "ccf7716b-88be-4947-b82a-437ca0877931", "comment": "Malware payload (DBatLoader)", "value": "307412391f3827bc6b09aead8edc73b5ce4d18cb", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364000, "uuid": "81ab0c23-98b9-4072-8cff-0cb19c5cdb27", "comment": "Malware payload (DBatLoader)", "value": "7477f342cdb42e2e8761df85ebf3ab9403cbada1d09a4481b9ca282d7c4f7037f06a5043b608ae9e73e975ab592a1b4d", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364000, "uuid": "fd6f7e96-c0a9-486f-aefc-be442858acf3", "value": "T124053A725250AF75D12F2D785C5BDA8C902B3D847D2ADFE500B9BEB63A342E43D5A00B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364000, "uuid": "814f9367-3376-4887-8efa-a28d2071a945", "value": "ff0bb68e944131943365efbe4d5b9737", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364000, "uuid": "65de8919-ff06-45e5-a9fc-fbcca23816fe", "value": "24576:DMvnUyU3fec2QPesTtGIZHrIzvlZwXI7Dyj3SaH+MJF:DqUjes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633364000, "uuid": "9fa73b8d-2b7f-4715-85ca-27f10a0e2950", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633364000, "uuid": "c80de808-90bd-4389-af8c-4a95f2d976e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364000, "uuid": "6914276d-e57b-471d-8473-2eff29864458", "value": "48a883923bdeb3d9cd1c2c15a002762b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c6feb8-2528-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633361710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361710, "uuid": "18621b19-1113-48ba-92c3-baa93139736f", "comment": "Malware payload (Formbook)", "value": "b236cb23e21d653da24854a78621a734", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361710, "uuid": "e7644b63-d16a-4205-8f68-d858859f85fb", "comment": "Malware payload (Formbook)", "value": "591d5e87b26cd03ea5de4713869cc4c492f8c53c0fac150ebdb41eedf3ab9a3a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361710, "uuid": "2bd3288a-3986-4618-ae38-49d132823451", "comment": "Malware payload (Formbook)", "value": "fce0cd7d773f173ebfc583318f29714c7e0b072a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361710, "uuid": "74e45bc1-b394-4ec6-a6a2-f32b07997106", "comment": "Malware payload (Formbook)", "value": "adc98b15066678ef64e27aca32eec18e9388b21c192768f48ac3d0269685d8676f781c394b050229b9b3b1386e0d5a83", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361710, "uuid": "d2bc5329-693a-4478-848e-c910151306e8", "value": "T13A74236C8E7849C0EB3F7F5B1BF8B284DA62E955CF76561A03018F4ED314E501A22BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361710, "uuid": "ef1de243-8ebd-4bdf-807d-4ae2d4addbc9", "value": "6144:HmtCfYtECRQjiZ3a6od2gjzCnPW+mX2UcG+RTnCdA0IMyLrPmYQj5JaAxGn0aLN5:GRvQjCK6Lt++/M+FCMHXr+5JHLaBZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633361710, "uuid": "f12c6a57-c7c4-4ef2-ab83-adee5935ba4a", "value": 344052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633361710, "uuid": "a3fcc4ce-b153-4582-9eca-07df315a00c1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361710, "uuid": "e8fca721-7640-410d-8879-6f6761d5bed1", "value": "PO.10032021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695408a0-2520-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633358167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358167, "uuid": "f645c0ca-61fb-4baf-99b2-24c1f7f0f843", "comment": "Malware payload (NanoCore)", "value": "500962576bc4fd9b1237f91c0741ea48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358167, "uuid": "42c7a641-f734-4013-896d-161eb0de7877", "comment": "Malware payload (NanoCore)", "value": "597baa2b442206336c582937353817b978ea97a86be5a864af1c94599dc2ca55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358167, "uuid": "5aa10339-70aa-4694-858e-341ca7d1cbbd", "comment": "Malware payload (NanoCore)", "value": "4dbcb033fc08f70d39c709b01350aec92b2de97c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358167, "uuid": "ff64b775-f58c-415a-8400-4f16d6c8a769", "comment": "Malware payload (NanoCore)", "value": "aa5d4f01e7b3333e7c668155526cd4ea911c8b5520ccd2978bfa309af7f4a176599dffe8e45497f5a7edeb324f071d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358167, "uuid": "a2d497f6-eb5a-451a-8422-5bf4a48577a9", "value": "T1F2E4E064B743D60BCE7547F028A9E6405739EE221609C31E7C89B7BC1DB3B741A8C9DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358167, "uuid": "2336d805-c653-415e-9c4f-e65de8e47bfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358167, "uuid": "787cfcc4-d894-4339-804a-ce76423eacc8", "value": "12288:nodKXOQloiDb8jJGmE5hMfHCebIg6Dx0Wk:nvlRb8j4NEHB8T0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633358167, "uuid": "f42226ea-3a95-4ae9-8caf-cb68345417b5", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633358167, "uuid": "0ccd3386-37d2-4ef9-b059-5290e2985df8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358167, "uuid": "1ecdc109-565c-4792-970c-be325705ae85", "value": "SWIFT MESAJPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e069e7-2521-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633358727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358727, "uuid": "c41a06b9-ff6f-4f61-ae98-3d4d86cfcdc7", "comment": "Malware payload (Quakbot)", "value": "f656d6ccef1f3f9499e9a07e22782271", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama108", "colour": "#0BD97C", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358727, "uuid": "7245a866-3dc9-46e9-86f5-c48784679957", "comment": "Malware payload (Quakbot)", "value": "59b7483e0e252b0d5d3bc65cf1e11dc47033bcddda5c02a8b63105a001a338e7", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama108", "colour": "#0BD97C", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358727, "uuid": "c76a3cb0-d4ce-4424-be5f-83a12c722d89", "comment": "Malware payload (Quakbot)", "value": "46d6812d888fadf561def0f65c0a59bcf4bdd8f5", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama108", "colour": "#0BD97C", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358727, "uuid": "6a423c66-8bbb-4c8d-b6a1-cb9a0d465afd", "comment": "Malware payload (Quakbot)", "value": "9736287b014229f06c1ffc48b786a9f6cc4ecca2e0a228738cad097c4b1ef1b94f9428922190680b382017ea7a3cf0f5", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama108", "colour": "#0BD97C", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358727, "uuid": "8235c275-9ae4-4a92-8f64-19e1d65abf38", "value": "T183B46C507751E4A1E67D18B18F28C9E90A097E068FB2B4EB79E43F1F6B6D9B7C011702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358727, "uuid": "ed6ad2ed-4117-4fe4-ba33-ec5fdac60ded", "value": "e4fbe8cce04bb55a530853e0c72f4bd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358727, "uuid": "d3cd543e-8df4-4d56-a891-791533b948e1", "value": "12288:hW7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6jUV:hWf3YTnJLBv2EKMAcOgqxETMNIpM6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633358727, "uuid": "1d84c0fa-426c-425e-90ef-44bfe4eb392c", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633358727, "uuid": "9b388453-687b-4653-8402-d266dffceab1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358727, "uuid": "66749c49-dcf8-483a-9f64-9886bd66eca0", "value": "44473.694800463.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778ea45e-2512-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633352178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352178, "uuid": "595d2294-c4ba-4b26-81ce-92c7a5965de1", "comment": "Malware payload", "value": "e0f3cbbc89163e80d76bfb6e7e3db030", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352178, "uuid": "b4aa5cc4-06bb-414f-8036-cb700b98b772", "comment": "Malware payload", "value": "59bcff84f74638bae9213e66b1deac0424443e178c51896efdd0f9639823129d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352178, "uuid": "fc77cff5-dbad-4bd5-8305-bf6752fc31c0", "comment": "Malware payload", "value": "71c6438d3a08171d439084340290227d9d9baf71", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352178, "uuid": "1a17880c-a8e3-4ab1-b015-ae2568672d2d", "comment": "Malware payload", "value": "408befcaa720e9c63c573f2b38697f67b7b019763dda36f21d4151df8686199a8a277259913be577da6ee22bba44f9ff", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352178, "uuid": "390c16ff-a666-4bb5-8e50-40a07693013c", "value": "T1B2D302D4FAF18D30E019987C1DAF9A5AC76BBC0E1800305272FA799705758BEC5D8B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352178, "uuid": "4966989f-2772-4bf9-8b6e-315fdfbe7891", "value": "3072:4p7TuyNjNZSJp3hrUVaqd/7b6+s4xiWi2KC4hwlQTZo:sWyBNup3hrhq1f6+FZhKCe2QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352178, "uuid": "e6b0bc26-da0a-475b-9d6a-f0ca2744d396", "value": 132900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352178, "uuid": "b33de54d-c084-4469-a256-643b7f00995d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352178, "uuid": "0661fa78-8292-40ee-b7b8-56f1155590c7", "value": "1 Balance_PI Dt. 21.9.2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8446c560-250a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633348764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348764, "uuid": "1fceb384-d186-4e79-9b67-c28684688be2", "comment": "Malware payload (RedLineStealer)", "value": "dcb22bb98cedae340afba9a5a9f6adfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348764, "uuid": "808eb95a-b807-4638-8355-53a0adbf26a6", "comment": "Malware payload (RedLineStealer)", "value": "5a82ef3afe4758cb4846122d6edc9cf726b6a520fbaff9452a32cce542c67dbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348764, "uuid": "cc1e875c-80c0-4870-b5dd-d3eb0ecab92e", "comment": "Malware payload (RedLineStealer)", "value": "b7afd606c4286a213f5684b9b6eee4b61ec8ce08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348764, "uuid": "b568e10a-b526-42d6-8132-d4ad4e6aba09", "comment": "Malware payload (RedLineStealer)", "value": "4599a65a4208020eb2e23f8cf3d0bdd932089484f0811535d66a05d220a3c672929bbe4d6170afe8eee07f1ce19855be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348764, "uuid": "482dcad3-d62a-4467-bd8e-7a74dc90c547", "value": "T17FE4F153EACCE9E9E11D85B81C61F34D2B72AD1A2852AE6E6DC2F049253035350FBC7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348764, "uuid": "50241ffb-68dc-4b46-8a7f-a04f2342dbc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348764, "uuid": "d6195e7b-e06e-4e28-9941-62a9870c09e2", "value": "12288:7JcPdmtiK5oBIy4A7nnU7/UzBWEVHM9CjqrDM21cWtcdBn0yMRBv8S:E+FoBmWnUDUzoEVs9mibJ0B03t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348764, "uuid": "02a72f01-454a-49a0-916d-5ecbf733cc4a", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348764, "uuid": "11a6d02f-6a7b-4edf-a4a2-9935d761afe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348764, "uuid": "22cc3b1e-730b-4549-a5fd-ee8f0d4ea4a3", "value": "PMA21-110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6460c74-24fc-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1633342861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342861, "uuid": "9106bb25-2ea7-4570-8d88-d7712f4275d5", "comment": "Malware payload (XpertRAT)", "value": "2cb032be3ffbf1a86e75669f6ff3e088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342861, "uuid": "81e7067d-f624-4586-b84a-6d3e1e95a531", "comment": "Malware payload (XpertRAT)", "value": "5bdc764598795f4afcb70f6ff95f29114f61ea24a1d836838125c08268e13de9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342861, "uuid": "f7d423c1-315b-4a5f-ba4b-f3388f6fb965", "comment": "Malware payload (XpertRAT)", "value": "bd801dff881983fad20212b5ee5cb7cc65845bf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342861, "uuid": "390c2533-6398-423c-83a6-c15d963f7512", "comment": "Malware payload (XpertRAT)", "value": "69413a1f637ae85c527175dcad1c9862d7ef901fb8dc68c07e4645bc0193e71ab5deb7114a8fa60b242fe187a62c6a1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342861, "uuid": "21b5697e-22ab-4fbc-964b-4995e75869a9", "value": "T1FA42F86173D4C6A6E8659A35FC3356000635F37BD8769F2E28CD506EADA330542E2B3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342861, "uuid": "a22f7435-e7fc-46e9-9bd3-44457235a280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342861, "uuid": "a951cb89-3da1-4297-bb4a-ad083fd1556b", "value": "192:NAPUh8X3VII+Z0ocAESQqMT0U2/JT0JN7Kaemz:GPUCX3VII+ZaplnT0UUKN7K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342861, "uuid": "d842675f-6162-4a8e-b107-8dfd7463cf73", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342861, "uuid": "4f0c121f-b044-4400-9a47-128e81808f89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342861, "uuid": "70493f82-2c90-4dc3-8ab1-17b969c63fa9", "value": "2cb032be3ffbf1a86e75669f6ff3e088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca9a999-2525-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633360240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360240, "uuid": "c22c72bf-2bfc-43fc-a3d8-4d60865d588a", "comment": "Malware payload (Quakbot)", "value": "8d6af41ee21d0d24be9a8c0443464f3f", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360240, "uuid": "f679b353-ee8d-486a-a9b1-aff9f418e8b4", "comment": "Malware payload (Quakbot)", "value": "5c00430991a28daff019acc9d8c4abdabf88b60aaf49d31d34bf6836dea48caf", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360240, "uuid": "58ddca8f-c56b-424f-8fa1-066c789e9b34", "comment": "Malware payload (Quakbot)", "value": "2ac4cb1b47a63c03afe242137c03bc460810f726", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360240, "uuid": "1cb0def3-f266-42a0-8365-e531256cb97b", "comment": "Malware payload (Quakbot)", "value": "1e166295812a90f809d0f553d6ebb36802a569ebc8bf9215578aa6962dfb8a06f2b8e0367742f9f6041a1b6ea76cccdc", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360240, "uuid": "82c050ad-1092-4d04-aa28-eb5cad110e98", "value": "T16AD3AD467797C94BE54903398EE3879B3B72FC21DE72470332467B0E4E796A18C16A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360240, "uuid": "7db57caa-f65c-41bd-a2e1-1c82dd441552", "value": "3072:Sk3hOdsylKlgxopeiBNhZFGzE+cL2kdAxc6YehWfGdtUHKGDbpmsii/+u6ssC06+:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360240, "uuid": "1e556a14-58fd-49ab-b8c2-97846a610695", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360240, "uuid": "780cac63-13f0-464f-9b1d-19f011f92849", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360240, "uuid": "bbdaa36d-a3d6-4f28-afec-754577aa5499", "value": "11484451163-10042021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5b37b9-2513-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633352428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352428, "uuid": "ac17ff56-db2d-434c-a301-7a9c7168e556", "comment": "Malware payload (RemcosRAT)", "value": "71934084e54964650703d65fdeff3f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352428, "uuid": "1323702e-b6d1-4530-a6bd-0a183dbaca3c", "comment": "Malware payload (RemcosRAT)", "value": "5c45e757ae803d17b8e0e9ecb841d582c57788dec91e8bfaece3bee9639f70f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352428, "uuid": "79ae905f-fe85-4cb5-b5b2-5333daf87f7c", "comment": "Malware payload (RemcosRAT)", "value": "0224a39eda5860a18079be545f40d24e677a5490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352428, "uuid": "0461b60a-0cd7-45cb-afe5-db72afd05b82", "comment": "Malware payload (RemcosRAT)", "value": "1c2e383aa613cdc96c992441f68cebc12c37bea2f914d23c68849ceb6169cef72f71681d13f7514008a46ed2d7231419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352428, "uuid": "1a284e18-4591-4c0b-9e8d-55f32ca9518c", "value": "T144357DE2B300DCF6EC19793ED809B3116355F7F078470D8CAEA43A8B57A4590B96E693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352428, "uuid": "9d707d0c-eb32-46b1-abfc-04fb3cd63c1e", "value": "bc8cc1eea5c25ce2056d7da92bd98134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352428, "uuid": "3440d21b-dbad-44f3-82d7-b95e2f6c5304", "value": "12288:BSZPsJUL/MN/cen/VwTQBXcameDCnNmdeoAdrL7+o:bOQN/cu/VdBXKyCnE0rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352428, "uuid": "13d9da3c-0e02-412e-b92f-c140d78c00f0", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352428, "uuid": "6f6a20a7-81cd-41d3-8d4f-5ab41491e3ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352428, "uuid": "c2405276-14b4-4aec-805f-71acfd4adf75", "value": "Talema Dringende Bestellung92121,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6314ddce-252e-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633364170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364170, "uuid": "c3a49ef8-7ce4-49d6-92a3-960c73f1a6aa", "comment": "Malware payload (RemcosRAT)", "value": "830bb43a544569cafc3179ad310ed702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364170, "uuid": "a3e1b25a-4a99-47b8-bc64-dcf6c259b768", "comment": "Malware payload (RemcosRAT)", "value": "5c7b6a74c0867199f8bf9950f097ac9b8e5de8f2813053c6bffbf2bdfa4c5487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364170, "uuid": "3a5c05a9-47c0-4893-adac-b6b59a1aff8b", "comment": "Malware payload (RemcosRAT)", "value": "0c31e199e9c6863d34a664659ba73a25a413754d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364170, "uuid": "3ac5037c-2127-4fed-840a-5253d08b7730", "comment": "Malware payload (RemcosRAT)", "value": "f8da5e5442e71cafa2b8a300abd8eeb752e0c03bf560ec38ff5f3eed18fe91b170a1592517f453fd6d9f3d4c09a6429a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364170, "uuid": "a2a4608c-d888-41e8-b040-48a510e2b1d2", "value": "T12B05E4A51450632AF5133B36E80752125BE1A93C2EA24B79F9402B9B0B6F7C1BDD1C7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364170, "uuid": "d2f47bbf-a5f3-489b-8fc3-481e45300f2e", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364170, "uuid": "a17dacbd-42c1-452f-a1e0-1e4ecddc1dc8", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyN2YAycjL7YiEFXXXB:Naeq3gF1Sf+WIyRAyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633364170, "uuid": "1ae83514-01e5-411b-b96d-db2540b51663", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633364170, "uuid": "35f64a45-cce6-45c2-bf32-d14583adcddb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364170, "uuid": "93fb596e-5f64-4f6e-942b-50a5c30083fa", "value": "BIOBARICA OC CVE6535 TVOP-MIO 10(C) 2021,pdf..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b3017c-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633363173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363173, "uuid": "b00aca7a-7149-4f45-bd2d-c9de6eacf435", "comment": "Malware payload (Loki)", "value": "64b65cc0153650b46ed88dc9826c7263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363173, "uuid": "7080683c-bb43-4ea8-808d-6a49e344e3ff", "comment": "Malware payload (Loki)", "value": "5cd97e749ea3d1481ad62add267e319637107973253bc34a5c95770fe5be1256", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363173, "uuid": "d02f0d2a-ed61-41f0-99d0-5e5078e5f7fc", "comment": "Malware payload (Loki)", "value": "5a01204c23baa7935e2a59bce1852b87e859e023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363173, "uuid": "a5a4c7fe-fa54-4dbe-9d13-04f867cceb4a", "comment": "Malware payload (Loki)", "value": "4ca58864172d3c289448d7394b912f7c0a145fe0f9951a25620cf8fbd874e4b323863f2e39326eb2b1151dfd8145e4ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363173, "uuid": "3ab42c83-5c45-48d9-b03b-96c0bc7c7523", "value": "T1CB64F06C63B79355DD3983F22C68E3925776A426511DC73C5EC8A0ED3AA3BB40EE0943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363173, "uuid": "56d5c409-9484-439a-b029-406c7168af84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363173, "uuid": "22e84c50-28c7-4f8d-a25a-33ca5ec73cdb", "value": "6144:2ttwrERQ+3HwOXY1eGFAcLPewmj09wfU4PWAyoy0XRIYMEo12CRzTAOdO0:zESoXYxmpjCwfUK+obRa31/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363173, "uuid": "05e1070b-7fea-418d-836a-a3aefd8df780", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363173, "uuid": "6c129872-393d-44d1-ae79-a7851e66b3fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363173, "uuid": "598b8f1f-6bfe-44dc-b355-c93828607235", "value": "64b65cc0153650b46ed88dc9826c7263.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95275aaa-2524-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633359959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359959, "uuid": "b949bcf6-7c1f-4815-9c53-099e73284a85", "comment": "Malware payload (RaccoonStealer)", "value": "37e19491782b92d5522f37b51c661b8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359959, "uuid": "14e3c0ae-be96-47a2-9dfc-34dbc269e500", "comment": "Malware payload (RaccoonStealer)", "value": "5cfb24404f3aa29dfbce03fc0ffa2fab60c2c4c0b9c35845e333d5dd0fb8205f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359959, "uuid": "62c0d85b-ae3c-4af0-9392-6525b4de5745", "comment": "Malware payload (RaccoonStealer)", "value": "a644e3140cff547adc44a6c3164e7813955cba52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359959, "uuid": "78b7e877-79ed-4156-baf4-15097801d8b7", "comment": "Malware payload (RaccoonStealer)", "value": "d34d081a330ef1ed1d562d096e5cd98393f460092fb441d48b90e3782f790304c90c4fbb871b9022bcb95259529b3ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359959, "uuid": "8056367e-5cfb-4789-8b20-b0b36c819715", "value": "T14E449C093180D7FED2760570AF96F7F44A2DBC6D4E66524F3798271E2E393E18221B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359959, "uuid": "9fa70395-3084-4674-ac98-32038fd2bdde", "value": "00e4a9909e1dd2f9b23ab751bea778c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359959, "uuid": "1ba6c482-8a35-472b-914c-bdbc78a4a2d2", "value": "3072:5HP9WH8u9lJUbhXUqXpnsMFk5QGzjWl55eaBBQWvbvPQiaDhxxMeetkkrsC9wi+t:5HPc8SubpnsCLSWlXROhxxpeTr/ekI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633359959, "uuid": "4f4ea1b9-5ea8-42ed-9b9d-d8af0ade62d3", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633359959, "uuid": "53ada2bc-93f2-49f0-9c53-cdc906860ff1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359959, "uuid": "fe8029d3-8822-4edd-a90c-26f2563c902a", "value": "37e19491782b92d5522f37b51c661b8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65e9504-24db-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633328742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328742, "uuid": "3d6e1075-bcc6-4213-8744-704f08ad49a0", "comment": "Malware payload (AgentTesla)", "value": "4dbe716764692ed8ec0178975755ad98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328742, "uuid": "ebeb833a-5f65-43f0-a348-ce114aba00f2", "comment": "Malware payload (AgentTesla)", "value": "5d26b106108feeedd106c7b0a66712cf3c29d1ef75fac3db29159229660652a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328742, "uuid": "cf12b90e-5db7-4d3a-bf57-d65310fcdeff", "comment": "Malware payload (AgentTesla)", "value": "746bb377ea9102f19e87dc60e48b15beaedbca60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328742, "uuid": "58b06323-a840-44f5-a2e9-74f169fcff49", "comment": "Malware payload (AgentTesla)", "value": "a3c468b290ee3646626e050f50c7af10bcd08ef36e407f223cc4613bda2e91eeccad99e675463a500e05334e7a646fd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328742, "uuid": "2f372b6a-a080-40d0-aff2-5711a1b73d34", "value": "T13184BF51F289DCD6E8571DB6487BDD3160A7BA6C94B84A0E140E77291AF334320AFE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328742, "uuid": "d309306b-6cd5-4536-a836-68abe66f8e50", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328742, "uuid": "942e3e25-c2fc-4d14-840f-9ffb79928276", "value": "6144:18LxBOeA5lbJ3LZd+mHq654lVP2b9RshFPlS5mXG5dz8oeCKgKRVq+4:LeAHTdN54OYhlUmedZKgKO+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328742, "uuid": "62085083-6a7a-454b-b88a-9c49ebffca6d", "value": 378230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328742, "uuid": "ad271966-af2d-437d-9e26-88de2e68f88d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328742, "uuid": "db380d3c-4577-4d90-a2b1-b0bfcdfed7c3", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1e4af2-24f5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633339574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339574, "uuid": "8c9d57b1-b89c-438e-9a51-225f1df6c4f8", "comment": "Malware payload", "value": "9ef78ab16cf7afe0847babcdcd4743ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339574, "uuid": "15e5ed8c-2394-4bdd-afad-4fbfb568b29e", "comment": "Malware payload", "value": "5d5c963179068a42cf75bebcce58e22912871e84085522de3b5752d0e031d016", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339574, "uuid": "fe40ec5b-6ea9-4ab1-b3a5-8ed2d11d616a", "comment": "Malware payload", "value": "ba4722e9049c89f221e4b70f7a90d0bdc11e7108", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339574, "uuid": "4b02bbf9-b633-44f2-a371-2bc2cfebf04e", "comment": "Malware payload", "value": "1c23cd3edfd31e84f114af46e12c9e440fd76889a08b9620881b6fa8ce05fe168ea85762885da8ce23496bcad57b58cb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339574, "uuid": "f37d8362-2b7e-4065-addc-f1d56f9cc6ba", "value": "T1F6B5FD06B52676D3D32B04F0026B7A1E812C798690CD1D89485BCBDE6CE5CF9E349E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339574, "uuid": "1de9c7e2-7c30-4b54-9ee5-7ed6d0c58028", "value": "1536:ti/ZfvkkoHUoUMUDUrUNUGUMUHUBUTUnU3UNUjU3UkUOURUUUHUBUTUnU3UNUjUz:ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339574, "uuid": "e8522fd2-1380-4a68-8949-f54cec0b9e0d", "value": 2273712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339574, "uuid": "5425ad46-6f47-4cbd-9b07-fd60faacbe7c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339574, "uuid": "b9897623-e672-4a2f-99a8-c0c1dbf06d1d", "value": "FedEx AWB# 884174658339.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d2cbae-24fb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633342344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342344, "uuid": "dc94cec5-d39a-4b9d-aa8d-a1cb31dbf552", "comment": "Malware payload (Mirai)", "value": "4ef94422d37f4d6793108c5ac9a7238f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342344, "uuid": "5ec40013-fb99-4584-a48c-a9e2043d65e1", "comment": "Malware payload (Mirai)", "value": "5d9f20d136a0e472e47c10ac74c75123d18608cd60b06e67b3236cf2544ee316", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342344, "uuid": "4c8e93bd-6066-4e9a-8ea3-915c59a076de", "comment": "Malware payload (Mirai)", "value": "a1bd66b8625684a3813a17ca288f925277766bcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342344, "uuid": "4c93e162-f315-449e-a951-17070e5faf72", "comment": "Malware payload (Mirai)", "value": "7045ced6d2da914e0a9cd691539fc3f8c71471f1dc4a060d4209b49b306424937b1c174eaac5a149fb5db7f93dde7659", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342344, "uuid": "2868757f-712d-4ae5-b215-02c14a61ac7f", "value": "T112C2E06157473A62E1F05C79EB4FC7E1A3B2AFF4F155303C335293B42AC9499A1B8A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342344, "uuid": "f58dc1c1-f3c7-49f6-af06-9779a75ee7e8", "value": "768:6jCT2VyFbekK1rTNgpHd4bhsuNrgs3Uozu:6kza11TNwHy1su7zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342344, "uuid": "9e784960-172d-435a-a1e6-23fff413c880", "value": 26636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342344, "uuid": "b701dd48-4b35-4219-bf4c-38076aa44169", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342344, "uuid": "bc729bec-e578-4065-948a-b1eda8d72594", "value": "4ef94422d37f4d6793108c5ac9a7238f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5879e2-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633353131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353131, "uuid": "a92b4444-ada8-45f2-bc1c-293235e944c5", "comment": "Malware payload (AgentTesla)", "value": "5fa85f6b9d586234d86a92dfe663f160", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353131, "uuid": "e4e64f9c-8988-4f48-93e5-37f7baf8cfb4", "comment": "Malware payload (AgentTesla)", "value": "5da25d9af00cded5377cc30943ae9084253d110abbf057e995aacfedfa1ef145", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353131, "uuid": "a6d608f9-0653-4d95-b4a6-2c7fd1fdaa4e", "comment": "Malware payload (AgentTesla)", "value": "b8ddf9bd783457e180f6bdcb31c712debacbddfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353131, "uuid": "4acbd05a-1fa5-46c7-a58d-8f927d8b7ed6", "comment": "Malware payload (AgentTesla)", "value": "140edda0938929fea4d3818c17e1db4f8fec84505e5d2ef24ba3fa032294f24c0f62e8369f2e5ad4fddb86b8dc315a3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353131, "uuid": "fb432273-8e51-4eb9-8b82-47c6fde8bae9", "value": "T1A815D0202364C22AE1FBE73CD47690719B3EF986A029D65F5DC3C9DA0E25341851BF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353131, "uuid": "b643a3e0-62ab-46ad-aec5-315d20bf0574", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353131, "uuid": "fc6ab799-3577-49bc-8ca4-fc382368a09a", "value": "24576:ZA6CFuZyE+ood7qYUAokmz9Buk/GwkU+Foo:jCFuZyE5od7zUFkmruDwkU6oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353131, "uuid": "0c1cbe78-7d1e-4a39-9bcb-0b2a77d3c4c4", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353131, "uuid": "d786ec25-f552-4039-8742-c147ce4bd243", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353131, "uuid": "7963cbaa-287c-4cc9-84f4-ee36512ff6de", "value": "PUR-21603246 FS9120 0.35_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695f2512-253e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633371052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371052, "uuid": "ad26fde2-f936-481b-ab49-a4305c0a0331", "comment": "Malware payload (RaccoonStealer)", "value": "bc6bcd6e668a744fa25be36f93ac75bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371052, "uuid": "d45f1d7c-b712-4372-8382-60944fa57922", "comment": "Malware payload (RaccoonStealer)", "value": "5e11ca103543381353beac9daac75beb13a4186fa3470bf90550ee6467270a66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371052, "uuid": "d0f68ba7-04bc-4a83-aab7-810c2bbc8ca5", "comment": "Malware payload (RaccoonStealer)", "value": "1411e702d2d14e2578cb1e6bfc70c1d42cc80bf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371052, "uuid": "0eec2172-44d8-4448-8b23-e779294ba1ba", "comment": "Malware payload (RaccoonStealer)", "value": "c5dbcd9065405687418d16526046fc964b7c9b1a8fa77f459e09ecd9eec01caff88417046a720b295c076d21651b2aa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371052, "uuid": "1f18310d-c36d-4d31-af46-df0f11abbee7", "value": "T1DFA53C18697FE01960E3FE916EDCA8FADADE55D3240D743B106163274F22B81DE8B439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371052, "uuid": "9384e513-e834-4ecb-a43c-6c995cf50697", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371052, "uuid": "c4e560a2-fe1a-4822-826a-f909badb482f", "value": "24576:YQEPpjUP3w7Mq58T+iF0GipV8s+4VHxFLjaTEAeVrM+vh8uyMGAksuqmd554qXg+:HElhL6zKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633371052, "uuid": "455f213e-b3d8-466f-8497-557b9e55b563", "value": 2065920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633371052, "uuid": "557add72-2869-48e4-86da-0014463ab4da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371052, "uuid": "c7c5aadd-b45e-4bef-bf76-270dc6fe91ba", "value": "bc6bcd6e668a744fa25be36f93ac75bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50f96d4-2556-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633381541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633381541, "uuid": "6fd903de-696d-453c-8a4e-c6040972668a", "comment": "Malware payload", "value": "deaf4a4861c73bf31b02baefdb15d99c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633381541, "uuid": "dd6fa4e4-5734-475e-a1cc-4638bd5fd094", "comment": "Malware payload", "value": "5e64039561c03a0af6a96ae348d8b57515fdc9e234ad8809e5cd311a69377bae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633381541, "uuid": "c67656ec-b6bb-425e-b65a-3c4adafc25e1", "comment": "Malware payload", "value": "7dd451b04d713c55b6adfb0dd65daa900337d807", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633381541, "uuid": "e8782a00-e4bc-40e4-8cb5-5f4241be50bd", "comment": "Malware payload", "value": "04c9a1a1c2cb7b3aba31056a3ba2ef82cb244829a7c818bfb68012969bf57a25ec8a0325443f725c6de38932c6a2da0b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633381541, "uuid": "dfcd9fd1-53bb-46fe-a6d9-e36f967028a3", "value": "T1ED248D717681F433E0560479A65BC7724EB9BC331AB198C7AF984D698F222D2DB39307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633381541, "uuid": "75652d32-50ec-43c8-bca4-d3090a956e5b", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633381541, "uuid": "75de617c-25fc-4c2d-b241-d52d7f3bb9f3", "value": "3072:T/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUmZ5rP:T/MEfuN0t8C5oFsoeRM3o0jpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633381541, "uuid": "7ade9209-f9a1-4527-a22f-bc917bcdf16e", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633381541, "uuid": "e6fd032a-ac0b-4abe-9bc3-9cc9d4b92fd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633381541, "uuid": "b8b9fde3-7836-42ac-a59e-2bb116539a41", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ecfe65-256e-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1633391521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633391521, "uuid": "d8bd2a79-86c3-4202-bdbf-2880322d1438", "comment": "Malware payload (BitRAT)", "value": "01b70c25232742a9d505e628b815eba8", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633391521, "uuid": "919dde62-1003-4744-9a74-675673788abc", "comment": "Malware payload (BitRAT)", "value": "5e8b5b1d1e2523d78ebd74d014b2384eae85d8c224da7dca4765eb7662ed7231", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633391521, "uuid": "eb94b882-dcef-424a-8e87-7bd522eb3775", "comment": "Malware payload (BitRAT)", "value": "92ae67c1d45e65dae526ac3fab20bbaa52644e53", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633391521, "uuid": "6b2a8455-2935-4c98-8cdf-7544586d7b73", "comment": "Malware payload (BitRAT)", "value": "651fbffca82044719c8ac38dda1e400f8ba276b645894ae2c7212b136d6dcbf7b639430fe5d62946ad2dbc541f8da702", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633391521, "uuid": "2698f6a2-065a-462d-b773-e4e874a776f5", "value": "T1B4157E7261F5853BC1E21BF2AC5F69895477BE2039146AC765EDBE4C3934FF1222208B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633391521, "uuid": "a024a951-a463-4882-ae76-eaf70ebdc756", "value": "b007c2633498ce5e9ac88f6c5e852d8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633391521, "uuid": "30c4ca91-9713-4bd2-8c98-af41c7397e93", "value": "12288:jlDYMzwNJM3m4uZQvFTt0jjqipWUUtWZPO19tT3jlin4uq8S:7KpKvFTmjjTWUrZW19tT3jlin4t8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633391521, "uuid": "d1684d99-b51c-447a-b429-4825f76d3600", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633391521, "uuid": "cde31b45-2744-43e4-89a4-d13afe4fa5d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633391521, "uuid": "a111b9c9-8342-4470-96f9-9e1779ec1312", "value": "Zhgafxcfrzzlbcdvuklhrmxvmcufzxktju.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbe80e3-2543-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633373043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373043, "uuid": "22830e51-56fa-41d4-a26c-fc35ad397a16", "comment": "Malware payload", "value": "8e569bc871b8364669e122b63dda8399", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373043, "uuid": "6252b2b5-df4d-4336-9e5d-8881342af1fd", "comment": "Malware payload", "value": "5f67a9e1b25d56cf1e7ba857b2cfc4be77db1e92ea8a32ee154e9322d96387f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373043, "uuid": "28d32544-4b21-4936-acd2-0cdf513509e4", "comment": "Malware payload", "value": "69dfd12c7df066389d1cf48ee17619ce03289263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373043, "uuid": "0afb5a02-339f-4a94-8372-d09272ba761e", "comment": "Malware payload", "value": "b54a92a93d11a17543df315025c0f94d3f7563acc61c2747d4658818bceaffab614ad478fcda2d6b2cc8251c53440afb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373043, "uuid": "fc1f10cc-30e2-4592-ae61-f833060919f9", "value": "T1764522193081C7B6E2B905315B07C7E0466EFC6C2F69AA8FB395176E8E752C2D369312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373043, "uuid": "dd120703-3e72-46ac-81e5-8acea63da396", "value": "820638e32882fc55584544cedf889893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373043, "uuid": "22a6f9de-363e-4e93-b65e-3c4b30a41069", "value": "24576:Qr0NQtHQ+I8JqdGmbTXgpDDhJ8BD1gNZNZANDuRrPNiKQ//j36L:QYNQtHQ+idGmbTXgpHhJ8BD1UvANDorN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633373043, "uuid": "a4975aed-60b6-4f01-965c-f4a1520bafe5", "value": 1218560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633373043, "uuid": "9a9c07b3-11ca-48f8-90a2-d1538a75ada5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373043, "uuid": "a742dd2c-20a9-4620-9ff3-342c5458690d", "value": "8e569bc871b8364669e122b63dda8399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bed7ad3-24d9-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633327516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327516, "uuid": "3e9a8c3e-1ac7-490c-a668-62e638caac28", "comment": "Malware payload (RedLineStealer)", "value": "a5058f0c8a12e82ee4cd0c922127953b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327516, "uuid": "7cfa1460-021b-42ed-a58b-5888d9666ba9", "comment": "Malware payload (RedLineStealer)", "value": "5fbbf8d74c8a2b3f6aabf4a95c1b68d9b5ce182ebd19c1f3c8eed44fdddc72c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327516, "uuid": "793bfd79-c7ff-403f-9856-05a1a61df421", "comment": "Malware payload (RedLineStealer)", "value": "c185e04a9b51c818c49c6ccc27cca1c674906ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327516, "uuid": "41994a60-a99c-4ca3-8252-9c276d9a8db9", "comment": "Malware payload (RedLineStealer)", "value": "2443c8a9446221e4f3554fec1970128d6759238b4bf1a8c086ebb4b6ddfbee1523028379b9e5ea0689b4de4a1fe1bdc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327516, "uuid": "7bdf2fb4-9c3c-40fa-ac6c-a00424ace555", "value": "T162A49D2C625D4F22D5FF4FB9E46281C2577E9613A225B2EC2C6CF8D48957FC04D62A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327516, "uuid": "8254f1fd-1960-402f-8565-e658ddc3b0c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327516, "uuid": "d914de66-c4ce-4be7-9875-4867dbc74e51", "value": "12288:ZSovggCj/bNcJjSOuBP4RylPhzQAgez64ehg:ZCjmlSOurPiTeBehg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327516, "uuid": "c222e507-96a3-4a2c-96c7-d0a8ae77d65c", "value": 450672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327516, "uuid": "0e6d22cb-6a20-4a30-8805-b60258f76c42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327516, "uuid": "4adef3df-d636-4931-a276-00737aacc46b", "value": "5fbbf8d74c8a2b3f6aabf4a95c1b68d9b5ce182ebd19c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6270b0-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633335278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335278, "uuid": "d088b967-128d-47da-b453-ce293a8fbab4", "comment": "Malware payload (SnakeKeylogger)", "value": "05dfafa6e7e68121b778f95bc65e3ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335278, "uuid": "2cb03b2b-5f88-4d1e-b22e-8de56b790543", "comment": "Malware payload (SnakeKeylogger)", "value": "603176e689510a10a66678429d44be65ab85ac5b5b0db2fd284f35ea5009f840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335278, "uuid": "80317691-a0a8-4fe2-af23-ae09030f0393", "comment": "Malware payload (SnakeKeylogger)", "value": "4acf7fb7a961d69d3075fcd164372a93c5bbf87f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335278, "uuid": "e67f5003-c8b0-4d13-a3e1-96811460ea30", "comment": "Malware payload (SnakeKeylogger)", "value": "72cdd8b3730ca7a9f9ca9a7981bcdb01c7c47fad3f15133814e49d8e53fb9832ef91f4c08c25a8f9b21eccd23e78ea48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335278, "uuid": "f0c4d137-d168-4d0c-a571-817de13de5e5", "value": "T19374F16963A79740DD3583F03C68E69267B6646A204EC73C6E89D0EE3E63BB44BD0543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335278, "uuid": "cc284e37-4bb2-49f8-b178-62683a78aa15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335278, "uuid": "29847d6c-f7a5-4130-8e16-9b48d103973e", "value": "6144:+JEtnEERQ+3HwOwkVFo8KOHemzvh/iT3jFkjwGewPrlPrJS9rBG3MUVb/OUg0:+rESo9FB3Ht4BkjewPVJD9Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335278, "uuid": "6fffb6eb-2bb1-4f84-afbd-cd68e3bae8a4", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335278, "uuid": "63b4c957-9e50-47c5-b4f4-554ee40fca86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335278, "uuid": "ccd0b8c9-1d15-48be-9ea7-1cbe1673da54", "value": "Invoice deposit-GE210058A3-B1-B3-D2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d1f4b2-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633354833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354833, "uuid": "ff12c43e-aec0-4d73-aab9-fbc676039eb6", "comment": "Malware payload (Loki)", "value": "d1312b65ba8ce2d74ddfc859555105e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354833, "uuid": "a4252795-2db1-44ee-bf30-cda144dfc532", "comment": "Malware payload (Loki)", "value": "616d536551a36dc7de21ef1945fba7edf919d6cf4bc14ddee3f983f1e55bbf74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354833, "uuid": "bcb15f04-7aa4-446e-8777-2a79c1b5696d", "comment": "Malware payload (Loki)", "value": "2dbf52ac263e3577ba57645c1b364bef97baa3a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354833, "uuid": "39c78c88-820a-4ea6-ab48-4dcebb80ded9", "comment": "Malware payload (Loki)", "value": "736e00b997803e3152ac01d8f88bb20c02018ee21a048a2c1d6404f0c9cb25f6ae75bf6596ac6025eef7a02a9f52916d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354833, "uuid": "232cd8ff-0d38-4281-8061-b2806bdf3303", "value": "T1F3351B8053C69AC0F43A6734B0319CF3A6BE7E1DE379CA1C29DA3D975EB6780421DA45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354833, "uuid": "f4352365-5d5d-4a7f-aa55-4dd6f127c094", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354833, "uuid": "409bdeb3-ff33-4926-ac1a-cfd6572c43d5", "value": "12288:c3lK8FluRs7Z8z4asvs1drdyImcHFebpvqgjoid2K046Mnq0UnsO5lJkKzUvoPUT:S9ZMRInpOdPZixK1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354833, "uuid": "a4a49537-8056-48d7-9b78-504c51a935dc", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354833, "uuid": "2d13594e-004a-41c7-9696-2b9f033d6881", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354833, "uuid": "702ab0ce-a520-4df1-8259-b0afed25c6d0", "value": "LISTA DE MIEMBROS SUSPENDIDOS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c09cfab-2512-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633352078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352078, "uuid": "e88ad6f1-0c8d-44d2-bdb2-7f1be7cf2f54", "comment": "Malware payload (SnakeKeylogger)", "value": "2c521578e8e6375e41c1ca48639fee83", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352078, "uuid": "5fbec426-a1c5-473f-b17d-54a6b1c91b09", "comment": "Malware payload (SnakeKeylogger)", "value": "61cc4e8ea2639e303a81054c4f88369b0275da3efa453b4eaad8d86935e23dfd", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352078, "uuid": "876a2bb3-19c1-4cad-a511-151884b8ab82", "comment": "Malware payload (SnakeKeylogger)", "value": "f5db5ef0df20227af74f347658c2f1e547cb549c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352078, "uuid": "49f64b40-a37b-4984-8068-9be9785ec0f2", "comment": "Malware payload (SnakeKeylogger)", "value": "0681e6b965ac68c23523c8e42a9cf99e183bafcb10c6174da87be325943ffd49138a0f061491e5ba7a7439cfc119272e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352078, "uuid": "07121810-4925-4a00-8f49-91d5ca78612d", "value": "T108542307B2CA97FB0EA59FF6C53E5816671F86F576B8250DBA35EE571A8482C02C3301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352078, "uuid": "bca21d3d-ccea-41f9-b5fe-ba9717c46f22", "value": "6144:V6Pnasbe5neOI1aiV79k+FafiUjNkBH/9X0/rL3qn3wmJYIIWDsvga:Ifalswk79k+yOlX0/rIJaga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352078, "uuid": "0d8c1c4d-6a27-4d69-a00e-bae2f3132897", "value": 292233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352078, "uuid": "3f4fc119-ee23-446c-8c11-0671480615e7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352078, "uuid": "80d3fc0a-58c3-4313-b244-053f23a090c6", "value": "Olimel & Periolimel PO.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90b1671-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633360851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360851, "uuid": "3b3fb214-00b0-4672-90e0-e4cbd9fa1f26", "comment": "Malware payload (RaccoonStealer)", "value": "c4c3ea5a3d2d9b3183dc1273e3fba3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360851, "uuid": "7703235e-7e46-4b0e-a9ad-d5f7a7f963b5", "comment": "Malware payload (RaccoonStealer)", "value": "628d96ad8e61df81aea0f6931e7daaa39ee860051bb15e9721ded124e943dd26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360851, "uuid": "9c65bfec-bc7b-4f4c-ac2c-56aed080349e", "comment": "Malware payload (RaccoonStealer)", "value": "dc04262a72c72551ecd20c7e34835df1a7667eaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360851, "uuid": "7ab6dc8b-3e11-4ce7-937a-d8c8be380aea", "comment": "Malware payload (RaccoonStealer)", "value": "3ff9c63efb4a05d623501748c0cf10d27bb598738c14f8372de923b131f5a5ac02d2f205be3f3c6c81ef2421d88481bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360851, "uuid": "f1dec668-574c-44e9-9b20-2b2f20628681", "value": "T121C4F1073161E7F3E6B156B1A726C7F50A6EBC5C8D2645CF6BD8236E6E3C3919221302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360851, "uuid": "d458e05f-37ee-4e5f-8a47-a7d538fea0df", "value": "820638e32882fc55584544cedf889893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360851, "uuid": "43c29499-207a-42a5-9ea3-c4820e6b4a50", "value": "12288:5dBpZdHiK5ZwdhLJ5ilvW4kv63CVmiSrLkXYxItvozxp6L:59ZdHlZwdhL6BW43y4YYxUc36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360851, "uuid": "b3503b1b-3f14-466b-b15c-3f6f5e76e1e4", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360851, "uuid": "a451dad6-5476-4baf-ac05-91d7da800ee5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360851, "uuid": "ce142f73-cdb7-4c3b-90f7-0d7174d5bee3", "value": "c4c3ea5a3d2d9b3183dc1273e3fba3cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5f932a-24d3-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633325133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325133, "uuid": "51324514-f0a2-4abf-9e8a-7ca196e80cbd", "comment": "Malware payload (Loki)", "value": "787b1c5c41a71bff95665c58b7d85f0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325133, "uuid": "4c66ec6e-053d-4d2a-8986-98d4ac1f41f1", "comment": "Malware payload (Loki)", "value": "62b61619e57f592a6234b6cf2d2331f72fcb4ea8c06cfa66de62cd96b8d9d812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325133, "uuid": "66f8de80-131e-4cd1-9677-bd0415ab3bee", "comment": "Malware payload (Loki)", "value": "bcd9bc98d78fb277937d59514caf0a0a991c0393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325133, "uuid": "1c9cef6b-17a7-481d-9cb3-a9c9bc3a9423", "comment": "Malware payload (Loki)", "value": "b9d7f2f52b577290b67942b1c8234bf8e5bb66fe5269f5f019dea82ffb3763399b89a796da73c31b4f95a316cb01e3fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325133, "uuid": "19c81276-c489-4bf8-982c-ca85847701e3", "value": "T1D7B39E0137855A56E4A459B180E3A3E503F3E5AB63F3DB8E3E4C46A60F457E48E84FC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325133, "uuid": "5cd9b9e1-7107-4803-9181-d88e88856176", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325133, "uuid": "b94af6cf-5407-4543-9d43-8f7b87c270ae", "value": "3072:dofnRnwBeFKk6Fsz05/S0h0CTXYmvFMQ4b1LfU:cOZ35/S0hYmuQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633325133, "uuid": "d9cdbbab-80a8-4df7-ba80-02896039be7d", "value": 108032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633325133, "uuid": "cdb9676b-99f3-4323-bbc0-a5438d91f66f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325133, "uuid": "5ba92907-b7a5-4719-8191-8697194ed559", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53d8635-24fc-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633342860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342860, "uuid": "6dc43a00-69f2-4209-9a2f-8fb0824f0c5c", "comment": "Malware payload (Loki)", "value": "5cac41d44c296b2d6f0a48767d073b04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342860, "uuid": "e4e93243-82d4-4fe1-831c-393dff356569", "comment": "Malware payload (Loki)", "value": "62c310a9aeec64bf3864411e0ea2edfdddbacb340626e7d808615ec35ec14d39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342860, "uuid": "ad24838d-ccee-4201-ba70-2c3aa26e9975", "comment": "Malware payload (Loki)", "value": "921e62a2a2b9b0a3a1f2f14546c4d4768e1cd82d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342860, "uuid": "dde4469d-0912-4669-b205-8be050b0791a", "comment": "Malware payload (Loki)", "value": "2392b7f2c1ad3b5c9f8a2dcfb13cea7abb91072682b09752669b034b9c485ea6f65ef4ef990ac08a06add3300cf4fe44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342860, "uuid": "141b64e1-4912-400a-8493-5c6c8dd3f005", "value": "T1ADB4E0FDA3177906CE3C42F6786091909BF189A7101AC3B44EB2F4FD39D67E8568258B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342860, "uuid": "d692d0d2-b45b-44c1-a730-f5370e615f44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342860, "uuid": "fe7e0500-e0ff-428f-b6cb-fe91d78aa6d1", "value": "12288:1wQaTxjoTojucl3HAShA65ppMP1JT6YashlM0JT6YashlMkov:aQExWol3Ksbmn9ashlV9ashlBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342860, "uuid": "573e1729-bd70-4080-80e6-21e9f803176c", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342860, "uuid": "2a6452e0-498a-414e-bdc9-43faf44564a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342860, "uuid": "ca929e7f-11ed-4581-a5a5-64db559464e6", "value": "5cac41d44c296b2d6f0a48767d073b04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd24136-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633360779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360779, "uuid": "4f048145-b8da-4c38-b366-18e09181183e", "comment": "Malware payload (GuLoader)", "value": "567d679df1c52ff01662db29cbda21c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360779, "uuid": "4a0532d5-44b7-41b2-872c-1ad8a4fc5776", "comment": "Malware payload (GuLoader)", "value": "6305547511252a10b0bc9aa45f1d05a17acde57a9caf4cbddf1b1cb25d59d302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360779, "uuid": "3f973817-271a-4cc4-b508-2d97d6ea9b0a", "comment": "Malware payload (GuLoader)", "value": "592b3df112874f6f06bbfa0387fdcf451f56b68b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360779, "uuid": "88de4f8f-02de-4a5f-a0ae-a0c897ad980a", "comment": "Malware payload (GuLoader)", "value": "ddcede4a378af8358fc2b3b133a0c6f1cf86d1dfe1ba2cc7ef0618e3aa619289303d05469f403d2bc5e9365cfacf691d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360779, "uuid": "c349fc82-829f-4577-a8f5-9c702483ed5b", "value": "T10CA3B232E5A4DBE5E919C2FEF734F0FA06F5AC72C8914A0735483F1A65F24C665E0609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360779, "uuid": "8e4a3df0-fe94-4910-b9d5-ad9003a4916e", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360779, "uuid": "8044cf80-e205-4e95-a9d9-3fe8f0fe55ba", "value": "1536:tDmae5I4Br/htl+L7labSUfdaPB7VtVmBSZ:t65FrNOlabSUovwSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360779, "uuid": "fba111e9-11a0-4dc3-809d-bae7fdb09775", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360779, "uuid": "167e9283-2bc2-44d5-ab13-f3bd1b28c559", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360779, "uuid": "45667a9c-ebe5-4ce1-a456-acb6cce929fe", "value": "Factura n\u00ba749962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10f2372-2520-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633358261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358261, "uuid": "20ed67e4-9848-4ebe-a69d-3ffaa46c055b", "comment": "Malware payload (AgentTesla)", "value": "c2bf2edf491f58e6a9c932fec05ac4b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358261, "uuid": "bb60879a-b79b-4ce7-ad0d-815cfe8f665e", "comment": "Malware payload (AgentTesla)", "value": "6331606d61c9ee5d65055a390e9c85f3924671e4bb5d24159df60b0513704d8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358261, "uuid": "2afe9572-4c7e-4197-8455-a3d58eb1b9a2", "comment": "Malware payload (AgentTesla)", "value": "ce3b0f1177c3dbeb85e4c128d39ef88f02683d41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358261, "uuid": "90625440-0fe2-4a1a-9393-40fd566dc4c5", "comment": "Malware payload (AgentTesla)", "value": "585ed03885ee8431343747c9694fbd1bd59a163e027e12416cb70c0c44b811860d582ff773093297ebc90e3502f55ad4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358261, "uuid": "9326ee3d-f3f1-45b7-a6bb-a31c9f7301ba", "value": "T1A7B46A243BAB4019F172AA757AD3EDF6E55ABF622E02945B10D13F473623AC1CEC142D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358261, "uuid": "53959f2a-d108-4fad-8f92-d06b3049dd04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358261, "uuid": "0b8dd632-7357-490f-a785-c8d646771c1c", "value": "12288:EWHCM2K4CYJO2DFdO1q0QJdI10MMzaskEWTi:k3CYoi0q0gJkE6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633358261, "uuid": "a18ebc36-fdbb-4e29-9bba-30856e1f81e3", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633358261, "uuid": "0db49498-8a6e-47f6-bba9-1bca0327ae78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358261, "uuid": "d6d6c859-71d9-43ca-a170-419b41746f7b", "value": "Quotation Lists.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab07e11-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633347862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347862, "uuid": "d2391301-786b-4dd2-9f86-3f5f55717686", "comment": "Malware payload (SnakeKeylogger)", "value": "235db681a2cced19427a7ac9f166756a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347862, "uuid": "4a03d71b-8d06-430c-936f-4e852bd8288b", "comment": "Malware payload (SnakeKeylogger)", "value": "63bed4590cc84b039552202a82d8a3d62cd39b44d084d69a02dd8597dd2287ba", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347862, "uuid": "bdbc95a4-6189-40c0-a2cb-8059c4980628", "comment": "Malware payload (SnakeKeylogger)", "value": "e9a9aa11805c5b7d9d4cc25d492eda925ecc9c29", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347862, "uuid": "52dca38b-db0e-4861-a2fc-0d25eb5dea27", "comment": "Malware payload (SnakeKeylogger)", "value": "569f3aa6df6908eb11bbb420dfd5c6f15e3f54da1793225ceeef6c4160544d89b07db4d6a0651faefec916e4896751d3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347862, "uuid": "a0c178c9-937a-42f8-aaa9-2bf1d905f8bf", "value": "T10AE2AA7DF15B0A588F8697B8131B6F81164CF50DF39885B236BCEB3866C1D7A861293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347862, "uuid": "27835194-b553-49f9-b425-29bb4688d2a8", "value": "768:86boom0exjxibtrczIQXq9IQAqOVIg0DWrTcKzLB5:86Eom0exjxibtrczIQXq9IQR2Ig0DWr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347862, "uuid": "853c1aa3-8ccb-4639-baca-fd9a0860f22b", "value": 32881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347862, "uuid": "0025d03c-6380-48d1-9269-32846bd5805b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347862, "uuid": "fa44a0df-c9bd-45f8-af1e-0545d40b50f7", "value": "Overseas Keys inquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2869d581-24d9-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633327564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327564, "uuid": "a8f9af51-8261-4c97-a8c9-e267b4222481", "comment": "Malware payload (RemcosRAT)", "value": "69000c7d6a5799a61d7bc02e36916d66", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327564, "uuid": "946d51f5-cd90-43dc-a637-51a3ad4948cb", "comment": "Malware payload (RemcosRAT)", "value": "647fa66c2cef019a16ae46d3648949b6777fb2f03ceeff8494ae76e65b34f187", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327564, "uuid": "68ff394b-1ae5-414e-b4f3-74f94237445f", "comment": "Malware payload (RemcosRAT)", "value": "7a7c38efb05e15ecc86f59da44a090d2094b620d", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327564, "uuid": "acd098af-bdf0-4a34-a7cb-6faa76c80b2c", "comment": "Malware payload (RemcosRAT)", "value": "8505bd071f7070bf1909c7ef07540faf7391b9383a3d8783b36aeda8fcc01e2d9436f6d0277f65494651ea28569543c4", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327564, "uuid": "515d6ffd-805a-4f9b-9aae-048a9d10fe24", "value": "T1B911F70A09D0FFDA188D016E400BC34A8C2432F38A97CA3E7A42B89B0498935C4B3464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327564, "uuid": "892f3d3b-6669-463d-bb74-7a1ccd340fbe", "value": "24:ZOrcKlxTb1KVj7Kzmd49P+1HVS7OWdS8mN:ZScKlLOj34s1U73dS8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327564, "uuid": "41865713-f02a-49a0-b9ee-462e99b49ffb", "value": 912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327564, "uuid": "325ae39b-8eea-4243-9ae0-d233564f29b2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327564, "uuid": "6d40b625-e2f3-4172-84d7-072f9fcbe9bc", "value": "Doc. no. MTSMEXP-30012021.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf70a8a-24d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633327466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327466, "uuid": "80bc2d41-eda9-44b8-95a7-0370eb00616d", "comment": "Malware payload (AgentTesla)", "value": "c0f2dbd0a680e84a510ad01089da3952", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327466, "uuid": "5843c7fb-1769-4936-a1f1-853cea0fff3c", "comment": "Malware payload (AgentTesla)", "value": "64c5ce215f635169c2dc793a3972365f5ce38981ea701a0369c8fac5adfd9a27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327466, "uuid": "79852f1f-5c77-4292-abd3-7efce6aef9f8", "comment": "Malware payload (AgentTesla)", "value": "ad1a2445cc8a13239617e79304c73638ab2f4b1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327466, "uuid": "8eec04c0-d6cf-4110-a42b-ded605b75c84", "comment": "Malware payload (AgentTesla)", "value": "920dfbc45e0e0d63327d59cbc5d82ae7fde107653e907a99009d49e2832006d5190c8dafb1705e26c33193eb9d48a9f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327466, "uuid": "9d61e733-8f3c-4094-a349-19ea7c295f31", "value": "T17825199053C79EC4F03B2734B0111CE7A2FE6F1EE379CA11699A3A874DB6744461EB98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327466, "uuid": "a98182a3-d11a-42cc-8a6c-ed27b5dfe713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327466, "uuid": "037306d5-5a12-44d1-9ac0-7bcb0c660985", "value": "12288:McfAjUfF8z046Mnq0UnsO5lJkKzUvoPUu9YYabGgEhgeqlvX+Wkv4pYRofgiuW2s:Mu0EhovX+Wkv4pYRof+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327466, "uuid": "2bea3631-a210-4792-930b-117979870c9d", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327466, "uuid": "23c21fde-6906-4a07-a152-663842ada68b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327466, "uuid": "d540d0a8-c288-497a-b537-1bd3a0fd64da", "value": "Invoices TableTop Lists 14490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217f5bec-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633335283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335283, "uuid": "602c50d9-5f0e-41c9-98ac-30731042c756", "comment": "Malware payload (SnakeKeylogger)", "value": "a4368e0a121a655183c00f3d1bfa43b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335283, "uuid": "905f12b8-d7d5-456a-9e44-9212640a3d0f", "comment": "Malware payload (SnakeKeylogger)", "value": "64e29f703a7f82f83191dc2f20ace8a7e8ca2e44794e8ab3c0a323b475b4ca2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335283, "uuid": "3f43bd35-d8e4-43b7-848a-614e425187ae", "comment": "Malware payload (SnakeKeylogger)", "value": "b7bfff937be760df5b746fc7a83535a0132ac8d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335283, "uuid": "0cf32f62-4d92-4049-85f6-53c5fcc9aba8", "comment": "Malware payload (SnakeKeylogger)", "value": "30d2debf43b3d6c92785f538154cc9b91fd1ee2888df5022e68a4f19880f081ad30a3350cc4325b630f1ed90e2028b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335283, "uuid": "950bcca0-ec97-44bb-992b-71dd35b66e3b", "value": "T1CA64F19863F79304CD3987F16828E29217BA6026245DC7385DDCE0FD7EA37749AE0993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335283, "uuid": "b191bce6-d0d5-4080-bb32-cd7482f2735b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335283, "uuid": "aacd9cf1-2f2b-4374-8c77-edf7bee4733b", "value": "6144:dPtHwAERQ+3HwOi/uLakwpr4jdFcbXMNkZUj9BR/tc49fIs00:djESoi/1prbXMNkZUjH3NR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335283, "uuid": "dcb30ab5-eae0-4fc2-8dbb-66269a542480", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335283, "uuid": "77d36a08-36ae-4fbd-a39b-5a57c02098c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335283, "uuid": "933a78cd-0135-4e24-8194-8076fa687ecd", "value": "siIts6bV7p8pVpA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7047f7a3-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633347871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347871, "uuid": "64bd5679-fa95-41fb-a4e3-0fb8c259baff", "comment": "Malware payload (AgentTesla)", "value": "3bd942fa68deb923211def04f6d7599e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347871, "uuid": "35331654-e8c9-4477-8694-a0798241c5f5", "comment": "Malware payload (AgentTesla)", "value": "654358b40477129118de96de09128bc4ba93a5fa5cfff544afad1ab0879da189", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347871, "uuid": "617a0825-49d1-4e0d-a6e4-b9e1fa517b91", "comment": "Malware payload (AgentTesla)", "value": "37d1179ab7f166b0873c8e05dcfd382ba6032a09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347871, "uuid": "be359c28-387d-4f71-8054-4722adab2193", "comment": "Malware payload (AgentTesla)", "value": "3559b1a3ed8fed6e09e1aa32ae99bd1138867bcf2480ab02def1a9332332aef42b3c99f2b2586d3d361b50818ddd24bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347871, "uuid": "c041f99a-e769-47eb-a294-e57b06b598f7", "value": "T10873E9BCF1870E988F8A87B9130B2F85111CB55DF7C890B532B8DB7825D1E7A861687D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347871, "uuid": "a5d0f29a-608e-4536-b629-6702a049e045", "value": "1536:OqvkCxiGLSJgnuulUCOlCA3Pr9Llglh0S5eS1eD6beyGI5iovFVVBrINyoLFNcvo:jk36aqGI5iovzVB0NLhNcv1GGMaNNr3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347871, "uuid": "9b6bb4f5-9bee-43e0-8340-587f93815385", "value": 78132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347871, "uuid": "8f8147b3-c867-4594-91c2-4d05c1cf56c0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347871, "uuid": "b6628f40-77db-4ee2-a274-2dc1441ea1a0", "value": "Offer Enquiry--YJ LINK.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a74c3a-24bd-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633315700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633315700, "uuid": "1b7c9555-d62e-48f1-ac37-868dbb44bfa9", "comment": "Malware payload (Gafgyt)", "value": "5a2f801be5c6c8f65a29d21724a85626", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633315700, "uuid": "83da2b74-a387-446b-b9c0-a7bdb8723033", "comment": "Malware payload (Gafgyt)", "value": "66f15f0e3a56fba3a6b37a050b5c0b0d355833138026e9e115737cebf8bd95c2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633315700, "uuid": "8864bb6f-7103-472b-8b8a-de3626e98491", "comment": "Malware payload (Gafgyt)", "value": "ebe8587835007ade0ecb5d796240c34f14c56d52", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633315700, "uuid": "6ca6ea50-1a1c-4475-a15c-5893c1d2f531", "comment": "Malware payload (Gafgyt)", "value": "eb7d9718661012e2aaf6c8545a2283df5ad32035527d1a726672a5b2b72a6e0dd51336424716148cb9c5951b8b4e0aa5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633315700, "uuid": "8e1b7c67-d206-4483-9859-dcdfeec025a2", "value": "T1AEB32B23F691CBBFC08792B426CF9D919833F1F91766322B33A46DB42B194C62D59E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633315700, "uuid": "0d96b4f7-67c5-45ac-bf26-ec722d1e39cc", "value": "3072:TyIF3yjczarP3Dpa1NDZ4FhzWi3+RmXZuJXQEFJZgQe:utrP3FZFhzWiAmXZuJXPFJZgQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633315700, "uuid": "6c5738fe-10d1-4404-b35c-035487d1d2c3", "value": 114136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633315700, "uuid": "e2a9215c-2fa9-4fd8-a7f2-01fe57e662f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633315700, "uuid": "8cf6e27e-0abe-43fd-b8eb-2f12dd2cde59", "value": "5a2f801be5c6c8f65a29d21724a85626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be564d4e-24dc-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633329104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329104, "uuid": "6e151f8d-e84b-4e8f-9a57-a4aa21474f95", "comment": "Malware payload (RedLineStealer)", "value": "e36ae1e3bfb505c2b765f03540f447fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329104, "uuid": "87db05f8-921c-425e-98a9-4e6076ae4326", "comment": "Malware payload (RedLineStealer)", "value": "66fb757759ed1304cbd914e9f6e39f3d01dfc666be70ce168ae2c5f95c277c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329104, "uuid": "087be394-d484-464e-a249-ef2694f62dae", "comment": "Malware payload (RedLineStealer)", "value": "1864a16250ab1925c0944a3e194d9a30803efbb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329104, "uuid": "fcbb821c-b315-4bbc-9be9-680e0f561e0b", "comment": "Malware payload (RedLineStealer)", "value": "5c334d3a1e716005d3383538de3043c44cb21cee13e5bafaeca2f324a21a7a08e342cf5bc91cfe0f0aacd24028bdbf0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329104, "uuid": "e320bc90-7a35-4c21-b1ec-7cce187d2c90", "value": "T1BEF49D54F11CD2B9FE1822B1363DFCC816F82EA8147DE91BB997B1E220B9E3154B0197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329104, "uuid": "76c1273a-e8bb-474e-8f55-60934479ad20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329104, "uuid": "e2d23a9c-f1f0-4733-8a3c-3c78fc8796f3", "value": "12288:+VnbQ+X8+UiDLbRHah9U31sEZJ+0akvWLfVqByOgU48AtB9rGGyCA6ZF:IbQ+X8+UiDLbRHah9U3fJ+0a6WJqByN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633329104, "uuid": "bd45978c-3437-45ed-8131-de265444d0cd", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633329104, "uuid": "627c01fc-d89d-4775-9e13-57b483d06d8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329104, "uuid": "4839950a-3641-404d-8f82-e611f23184e1", "value": "our ref 2735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d621d3-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633348233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348233, "uuid": "4a39f7dd-2b9e-439c-ba28-a5eac597a5f1", "comment": "Malware payload (Mirai)", "value": "019f7ba810e7ae6d34d5dc4e2d55da3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348233, "uuid": "bbfc601d-e1b5-4471-b9cf-fbca937563be", "comment": "Malware payload (Mirai)", "value": "68514f6feb93de45dcc47c106fa1451406e5382542f7c912afcef9cf07edbe9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348233, "uuid": "e1b1e7d4-d90b-4e96-91db-2cde614e0ed3", "comment": "Malware payload (Mirai)", "value": "843d4262bea7a88122660eb5cedf9d396490ecae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348233, "uuid": "781734fd-78cc-4444-91dc-fd86a8dbea27", "comment": "Malware payload (Mirai)", "value": "ee8ab5f33bdea3c15b3797b7da232d92aeedabdf51ec5a670adefa1b29e9a309cea5013258d5010caae46599eb3384f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348233, "uuid": "2c017339-9f68-400b-a9eb-4dec6404e9fc", "value": "T12ED2E1EC7A1D259AC8BD24B231DF27719E8972C1326E4FD59314088AD329B0B75CF914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348233, "uuid": "0d959091-0ebc-4452-9ffc-98697029c2c8", "value": "768:Ff018VxOovyEIUN9Ijbfn1yvJFjUKLkbT2HxeJYWFZ:i18HJIy98xajjD+TieJrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348233, "uuid": "e276604b-e45f-4fce-99ff-b823d58d830d", "value": 28736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348233, "uuid": "e4bced05-dfac-4467-a43c-150937a8c9c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348233, "uuid": "de221359-5103-411b-a12a-5d5f044eb586", "value": "019f7ba810e7ae6d34d5dc4e2d55da3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7072fdec-24ba-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633314371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314371, "uuid": "c4d7ed6d-ba5a-4ea5-a2a4-49d0f90cc87c", "comment": "Malware payload (Gafgyt)", "value": "e3652fd2c710829e46c74c0c7bb47eae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314371, "uuid": "08741107-b277-485b-aaf6-7382f9dd608e", "comment": "Malware payload (Gafgyt)", "value": "68ad7ad77ee33b7bc6d08fe4199f291eefcfc6e18b262a3587ebad9f624f8b13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314371, "uuid": "db6ff442-eb0e-4d5b-9b63-65c3fe2de07e", "comment": "Malware payload (Gafgyt)", "value": "aca2d1304f138503f6322f7bb050469da7a5a37c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314371, "uuid": "c5383357-2aaa-4699-b832-e24a83c4122e", "comment": "Malware payload (Gafgyt)", "value": "b72c824adc3edacd526122d8568306f16a3064061b0d888ab7ac466d6c55363c69e4eb8022b69bf8235b5089815d0849", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314371, "uuid": "3415d0c5-c1b9-4e43-8ad7-d7925a85c28e", "value": "T1EE044909F6404757C2E32375B68F434A37228BE463DB33065938ABB43FC27AA5E26D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314371, "uuid": "70f62913-c251-4fbf-9c35-45b81fa49fa8", "value": "3072:anxAJDautWsDx+7b31IAVIyKFhCj8CQsfM/9DfmmwGBoW0QL+n:ansDautWs1+mAVI9Fha8CQIM/9rmmwGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633314371, "uuid": "6e93775d-7652-448b-9612-af7e41b8322c", "value": 177998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633314371, "uuid": "cc469c21-cf35-4830-b37c-2547f2cacd16", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314371, "uuid": "e5d44bb9-eea7-44d5-a390-b0a84d4dd0ed", "value": "e3652fd2c710829e46c74c0c7bb47eae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7253338d-2535-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633367202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367202, "uuid": "e2c07537-40e7-4275-a2d1-418782d9db8c", "comment": "Malware payload", "value": "551ef5978797cfb12434b1b5c7e14064", "object_relation": "md5", "Tag": [ { "name": "iOS", "colour": "#F84C98", "exportable": true, "hide_tag": false }, { "name": "iphone", "colour": "#EE792E", "exportable": true, "hide_tag": false }, { "name": "mobileconfig", "colour": "#7A59DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367202, "uuid": "02df7327-ac37-4b36-8bd1-86573dd1fa94", "comment": "Malware payload", "value": "6a23109ed6977b74ec031a3eeeb51ca24582419bb8c11e2ec1d8af7a46b7eda2", "object_relation": "sha256", "Tag": [ { "name": "iOS", "colour": "#F84C98", "exportable": true, "hide_tag": false }, { "name": "iphone", "colour": "#EE792E", "exportable": true, "hide_tag": false }, { "name": "mobileconfig", "colour": "#7A59DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367202, "uuid": "1106d087-214f-4656-abe8-1b49bc3acc6b", "comment": "Malware payload", "value": "0ba421117dcf40625d9e28fae9e76af06aa8e7ef", "object_relation": "sha1", "Tag": [ { "name": "iOS", "colour": "#F84C98", "exportable": true, "hide_tag": false }, { "name": "iphone", "colour": "#EE792E", "exportable": true, "hide_tag": false }, { "name": "mobileconfig", "colour": "#7A59DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367202, "uuid": "3737aa1e-63ff-4bad-ab35-88f243a82830", "comment": "Malware payload", "value": "63bacf38e0a621401105675c02c8011678e9a61054c909bc377faae6b6033fbadc1f98ec86885ff1b4439c91805b415f", "object_relation": "sha3-384", "Tag": [ { "name": "iOS", "colour": "#F84C98", "exportable": true, "hide_tag": false }, { "name": "iphone", "colour": "#EE792E", "exportable": true, "hide_tag": false }, { "name": "mobileconfig", "colour": "#7A59DB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367202, "uuid": "2d310efb-a17b-44ce-a70d-a6521a3673c3", "value": "T195D1B7964B809C160E528921A2C5D96D8D70768F9DF2D0F3F90EC4C14F62B93A59F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367202, "uuid": "993500ce-8ee1-48e6-a03d-2f295377f220", "value": "192:6sf4V3yHGBmXocfA7ibbEGFyHGBmXoxoS0g:zAVPB1cfAubEGFPB1xoS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633367202, "uuid": "cd3bcb5d-a4a4-423e-a670-a192b7ea3a0e", "value": 6451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633367202, "uuid": "80bd2266-192c-40dc-af88-d5d73a23aaf6", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367202, "uuid": "2e3a5ecb-cdf6-4d77-8d1d-d784306b74a7", "value": "05010330beit.mobileconfig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7130e5df-2517-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633354315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354315, "uuid": "80baae25-75d5-47c3-a810-c855789a33fc", "comment": "Malware payload (Formbook)", "value": "839506b9d3655b1259a95797348748ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354315, "uuid": "4a59e479-e5d4-4a00-a28a-bd5f32dac69e", "comment": "Malware payload (Formbook)", "value": "6a545d90b499264c401c3afad3e926547f86349dfc12b9c50700afc0590cfc53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354315, "uuid": "f86e3961-c76b-47c0-8375-6a9f6f5454cb", "comment": "Malware payload (Formbook)", "value": "92e9c881fc6487f3533c873b08099b82c5ad51ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354315, "uuid": "b7fa74e9-d7ef-45fe-8086-ad45abf11a95", "comment": "Malware payload (Formbook)", "value": "e1f2a3355bacdee0be1bb1f9b301daa1b8b1194c7a10acfd6e5dd7d2fe35c25ac236063e5dddf46a98081b26f6827a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354315, "uuid": "99962634-6e9b-4ac9-ab92-40b1fd2f62b8", "value": "T1C484F16933A7A708DC38C7F52824A29127B66426150EC7BC9EDCD0FD7E23B7459E4A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354315, "uuid": "80341fdd-dd15-4ebc-9add-6248232c1e6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354315, "uuid": "c1945721-2300-42a4-aeeb-934695e62da6", "value": "6144:kt2rERQ+3HwOR3fQHqfY4D5jgL24waD4pd26J8vKRNvHe0f9fqrHTG/fp0:vESoR3kTq58LBwTuvKRNv+0Fi7TG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354315, "uuid": "31525285-3dc8-4bab-92c4-f53e43f19a4f", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354315, "uuid": "45cadeab-959b-429a-b8b0-a03c096f192e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354315, "uuid": "eee7c075-1f7f-43b9-b90c-0e76925056e0", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ea949e-24fc-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633342867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342867, "uuid": "42642054-1a52-4c9f-ab10-272801d248b1", "comment": "Malware payload (NanoCore)", "value": "e6a304a190393045871a1144609dc414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342867, "uuid": "b538e038-e305-4967-a61e-79adf26a6194", "comment": "Malware payload (NanoCore)", "value": "6ad6f24871ddeedb5dd1fd49abec8faae3a0809b3211c7ecce5fbce40dd28a75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342867, "uuid": "ade7483e-e938-410c-9a06-d7af1fc6b8a5", "comment": "Malware payload (NanoCore)", "value": "3606ac6e3d8ee7087e8a92da44bdbf6169794bb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342867, "uuid": "0e234164-a63b-4b71-96a7-d56d22ade020", "comment": "Malware payload (NanoCore)", "value": "55aa84bf835528d1117ebb1d713db5b8ed981d29f422e118591b023ee41e6c8d33144f5eb8db0e7ca7de92c616d7a2c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342867, "uuid": "df29d640-1f04-4659-89ce-e6c1ee422d8b", "value": "T1D142F95273D4DBA5E8669A75FC3356000635F33BD8A39F2E14CD503EADA360542E2B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342867, "uuid": "43c4e960-68b1-43d4-94d1-6735dbcea7e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342867, "uuid": "b89ca92e-7a0d-45a3-8f7c-9f225af7e77a", "value": "192:pLU/9thAs3VkI0Z2tQN6WcoEuQqMT0U2/JT0JN7Kaemj:pLU/9tis3VkI0Z2iN6NBpnT0UUKN7KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342867, "uuid": "4a78117a-ed7c-444c-8aa5-fffa7cba6e8d", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342867, "uuid": "ef157452-1f73-4840-865e-c0bf404cde41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342867, "uuid": "09d35d00-bdd0-4b31-960b-7440aea44f2a", "value": "e6a304a190393045871a1144609dc414.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29b3d35-24d0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633323984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323984, "uuid": "b50d5254-623f-42c8-9b28-49cf27b73482", "comment": "Malware payload (AgentTesla)", "value": "2eb017a94885236c6427f59991ad760a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323984, "uuid": "a005004f-2b59-4168-a631-c64943521e04", "comment": "Malware payload (AgentTesla)", "value": "6ade7c92b8ada61b23e10c3c9b6a698f429025da6782ebdc32b23027d21e43ae", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323984, "uuid": "a5b12045-0347-4aae-94a5-526659f14c71", "comment": "Malware payload (AgentTesla)", "value": "b2c8d3699e539749e4b61241b29e39bb92010a3e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323984, "uuid": "b2eea556-7fca-46c3-8aad-c3c01df6babc", "comment": "Malware payload (AgentTesla)", "value": "7d73f2e495dd56759ef6d9866c0df5120015200a2339280a520444b79716260e55585d83c0e59516e996e9339e260ec1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323984, "uuid": "e856f4bc-ebb6-45ad-9ddd-06d1766ef3f9", "value": "T1399423E0B6728EB8ED6A1EB4228F56FFD0EC07587196F1D4D2A5B0D471EF8423294E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323984, "uuid": "822336ae-17c9-41cc-a843-e9ac5bcee21a", "value": "12288:kk9aTlVrCCXlLKHvKtXWs6ilS5n0OtTwSLV4iMiB9:kkKVeC1mCsJilq0OtTwSvt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633323984, "uuid": "c470cb23-6c82-4ce3-b658-79cf5e009fe7", "value": 441559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633323984, "uuid": "ee760d39-342d-4863-ae12-e77926354241", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323984, "uuid": "2f4d0a18-762f-472b-9f67-667d73af5e7d", "value": "UPDATED SOA.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2235f3-2527-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633361259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361259, "uuid": "3e758589-9c4c-4c19-8096-9714bb43c868", "comment": "Malware payload (Mirai)", "value": "6825f382cf6b651e6aeee1ce5f9a6795", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361259, "uuid": "aff06ca3-66e1-40ea-8278-736be00ea633", "comment": "Malware payload (Mirai)", "value": "6ae5fa924ad0b5b67b297ab730f1bb46e7c65d1e3194420b9bc3f4b19873df82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361259, "uuid": "e3502a3d-3acc-4133-870e-3a03363ebd91", "comment": "Malware payload (Mirai)", "value": "a8f1934ea4929a0ba057600617b57062c74d1931", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361259, "uuid": "0dc1cae5-1b9f-42ae-8cc5-69d8f84609c9", "comment": "Malware payload (Mirai)", "value": "ac40ec77240a4bf49e4b9c09de2f9d12ee75e4f30e31de988689593cd24cd023557a41c75cf1257fc70f7b9551a1e9f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361259, "uuid": "90ed983c-11e0-4cca-955f-bc071ef73015", "value": "T14E3308C4FA8B89F5D90749304067F13FCF31D5B941B1C6ADEF9A9F35CA67642920228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361259, "uuid": "7cfccb89-940d-4dda-85c6-2b1377279c00", "value": "1536:nfyMY0q0Yv5qP69Dj0MGNLijtdbL7YkO0FtP:fyMY6Yv5qP6BoNLiJdbfYB0F5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633361259, "uuid": "cc04217b-7c7b-4668-bf6b-4249d49d860c", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633361259, "uuid": "9000c8b6-c66b-4fef-a258-b516051ae8a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361259, "uuid": "53a43ab2-2c00-419f-b52c-e9ab1a3a5214", "value": "6825f382cf6b651e6aeee1ce5f9a6795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a00287a-24dc-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633328963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328963, "uuid": "2ead5290-0ef3-4894-b01e-cd6f4bb1157c", "comment": "Malware payload (RedLineStealer)", "value": "2f033d39bc6b6cb960b928b075fde301", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328963, "uuid": "826e98d3-f795-4a71-80f7-acc035615c9e", "comment": "Malware payload (RedLineStealer)", "value": "6b19c8edd9df5e1c99ab91658b265fdcbfb61669d64679ff622d61e83622f4a3", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328963, "uuid": "d9fb734e-3a62-4c7c-b53a-b489ffb6e975", "comment": "Malware payload (RedLineStealer)", "value": "0c4888a8c46a681d00fd5318c3b82e1cfeb1d4db", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328963, "uuid": "22883154-a95e-464f-93f5-ae61b7e4ed88", "comment": "Malware payload (RedLineStealer)", "value": "60996fb6e87adc52681e75f06364d515adff7c0b0483532091f433f8b3102b07da89abebfe025312ce72291f0c3df55d", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328963, "uuid": "e2f9e7e5-0db9-4f8c-8a1c-9ba36b40329d", "value": "T15A451258137B101ADC764FF998F25682273BF021234CEB75BACD714D17E6BB86AA0D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328963, "uuid": "1cf42ae2-398a-4e9f-911c-3c2fe1895ab9", "value": "12288:nEdBaegj/P6Sl0JAoWYfgwthi+6gDZ9D7VKT6t5TeEwEKuxX/:nEdLgLQvt4vgntKq5TeE1KuxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328963, "uuid": "2bd3155d-72e7-4ede-8a8e-478a06affe53", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328963, "uuid": "d236ea3d-10fe-4ac7-b669-4ffd3221c6c1", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328963, "uuid": "b3fb13b7-e3cb-41ef-92d2-1bcd04395ada", "value": "PO# SI-3701112 MO# 10146325.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817631d4-24d8-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633327284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327284, "uuid": "f84037e8-b46b-416f-990d-077697c6657a", "comment": "Malware payload (GuLoader)", "value": "2c81e0f87b5ade59b4152cc9887c30d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327284, "uuid": "bd4913e8-64db-443e-bcc4-51e53d774d31", "comment": "Malware payload (GuLoader)", "value": "6b29530275b49c9e0563b744fcd72594c4eda88d8a4e510ea680867df1c9761a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327284, "uuid": "1eee7721-6f54-48c3-a100-769818c6ec96", "comment": "Malware payload (GuLoader)", "value": "90173704b1c78db0e590c2c990f4fe88cea76526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327284, "uuid": "c5e0d43c-f804-4c8c-b8e7-000252fb9424", "comment": "Malware payload (GuLoader)", "value": "2f7e2f5b5c3c2e29985c600bc9dd9e29ee23d911a7213f3563867dc477c65ae7b7490c0a9877cae9849f7ab1971fd2e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327284, "uuid": "1c166482-7dfb-4973-a7bd-bd4ae79dc5c6", "value": "T17CB34A517285CCA2F5404531CA93D6F44BD3EC6C8E56C7077ED87EAE3FBA280A6126D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327284, "uuid": "f1cbeac6-8686-42ab-918b-d89145a090eb", "value": "034798d5891f6a110ab94befc4c55274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327284, "uuid": "6b50fb1c-436f-4588-a9b1-7966dc814ab1", "value": "1536:FDdso0EEatBpjkX0Ib+e5pdoFdgnd0z+c78cO:FDdsobEeBhkki7o7+cI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327284, "uuid": "aaa2499b-3c2b-4f4a-8216-1c024a875b0b", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327284, "uuid": "8a4da112-3d8f-4ce7-a36f-d7ab811db1e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327284, "uuid": "ed045838-458b-4eb8-bd82-af359a84dd4e", "value": "Invoice Packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13130144-2504-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633345997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345997, "uuid": "cb73f914-8c74-4198-96d6-5fb638d6133a", "comment": "Malware payload (AgentTesla)", "value": "38af99466b5e62879601f83fc5601410", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345997, "uuid": "fbbcb423-2d08-4966-9d05-92a6f24a99f9", "comment": "Malware payload (AgentTesla)", "value": "6be78f9927e05b2e51d5815ed538ad7bf3e3770c1bbb63f4b5daad4ce75e14dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345997, "uuid": "2f0fdedd-116a-4950-aaa6-d0b2615b57fb", "comment": "Malware payload (AgentTesla)", "value": "dabb62f4f6c46e3646004665790ac0971207efe9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345997, "uuid": "47a7c86b-7aa4-4d98-9e11-b7d19caba531", "comment": "Malware payload (AgentTesla)", "value": "416e64a35e79250e0b193f4f69ac18cbbd48635e370d7aef575b400b3f44cd0778d1a9cf602f81e60076bf5115b41a3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345997, "uuid": "bdefbf7a-6db8-4349-9b4e-a7d860626037", "value": "T149C4DF57A6DFA2D8EC2C86F01C14F39D2B726C2A1059DD3C6DC9F498263126625F387E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345997, "uuid": "4a4c450d-96c0-436c-a6cd-5cf62d498eb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345997, "uuid": "e5038bd6-931c-424f-b823-0a1dd13ddd17", "value": "6144:h+tKpERQ+3HwOnf9+DynewPjQAfvRwuPNubeSKJg94gnbaztTFzOUm5qlY9gd0:rESoweewJ6EeZKJg94MotTgL0Yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345997, "uuid": "2f90a5d5-ef9d-47d6-b5a7-10fb09f5b1a3", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345997, "uuid": "bd1ddab8-844c-4c67-9989-b9e01c866216", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345997, "uuid": "fd4ac577-accf-49b2-a753-90ce90738644", "value": "Order List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a46a48-24f7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633340651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340651, "uuid": "6a148801-69ea-4db7-9226-2238d0957eba", "comment": "Malware payload (RedLineStealer)", "value": "727b7725e1279d6bff05a13e5b9663b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340651, "uuid": "fe47ac43-c6ae-47ba-a819-4c39f73d032e", "comment": "Malware payload (RedLineStealer)", "value": "6c42f8aba403b171e9bb62f8368a3d4998d219ab30683f64db9f0f915eff623a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340651, "uuid": "b1497618-801c-4265-bddf-6e0414b78e3b", "comment": "Malware payload (RedLineStealer)", "value": "d552dd7331296fe6c93a3baabbff341f0221785b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340651, "uuid": "b1a200f9-4435-48dc-816f-a696e00246c8", "comment": "Malware payload (RedLineStealer)", "value": "5527426235cff44f4af08fcc782db7008e547e7ced5e7d83ebd3334a1f67a83e56e38cd71abd7e3eddd2310bfdfe2ead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340651, "uuid": "54ce0bba-6432-4952-9706-400e762b6e45", "value": "T1BD835067AE2A5511C0E50BB18E5BC0344AE75C469673840DA8F13E47FBB3738A90EFB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340651, "uuid": "9b47ed9b-e600-441b-95bc-c90928eaa969", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340651, "uuid": "dd4d1478-35ef-4a40-920c-6c2edc854981", "value": "384:ayuGsx0ynRCw6b7T5JPkTJlBAJEEENqbvaiYFlQu66/wobiVRw1gWthW:ayurxLnUw6b7T5JPiBA+qbvaNlQp4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633340651, "uuid": "cf7d7391-f187-49fb-94f2-9093def721c7", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633340651, "uuid": "121a87b1-5628-4724-acc2-56af2d12cfc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340651, "uuid": "e4f8872a-eb78-448b-8bde-d6d7aeb3f74b", "value": "Emask PO091921xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639f75a7-2525-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633360305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360305, "uuid": "826025aa-2f64-4cdd-be6f-314e5ba9dadc", "comment": "Malware payload (Loki)", "value": "f7cd46b1446c5f460d56ac08d6463e9f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360305, "uuid": "94f2a04e-744c-4b2a-b439-ebf852fdf067", "comment": "Malware payload (Loki)", "value": "6c50826ff833a9077d9235faeace08af9f973629592199840cc165d399646bb2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360305, "uuid": "6777d98c-fdbf-4fd5-b37f-7e6b133a3a67", "comment": "Malware payload (Loki)", "value": "cd018a413139230e504e306d24428465b4b2342f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360305, "uuid": "8da08b99-8355-49c1-a962-26e700328c2f", "comment": "Malware payload (Loki)", "value": "6d4fa2b0036c2211ee1cbc225c4db2d622e6993a8dcedf34421799d9881f44d0e58e12aac36ad6edc30adc5c36af87d5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360305, "uuid": "fe5e748f-465d-4028-9e90-53dd0df41015", "value": "T176641207B3E3B35AF0AF1BBCC87B9D727163DF41C7A96282611875CF697891114A813A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360305, "uuid": "70b9eb49-324f-4f73-ae7e-903c7a06e913", "value": "6144:gGVMeWCGKVNbZ/5rA7Lr4VxrYZTdy/K1DEZws:TWBKVJPrAHr4VtYZhySNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360305, "uuid": "f6835ede-4fb0-4276-9527-bcaf5f882513", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360305, "uuid": "1620e199-ab97-4d02-b1a1-edbc9d453f3d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360305, "uuid": "6994cff2-6745-412c-a7c8-93b7b3c87d16", "value": "VK-8722-513-087ENQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab827b1c-24b0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633310175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633310175, "uuid": "c1ab6604-c6ea-40cd-b83d-2ecd4482fd1e", "comment": "Malware payload (Gafgyt)", "value": "9015654c8e36e6c1b59afd06bd8c1418", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633310175, "uuid": "b079e9ff-1296-4005-a2c7-8e280eb06e50", "comment": "Malware payload (Gafgyt)", "value": "6c5efc4157937ffea9555cfd3f07a4177be009f6deb486bd6ee59c9b43941dab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633310175, "uuid": "3b5e2bda-6c39-4487-bf05-bfd0cb9dd84f", "comment": "Malware payload (Gafgyt)", "value": "e79820924cd2265ba412829f837a1a7baf1ef63e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633310175, "uuid": "9ccb5f6d-d745-4c90-97fa-17a46f65d8fe", "comment": "Malware payload (Gafgyt)", "value": "6ceae06c90cdcbf101735f6180a337053608400f8c3ef486101953f0f4b8159afabd73171bc96719798560d958395f32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633310175, "uuid": "dd8778ec-d823-4b47-b859-674da7eed388", "value": "T1D0E3A53E7A11AFBEE168827107F29F70CF9529D326A09381E26CF6185E7118D0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633310175, "uuid": "18a219a4-425c-499e-a724-d388daa11d6e", "value": "3072:JW6Bu9tS1aRG4dKP6hT/F1N2mrThPaLEnn7rNb:c6Mi6bFCmrThPaLEnn7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633310175, "uuid": "f9a71074-6149-453d-b810-a9e3e7fc21f6", "value": 155427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633310175, "uuid": "9e86b469-bae6-4ebe-b347-01a4fd9f59b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633310175, "uuid": "723f9e07-0df5-4243-a4fb-d72b77e7076e", "value": "9015654c8e36e6c1b59afd06bd8c1418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3283b38d-24ba-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633314267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314267, "uuid": "0b373ccf-749d-47bc-bb21-33e984a782a2", "comment": "Malware payload (AgentTesla)", "value": "272c1cce4c73c2213eb9a228c0d2c8ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314267, "uuid": "d3396ee0-b18f-48cc-bd06-3ecf467b6174", "comment": "Malware payload (AgentTesla)", "value": "6c7963752027a514f8bed1a54a61c6314465fff60ba680b57746931edc2516a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314267, "uuid": "1633f60c-68cb-428f-895b-35504366ad47", "comment": "Malware payload (AgentTesla)", "value": "03f443a7176dc58cfcb9d53370632a1b4ef80055", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314267, "uuid": "964d5dfc-d951-4e9a-8baa-dcdbe207ac64", "comment": "Malware payload (AgentTesla)", "value": "7d39ccfd3898bfcbe8f1d3b4597b399f1f566fe7fc6a55265e3f57fa80d18346e43b2f3f0942d0ab4a18e8b87b494d67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314267, "uuid": "57c11a7d-09ac-4eba-92e7-0af753bff6a1", "value": "T1ECD4F16F3217AA8BCE7C41F4385491407BF7846B1116E3E84E85B0F92AD3BE85B91D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314267, "uuid": "fa7f82ac-a5cc-46c4-bd80-284e8bb7ec0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314267, "uuid": "32069748-f794-4175-938a-adca0c646795", "value": "12288:frkBRKG/x4oXhHcsZnUSXs2DDwkAsZ8r7WJT6YashlM0JT6YashlMq+ov:4Ka4W6SXs2okFZ8Py9ashlV9ashl1+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633314267, "uuid": "eb5c8797-e920-42be-8d68-c29dcb6ec3cc", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633314267, "uuid": "ff877495-b98c-4590-86d9-244d1678741c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314267, "uuid": "5ecfb440-eb41-4ff8-aff9-d6f21a3ba754", "value": "Confirmation 4500159299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422bbb2e-2525-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633360249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360249, "uuid": "c59dcc4a-06df-4b69-bf07-38568bc2bb25", "comment": "Malware payload (RaccoonStealer)", "value": "a57b534715ba56f5f9f9f27b0d57ad34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360249, "uuid": "1fa8b19f-819e-41ff-a2e6-1b06ab7cd97c", "comment": "Malware payload (RaccoonStealer)", "value": "6ca5031ab0efac1fdc6d3b251072ea93e70d911067995cd367778bfffd2b45a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360249, "uuid": "e9846a5b-1ac4-461c-ad65-355c903777ed", "comment": "Malware payload (RaccoonStealer)", "value": "0fc07bf4defc689bace1dd256fc096174a916878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360249, "uuid": "7b7de800-b509-4a33-85f4-5403532e13e2", "comment": "Malware payload (RaccoonStealer)", "value": "0a062d8529febbc4ab7d163b4393f54e75ca840f2784afa7910d65b656d58fb42d93a9988f1e3d6285f057198d7140e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360249, "uuid": "76cf7644-7c8f-4d73-ba3d-19e7ad323371", "value": "T1E9C4F10932B5E7F2E27242B16762C7F04B6CBC6D5D25528F6B881B1E6E7C7D29732201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360249, "uuid": "ff87f1c5-09bb-47e5-9697-70718df6b0de", "value": "00e4a9909e1dd2f9b23ab751bea778c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360249, "uuid": "9d288cbb-c705-436b-94dc-670a69e4acbe", "value": "12288:D+RM1l85GBqJ7dInwNhm3bCHdI9ezxp6L:DuM1l8VRcy83b/y36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360249, "uuid": "2cd3fc26-8a65-4df7-8010-87e78f3b88bb", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360249, "uuid": "233a18d0-9902-4a78-ad95-5de2594fb85d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360249, "uuid": "3f090eb0-851c-47d7-bd37-b2d9b2386295", "value": "a57b534715ba56f5f9f9f27b0d57ad34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3129b217-2529-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633361939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361939, "uuid": "08a4d209-c95b-4351-93d6-c1d303d0c9d2", "comment": "Malware payload (Quakbot)", "value": "cb3ed0fab377c48841597c09e0fec1f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361939, "uuid": "9505306f-ac65-4f70-9820-4ad2a8abc471", "comment": "Malware payload (Quakbot)", "value": "6cd4744b21f0f2f3145ff26150d7c8db36da68a4cf5d7ba7346cd2a31569c871", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361939, "uuid": "ffd51420-c167-42a5-ae93-0d140934c24a", "comment": "Malware payload (Quakbot)", "value": "6e74569cc356139e1892732fcc97a6ec94c6240e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361939, "uuid": "95cb87c2-fa6e-4638-aeea-5f712c9502c2", "comment": "Malware payload (Quakbot)", "value": "81f115d5cce91aaee316a8dc4442b2e0b55bbcfc2d7e21b2de2422a5872e228efb84e0aef8a0cbac7905273c4ba896e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361939, "uuid": "7e1d2851-9805-48d8-bd08-47be089ee32d", "value": "T177B46C507751E4A1E67D28718E28C9E90A097E068FB2B4EB79E43F1F6B6D9F7C011702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361939, "uuid": "1977785e-601c-4923-80a3-9b6776051053", "value": "e4fbe8cce04bb55a530853e0c72f4bd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361939, "uuid": "ffb7b905-37ba-4b4d-a712-c679b59b8c49", "value": "12288:4W7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6zUV:4Wf3YTnJLBv2EKMAcOgqxETMNIpM6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633361939, "uuid": "766a4782-6a7b-4c39-8735-88a3812f5e99", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633361939, "uuid": "b87806c9-58f2-48bb-a58e-6ff916a54710", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361939, "uuid": "22cc5aba-a8bf-4201-9af5-9e999a8c03ce", "value": "cb3ed0fab377c48841597c09e0fec1f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e921519-2502-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633345345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345345, "uuid": "fa1c9f08-b7d4-481a-b83d-e0f9650a2abc", "comment": "Malware payload (AgentTesla)", "value": "9ecf694137c6cafe4de437bca4866dd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345345, "uuid": "687124b3-58a7-43a6-9fd5-4d28e0610b80", "comment": "Malware payload (AgentTesla)", "value": "6ce818d1d57221b163acc5f1c9b5efc3c592fd08784f55d326bfe71bda4c22ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345345, "uuid": "ca63e447-9c16-4f59-9f35-43106b9a20cf", "comment": "Malware payload (AgentTesla)", "value": "e0ad989f35f476789ab1822ef0ec6f9775230ef9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345345, "uuid": "c228839d-57a5-4440-9cb1-160a059d6a87", "comment": "Malware payload (AgentTesla)", "value": "bd763261488b69c898b3b42c253f33673497cb3a88b28ef4864e38a745bb62b3070ff51d3765fb6256aa685968ea70cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345345, "uuid": "7fe867c5-644b-47bc-a566-36b9f5757d5f", "value": "T1A6A4122572684D7BD5A852FA44622551D3705A3A08D3F3DE7DD220EEB6F33E07A892C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345345, "uuid": "f545fc54-1f79-4ace-ae39-fc5497702ed8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345345, "uuid": "a5452432-32b6-4d8d-af7e-ac10639bd16f", "value": "12288:IRfbwYn9l3fTPoVhMbaG1ffa3xahaUL71yxXYSQ2:mwYn9l3fHbaG1aE5mhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345345, "uuid": "4396552a-bb79-4689-8754-3d69518f019b", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345345, "uuid": "9b47f64c-3fae-4d76-af90-716ec8c8bc80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345345, "uuid": "bda27546-d10a-4ebf-9f1d-e00691416f0e", "value": "P.O# 21-1477_20-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07cbf3d-24fc-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633342852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342852, "uuid": "b59bd5f7-834b-4da4-a8eb-5388a90555cd", "comment": "Malware payload (ArkeiStealer)", "value": "adcacd9e20ecf85778ba5e27257ba966", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342852, "uuid": "8fe9a134-ffde-4aab-bfc5-d4ddb1c006c5", "comment": "Malware payload (ArkeiStealer)", "value": "6d17e177673f0b60e657f7918c06b128b5eb46ffe9f7ab2c7fd7968b95b388d6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342852, "uuid": "ed3e66d7-61f5-4f7c-9132-c36686b14db0", "comment": "Malware payload (ArkeiStealer)", "value": "e6595127bd5e1800dcd7144f5c999cd8ca7b5c88", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342852, "uuid": "6103eae1-9e0c-4ad7-9121-20f9cd11139e", "comment": "Malware payload (ArkeiStealer)", "value": "a15a5396c4d2b4a990c981e1b8f4f336e7e45b0c48abd45c0c2f6f808cdf6e9bf8eabcf2e52c4fdf90b837fc07d65efd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342852, "uuid": "66ece9a5-00c8-4f75-9217-ca9acd5bcf45", "value": "T173F40128B5C0D7F3E6720174BB25C7F0862EB8AD4D66528F2B88A71F5F383C19625356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342852, "uuid": "aa7dd455-31d4-45cb-b87d-87168df80bbd", "value": "ea6e9add4feec4142f4eaf80b256f47a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342852, "uuid": "e3d707ab-9ee7-4f08-a3b5-e2a8f4f73230", "value": "12288:jr6jFwP32g1yYoer/lhehm+M8QbUmdY6caj7GRuUt9KTzxp6L:j2s32gdfehQlb1R5Qi36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342852, "uuid": "10cd2d2b-39a8-48af-bf91-53c56f4949c1", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342852, "uuid": "dc565d78-34dc-47c3-b7b0-3c432186d209", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342852, "uuid": "3e63c909-6c0f-4173-b7b2-14176304143b", "value": "adcacd9e20ecf85778ba5e27257ba966.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e08f614-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633341720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341720, "uuid": "97c2ef7b-b219-40ed-ae3c-117bb3969958", "comment": "Malware payload (Mirai)", "value": "09b330ff7712173edd593a5b4a392442", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341720, "uuid": "eeee7d87-a4ae-47ef-aa6a-f3426a72a18c", "comment": "Malware payload (Mirai)", "value": "6d22938d9b8940c71c3920b9705fa9f64c3c1dabfa157742a6f7db6f205f9060", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341720, "uuid": "8c2fe9a0-339b-4c9e-a3f7-de68857327e0", "comment": "Malware payload (Mirai)", "value": "9f50643d9295d1691540b09bf6b6b2ccd2d2c51f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341720, "uuid": "239d1694-6d45-4084-bd38-a062c25b07d3", "comment": "Malware payload (Mirai)", "value": "07e1cd5249242b4b7697049773a6da7d6f5fb0a4365025a696e3f5169be17aa495eae1bd9a0d6bfd2ce122610242bd66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341720, "uuid": "a92965ed-b5c1-4006-9335-a0a4ebbba28d", "value": "T142430251AFC139DFE8955D387C1780AB2B426DFF56FF228790902958FDA2404CEA171E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341720, "uuid": "83c41178-f3bb-4b3a-832b-88f9f2c285d3", "value": "1536:wXkyI+x9mYxqu9KXxLlbzMPPLZRSYr9BUkIY:wUyHYDkolfMPzZ0q9BU/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341720, "uuid": "d464636b-2332-4f08-8a9a-59c4ac7a1d18", "value": 59748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341720, "uuid": "515783f2-e922-43dd-8c86-afd3fddf486e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341720, "uuid": "ff0b1ad3-798e-416b-aa18-09605c27b3b4", "value": "09b330ff7712173edd593a5b4a392442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0adb55-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633360908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360908, "uuid": "7f51b08b-cc46-4ecf-a1bc-ca99b57ac26f", "comment": "Malware payload (Mirai)", "value": "31898eecc00abb26be949765e71e574e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360908, "uuid": "8607cd00-81ac-4da4-a898-24f8367767cb", "comment": "Malware payload (Mirai)", "value": "6d4de75278dda9ac236b39df59e34fe339caeae7aa9bf4d047ed4da6e05c3216", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360908, "uuid": "9763ebf3-d285-4c1e-a431-00b9f3e299e6", "comment": "Malware payload (Mirai)", "value": "e2c200e78d07185de1b0fb772a91828f11bf22e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360908, "uuid": "0aad8826-c6b0-4c23-b6e4-eee7d425be74", "comment": "Malware payload (Mirai)", "value": "4caa1a8d140c61e1b5de95a79fadbf46ede5230578094a7ea02d7e6cdae362890e369ff1de2056b8625c688847dfd928", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360908, "uuid": "8a8c967e-d6df-4ed7-8617-442dc0332a2e", "value": "T1F7234CC9A587DAF8FC160B742172EF325BB6F93F1018DE47C7A59933D942602D10A1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360908, "uuid": "dc725115-f570-49cd-aa03-a542212f39aa", "value": "768:13sPWVrWy7PBIe9iFokjlMdMhc0otXzHFxK0XY1ww5TKILpZYiG6Xls:DD9IciFokjlMdMO0iHrKuY1z5TTLrrGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360908, "uuid": "be485e74-971a-46ff-8336-bc294f3f54eb", "value": 47056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360908, "uuid": "e53ef045-3447-4e01-8599-549348be0485", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360908, "uuid": "7179f2b6-4785-4ed5-9dc0-fd2abf6ec55f", "value": "31898eecc00abb26be949765e71e574e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb01a4a-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354630, "uuid": "6315ef53-3fec-4d7a-9f35-f654a3f7447b", "comment": "Malware payload (AgentTesla)", "value": "3e2ceb63057286acc96bcc37769183a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354630, "uuid": "8f812b9f-f504-45d1-a5e4-4f2df31ffb4a", "comment": "Malware payload (AgentTesla)", "value": "6d59a26eceafad84e043ea40c81b10b501c63c7ad9a15ece7c2867802801ab02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354630, "uuid": "b13ac228-60da-4246-9b9b-ad7da6a79f29", "comment": "Malware payload (AgentTesla)", "value": "e6f05d98c21391ab5edf14e73421d15877741484", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354630, "uuid": "58325892-2dc2-4fa7-9bdb-99c4bf2edee3", "comment": "Malware payload (AgentTesla)", "value": "ca13df89e74e9940650de6a33a417b493285fec20ee7960d30eb3adf0822d73ca81e2854b3f1694338610f0ded88a5b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354630, "uuid": "b724915e-f4db-41c5-822d-cc3d412e765e", "value": "T114C423D3D5A19247F51705BE0457B1FA66D3EE7FCE84CD800AADBCC9A204C6ED6E5220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354630, "uuid": "3cde6f77-aa95-4eeb-b82f-defc87585164", "value": "12288:Vvndp/g1BAk91vqEQIX/8fY7Q7i6LLHAxHHTGvcJcEPIY4LCfEJWm/XI:lnLo1BzMEBX/8fY7QeVGvlEwbm8Im/XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354630, "uuid": "7baff161-2bd1-449f-af33-e7ad0568eda0", "value": 547912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354630, "uuid": "21d34870-d727-479a-b3c9-3c49b2f30062", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354630, "uuid": "fc5df032-f427-495a-a628-c690c4acc1ff", "value": "3e2ceb63057286acc96bcc37769183a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62016d57-24ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633343982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343982, "uuid": "9945916c-8ee4-4bd8-9a08-2fd1e34ecea6", "comment": "Malware payload (Formbook)", "value": "ba2cd86b94baeb58becd532319250fe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343982, "uuid": "802ba266-d49b-441a-847f-942a19fa5d9e", "comment": "Malware payload (Formbook)", "value": "6d725aa4c3dd38bc7f924af4891b82a9c993e2db67765c72be42778a9c1b561a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343982, "uuid": "dcd47707-0f7a-4203-9e2b-86d6faa0db65", "comment": "Malware payload (Formbook)", "value": "31e88e27c5840c2a0b7840d3c4c0acd489f0a8e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343982, "uuid": "11de9d9b-ae70-4423-b3d5-013c595c4f92", "comment": "Malware payload (Formbook)", "value": "83139c23aa21b393ff5a7825f9eeaf0b44b162a0e756872dfef230f3438a37c3eb29715266eb0f034681dbe24df9aaa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343982, "uuid": "d8bb15b2-d52c-4179-a3e4-8a800427bf83", "value": "T18D441216A6E19EF3D7441A31893AF63EF337C114928796CFC7A82FB72A10057B6606D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343982, "uuid": "83b74b3a-9daf-4254-a88b-4d9bfc7668ff", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343982, "uuid": "0d15be8c-dfee-4d8d-bca6-a352ca9f02fa", "value": "6144:F8LxBsILehr/8rqSEeh2K6T+FISUYwZj6zVoooV:/weB0rqSECK+FIkwZORoLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343982, "uuid": "27705bee-f1b6-4561-b409-b8a3e7064c50", "value": 265643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343982, "uuid": "1ee94fd2-c153-411d-bf80-e098ba90f561", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343982, "uuid": "16e79e49-c8fa-4147-abb2-06e8567a5a2f", "value": "Nouvel ordre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7c2850-250c-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1633349747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349747, "uuid": "d8739990-3842-4fff-a0a3-571d0d2ed3c0", "comment": "Malware payload (njrat)", "value": "a7ffebe2d929cb30d09a5f97bf04bf4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349747, "uuid": "9ff6da95-77d8-4b5e-957c-00865b3e46ae", "comment": "Malware payload (njrat)", "value": "6d8714bcd12dc506609b53ee525e2ee435e154c3c4b1087c8285f3fd2e678dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349747, "uuid": "a8074234-a974-4269-85f4-6f896eb7c4fc", "comment": "Malware payload (njrat)", "value": "0973fa934cbac60167827c6131330f5c1455b6c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349747, "uuid": "73c778e2-76c9-449b-b9b8-c30d6da9ab2d", "comment": "Malware payload (njrat)", "value": "ddf39bcd050571ec5403b1b7bfe192d823b769bb045d531b9c75fa9a12e93cd2cc837ed8d56611112daadb72442382dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349747, "uuid": "af9f50d2-a77f-4cb2-811d-710dd931cda4", "value": "T152033A4D7BE1816CC5FD097B06B2D01207BBE04F6E23D91E8EE5649A37636C58B40AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349747, "uuid": "31a92dbc-398a-498a-90c1-5f9e12625bcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349747, "uuid": "bb277a64-4977-4956-9978-aeab78b416c9", "value": "384:8cLnsiDjT95hL5YyUvZ7vLOw4qYddArAF+rMRTyN/0L+EcoinblneHQM3epzXxNE:TLvv5zUvZ7blYrArM+rMRa8Nufqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633349747, "uuid": "5c7100fd-c54c-43b5-b7c8-81b42270a8b4", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633349747, "uuid": "cb8b8f4a-2640-41ed-bf61-9097640c8759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349747, "uuid": "1d72c5d9-e198-4eb5-961d-901b54b78826", "value": "a7ffebe2d929cb30d09a5f97bf04bf4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18a7b4b-24ce-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633323123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323123, "uuid": "2db4642e-bd5a-4c2a-b826-666a84c59534", "comment": "Malware payload (Formbook)", "value": "439ec2917b590c3172a790f519f751b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323123, "uuid": "97facc40-87b8-40bb-be7c-ae276f9b365a", "comment": "Malware payload (Formbook)", "value": "6dbd578bacfac6bee49b778b85cd62926c65a7f23bb33ceec705686474308898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323123, "uuid": "6dbdfb94-5a84-4b70-baa8-317262cafcab", "comment": "Malware payload (Formbook)", "value": "5280d1249d0ca942d22d6c78cf864f129d867b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323123, "uuid": "d6707b01-9999-4371-9f4b-aac2fa461444", "comment": "Malware payload (Formbook)", "value": "daebdb999f5713da333f579a202780f3e181074dcae06e02a102e3e9cd5db43d40411b749399a58d135bf759248fc996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323123, "uuid": "ddd9de8c-9c4e-4454-a6c9-0f39f404afe4", "value": "T1D9948C016602D76BD98665F40F30E2FD922C7C892880D08656ECAE3F79B81DF6639DC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323123, "uuid": "35925470-5a3f-42b3-a85d-f254b2421b74", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323123, "uuid": "a8a93d61-ed4f-4137-b7c9-ea8a4ca2b774", "value": "6144:G8LxBVkCInwNqWBD5Xz560A5A8/0FwN47sfJUhhRXmRNOE6SIfBQW8aFm6HlVGjM:bFBtLAq8c7bhh/l58aA6FVGj45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633323123, "uuid": "6f014bed-3f0c-4991-ba9e-3730e3e4d2cb", "value": 441122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633323123, "uuid": "55bdb68b-0b9e-4726-93d2-588a23697510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323123, "uuid": "4ce30d24-fe26-4cce-b596-bf7ffffdb147", "value": "Mikbin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23539b6a-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633338722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338722, "uuid": "42aa47c7-482c-4495-b1b7-5f8c758ed231", "comment": "Malware payload (AgentTesla)", "value": "5118e4b5749490e54108803e657aad48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338722, "uuid": "eac70c50-857b-4a4d-b635-6e95a7c82703", "comment": "Malware payload (AgentTesla)", "value": "6df45fadacc532c0410829bd06cf0bf8bedd671297a55b3ea47236ef13c95b33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338722, "uuid": "948dec46-f363-43d5-b59b-8024d8353a46", "comment": "Malware payload (AgentTesla)", "value": "bc2366493f20dd849d402a33b83ce6390c380f68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338722, "uuid": "158fd614-2b52-4b7c-9ed4-94b3623deab1", "comment": "Malware payload (AgentTesla)", "value": "f168d3926925360a83bbdef59ba8201ff3a82ac0387ce4f4325baef7c69e921563ba0ff2e1822b0b9210076e2d467710", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338722, "uuid": "5d34abb7-6eef-4cd5-986a-1db51d17364a", "value": "T13164122772DB4F97F3F25EF00C996264B4A2EFC643C99B16858175181A7030DCDEE26A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338722, "uuid": "01daeeeb-d4da-4237-af1f-332e9fbfbdf5", "value": "6144:/tGYlyeclgrQ2PDwlfDgcOvQ0B7bbKQf2lncsYQ386NY7:lblyrl2nPcl+v97Ciqm/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338722, "uuid": "a6ea1ca2-3fe5-41f8-9ad1-da48308184c6", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338722, "uuid": "99343b5a-c5ea-4f60-9639-c78fc5a9e17f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338722, "uuid": "ebe96874-cf91-41fb-be18-0dc0dbfcdd8e", "value": "PRESUPUESTO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd473e6-24d3-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633325318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325318, "uuid": "1865dbef-34cf-4d7a-81ce-7f327f1a80c4", "comment": "Malware payload (ArkeiStealer)", "value": "2ba4c00c7d648e0fbda6a337f0ac4207", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325318, "uuid": "8556a216-68d8-4928-ba34-9076a3c98111", "comment": "Malware payload (ArkeiStealer)", "value": "6e92fd899d267ad5afe11d7dc817fb3db47b5518ee060dc336130eb40e2ebddb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325318, "uuid": "f53adb44-db82-4ff6-8d63-4b8f0ab50e43", "comment": "Malware payload (ArkeiStealer)", "value": "5e2e8155017152c31369008dd39a27e330ce3a63", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325318, "uuid": "05a5e81d-d0d1-437f-b6bc-a37eb6256255", "comment": "Malware payload (ArkeiStealer)", "value": "d5290f73fd60a75f4f681f635ef30fce7b9e19d60d9f057e01c0c456f3ca187273561302d9bdf51fccc8ee80f092a077", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325318, "uuid": "e4ccfcc4-b675-4edf-a5b0-dd9bab5feca3", "value": "T1DAF4014A38C6F7F2E6F20371BB16C3F44A2CB859591A524F639B275E5E3C3C25A25312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325318, "uuid": "c8307adb-1cb5-4656-8e55-9d58503e9a70", "value": "d33805713bf84c5172011e6ee58dcc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325318, "uuid": "fd4d5d3f-d1d1-4edb-bdb1-07af5b549361", "value": "12288:dUYN+OMbL0j7RR41iqN19lDzrJG6PTi9nQOrzFEBvo2zxp6L:dUfnbL041iqNjlDXVG9nnfP636L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633325318, "uuid": "80ad083a-44da-40eb-8ae7-8756a1e4fea1", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633325318, "uuid": "209a1426-f307-423c-a3e9-4b3c9a3eb427", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325318, "uuid": "156aaf01-34a3-4252-b1dd-fbb8a5e3d312", "value": "2ba4c00c7d648e0fbda6a337f0ac4207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c896b8fe-2517-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354462, "uuid": "1104ce7e-5256-4654-963d-412b8d52c34b", "comment": "Malware payload (AgentTesla)", "value": "882a896400e98b35d36ac7c5c9bdd41a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354462, "uuid": "1624947a-6acc-4f2f-88aa-5a1b43ff8d97", "comment": "Malware payload (AgentTesla)", "value": "6ebe03dc60018f5d7ca43f37744754c905a5b3102fddd1aa41326423c5e8c383", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354462, "uuid": "c2d9bd30-95e0-4096-b09c-3d8b0125014c", "comment": "Malware payload (AgentTesla)", "value": "12a18fe75fc841c2274cff146f4bf4f2ae70aa1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354462, "uuid": "fe88d86c-1ab0-4694-8b29-d9f55d7a8614", "comment": "Malware payload (AgentTesla)", "value": "d7924486551f4f821686fc2534a8364acfa44b7352f0379fe830477b2cba9509465d373d8786b46c15ad767bfe1a8429", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354462, "uuid": "cb9d920d-542c-456b-bb0a-7a665917db8e", "value": "T1E2B4C0243AEA9019F173BFB98ED574558B6EFE233703D41A2095338A4633B82DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354462, "uuid": "888aa4b3-72c3-4ea4-9c64-0cb54255faf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354462, "uuid": "e27b5150-0788-4b47-8f46-73ab115904c7", "value": "12288:K6WHCM2K4ChJ17P//Twny7Wz/4ECeI9zgbQnRQm:KW3CZ/VrVibQKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354462, "uuid": "4a9f504b-1100-43e2-9e57-843ca82693df", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354462, "uuid": "f378ea87-4f28-44c4-ae76-4aaba3db88f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354462, "uuid": "067ec9d3-a37d-4959-a802-06f1f489eb9a", "value": "dhl scan010_yasa uygulama belgesini ihra\u00e7 et formu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eded8c2c-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633342069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342069, "uuid": "ef1d69c1-e876-425f-a3ef-2af2f3fb810f", "comment": "Malware payload (Gafgyt)", "value": "dc2ad88eb6c9ad0e5a9bc80c5a17174c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342069, "uuid": "99144ca5-0a97-4c46-bbee-d465e82b1bc7", "comment": "Malware payload (Gafgyt)", "value": "6ecd1088946f1c2f559e9791a188d89f4a829c516013cb1cfddfad32d9ea303c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342069, "uuid": "50669a5a-0401-418b-9d00-4e8eaab06bd6", "comment": "Malware payload (Gafgyt)", "value": "bd80216742fc6b16a62898753a8a7de878da9fd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342069, "uuid": "825fd23d-b12f-4567-b22c-aca7fbd20440", "comment": "Malware payload (Gafgyt)", "value": "623975eb574c42bda2122757c4d231694ce9469734a53a215e9d5f81ff67e09ca2ff733d20450cdae1f9a44000c09b01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342069, "uuid": "d2f59710-0d3d-4161-a2f3-e30cad42bdcc", "value": "T1BF836B25BC7A2E27C0E4A17E02B78325B2E5274D24B8C71DBD760F4EFF186902467976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342069, "uuid": "39537341-9eda-4e3e-8d4a-bf91b2b1a4f1", "value": "1536:t89ZMpScaiLxrs0MiJpJvwHq0Zs9X/jFEwnwokJEbD:syQqWmYHk9X/Btrkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342069, "uuid": "7df51f66-1bc8-47dc-8cac-10722f8441a4", "value": 85776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342069, "uuid": "92846121-05f4-4f68-b914-890c5230c78f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342069, "uuid": "7cc4d71c-049b-479f-ac1d-f205b0859925", "value": "dc2ad88eb6c9ad0e5a9bc80c5a17174c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8792b9-24ad-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633308809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308809, "uuid": "9951cacc-44d3-44d8-b1f8-37f2c8e030a6", "comment": "Malware payload (Gafgyt)", "value": "a671f306acc0a9ddd8d4a54970f535c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308809, "uuid": "d71bce27-6410-42a0-829e-29f5c58649a1", "comment": "Malware payload (Gafgyt)", "value": "6f241b40dee308b7ea8b9c0ace9e979464a6d51cddec03014ef8ae01cacfd792", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308809, "uuid": "6455eb8b-5848-4a44-97ae-a36cb5aeb98d", "comment": "Malware payload (Gafgyt)", "value": "abacd60265249cc31bb98c6fda888d9c6889b907", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308809, "uuid": "6451593d-0961-4298-9ffb-89efc0be7594", "comment": "Malware payload (Gafgyt)", "value": "75e9513553921af8944ddd1c4b4757a8cc8dd146f2e470119a02ccfa2af0eb5627ba12a21d50522dfadc1f37869801cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308809, "uuid": "19c1f7ec-97b5-4c95-a97b-9cb370b88e73", "value": "T18CC3F730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308809, "uuid": "5c26b245-4a34-44d6-9a36-d9e5a0c21172", "value": "3072:AjDaHq6NZjt/PMKZMbGwUniDm7/L7QsvmGngiNb:OW1ZjNjZMbnRm7/L7QsvmGngiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308809, "uuid": "7bd3404d-bc6b-4bbb-8619-e3e60f924d90", "value": 125007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308809, "uuid": "3d196b00-dee9-42ba-86e9-86c908857e68", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308809, "uuid": "ebaa649c-17f2-496a-a621-817c274fdfbd", "value": "a671f306acc0a9ddd8d4a54970f535c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dd63f0-24fc-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633342718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342718, "uuid": "78e2b318-87df-43a5-8b1d-cad33dd640b8", "comment": "Malware payload (RemcosRAT)", "value": "f6cb0491f71c8470bf6012a36a7fb4ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342718, "uuid": "ca6c40b1-9df3-40f5-9f44-3931cfd17648", "comment": "Malware payload (RemcosRAT)", "value": "6f476c63a6d699d1f0166313deb1e0f623c689882de8411bcd4f0b4f880526dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342718, "uuid": "f78dbc5b-2a19-47f1-aa2f-472b18502bf3", "comment": "Malware payload (RemcosRAT)", "value": "ecb9b1f54d73a0ae7d312cf5e51714a871d0ddde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342718, "uuid": "f9bddf11-43f6-445c-96e6-e323169e8194", "comment": "Malware payload (RemcosRAT)", "value": "52a53dde1a8d42e610f652db682bd13767bc969746d8169f4a2bcb28e7ec09b8467f03fb38a358c29c8dcaf2ba120b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342718, "uuid": "ff6db789-4e03-4cd7-a155-47f3b09ef130", "value": "T174C3BE80FC757C27D199853C6433E284A2F9BC43E5119BBB752DBBD81E7438C642A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342718, "uuid": "6d415d92-fb2b-4b59-b889-c6466031dc19", "value": "3c727df5dd5653a8cd06df0c3a130336", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342718, "uuid": "74f4bd41-e33f-42fd-8915-a204e54a9bfb", "value": "1536:qMPWczFRB6REkV4Y1M7wrZzj5hsRUe9CdmGKtWWcHvZx0FpSvZpD7o4VOSD:xWcznaEG4YuIZfIUeomGDhHR2ncIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342718, "uuid": "3724e77e-0f39-4a8a-b49d-766d7204c35e", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342718, "uuid": "06c435f0-3abc-44d2-9f0e-dcaf9c3b16d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342718, "uuid": "e892b5b7-f12a-4f59-9b2d-4df494efb060", "value": "f6cb0491f71c8470bf6012a36a7fb4ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e86fd7f-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633354713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354713, "uuid": "97a57ec8-0b20-4239-a28f-3cfc6128f1fa", "comment": "Malware payload (SnakeKeylogger)", "value": "ddf050af2bbaaceb9ab27facc2240dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354713, "uuid": "77386448-1d22-4d8d-b6ab-69179b1e6459", "comment": "Malware payload (SnakeKeylogger)", "value": "7028532110df76fd267d80153b26e0f5bc23660da571fed3a384e662c3892f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354713, "uuid": "3a8189c0-b812-4a86-ab3b-00c892e8a092", "comment": "Malware payload (SnakeKeylogger)", "value": "1193d161fd69393508f4a4ff244e98278381ae71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354713, "uuid": "022d07fc-37c9-4675-aa96-e091101364b2", "comment": "Malware payload (SnakeKeylogger)", "value": "37a0c39557026a1a35f628d377c1589d03f5a240dde50e908fb43fbd9eee56e8f3b0c40916aedd75f69794ba1765c9ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354713, "uuid": "c7ab66f7-9917-403a-8565-11c082c5dc85", "value": "T1F082B22633D4C4D8E5D489348CD7AE7009F1BD339411B6AE37D03B2EAE33E86D255696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354713, "uuid": "31b4dbf3-b3c7-4364-b3b8-d4d5f5f2d09d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354713, "uuid": "75c420fa-2da0-4095-8ad4-d1d35a9c1a1e", "value": "384:4K9UXI4X3VgI0ZM5KamFKDQCkEKDVbJEp5KDGPGAnZf:4KmA4K7p9mPGKZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354713, "uuid": "9ecad532-f09a-4ed2-bb5f-8edec99e1ee9", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354713, "uuid": "4ddb5b7d-6d83-46d4-b3bc-d630be181f88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354713, "uuid": "da3baaa9-105d-447b-a449-de758225bd15", "value": "Price & Delivery Schedule_N2 Package.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031854c6-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633338668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338668, "uuid": "946d5b57-8fd0-4038-806c-efca6ff0cf69", "comment": "Malware payload (AgentTesla)", "value": "1ddea0ad65f19a92e261217a5c1f0045", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338668, "uuid": "182d8b6e-99f8-4f3a-bb7a-507ef5ad02a7", "comment": "Malware payload (AgentTesla)", "value": "70777b1febe905c8c4d158e14afc381d8665bc94f39f04da2cecf1c3f9ecf4f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338668, "uuid": "54f6f51a-540a-4f59-bd4d-f8169dd4adec", "comment": "Malware payload (AgentTesla)", "value": "b524a5334b9ac922c1ad0075667200780174940d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338668, "uuid": "e9eb3b4e-def0-4ec8-b48e-7670a7eaa782", "comment": "Malware payload (AgentTesla)", "value": "4cc9854c8c0d2288b68535ba646696e3c3b8637bdd549f6f2d22cbeb383c636ddfc294af8dbd7c4beaa249c929a9491c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338668, "uuid": "3307a3fc-e325-4ece-897f-b84d6a00424a", "value": "T13164239EB7BC761FF0021ABC7F25D1ED0A1BEC879A65A14812C0387C51F8D5805A9DEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338668, "uuid": "d56b0de9-6c70-47c2-8373-7fbe2fcdf3f2", "value": "6144:q9iJ0AIcnR55kJ+pQ+Q/kxs3FU7GQ/G59gwum1qkuI/EDVG8meDt:MQ0AIOb/2cxscG/TvTriG/eDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338668, "uuid": "05da8d03-5847-48ad-b999-f072f44e840c", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338668, "uuid": "9eecf3a0-3968-4040-ba2d-759b666a7014", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338668, "uuid": "190cd31a-50d8-4407-8f1a-f5d462fae96a", "value": "Doc-909486.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee3386a-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633353237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353237, "uuid": "b3567bbf-716b-4c68-af7a-bd35ea885287", "comment": "Malware payload (AgentTesla)", "value": "c662c3bf5aca5c98d8f90c83f4c07536", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353237, "uuid": "8c26b50d-13d4-42fa-b106-b49571c1c48c", "comment": "Malware payload (AgentTesla)", "value": "7291a88932a85bc5434e0688073e138d98ba4b0641d6b068acef59e1269ca116", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353237, "uuid": "2c443ac3-fcbb-447b-ba57-3da941764430", "comment": "Malware payload (AgentTesla)", "value": "bcf7ff92d1af04b64c6afe8892f7910f5849cbdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353237, "uuid": "7bfbd061-d08e-43b5-bea9-08f18ee72bbf", "comment": "Malware payload (AgentTesla)", "value": "f3ea63f5bf148360ac032c98e9893c7018e9d8e4b07df9e1214049b2fba8ab0069267b2327568b4f9ef709946d9ec036", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353237, "uuid": "2ebb2a3d-9565-4b7b-a7a1-2814510cf413", "value": "T1C135CC294D2682F7C7EEC62CD09C0FCEEB62A4837B918F1ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353237, "uuid": "432c6fc3-18bd-48d3-8256-b30fc786bfb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353237, "uuid": "8ceb1c29-367f-40d4-8285-afb9968a87ec", "value": "12288:dRNHT+Hdh4N3Qt/RdRxqminiqOzsHD4wezxf7ltKMcvZ:dRNz+Hdh4N6/rlfzsUwe5lEMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353237, "uuid": "da5688b4-be58-403c-89d8-565e12a0f2e5", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353237, "uuid": "295d2437-a7f7-4df7-a317-487b5b5506fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353237, "uuid": "755de762-4756-4fde-a52c-9e3754929911", "value": "Payment Slip_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f58532-24de-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633329731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329731, "uuid": "ea375b63-c5eb-4cbf-8aa6-7ba3e51f1711", "comment": "Malware payload (AveMariaRAT)", "value": "1afbf93739476cf388297983f1c4f32a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329731, "uuid": "3729fbf9-e7e2-4c92-a3fa-015273abb30e", "comment": "Malware payload (AveMariaRAT)", "value": "730419e98bfe7df620914152b813c784f9c3645794aa19e6160dd258f8422025", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329731, "uuid": "efd5ee9b-8113-476c-b8bc-28316704851f", "comment": "Malware payload (AveMariaRAT)", "value": "133f3ad67f07793e2a8dda6fc200b59e20b9cddf", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329731, "uuid": "4972669f-4b2d-4d32-b363-db8aa5f80e51", "comment": "Malware payload (AveMariaRAT)", "value": "a51f1d83dcc81457fa0e78e19abd039f27c98caed1478ffbfe899a8fcc695e7369a5cf6525e9b01e34b2dba4a2a942fe", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329731, "uuid": "55b22b55-534d-43c1-b7f8-fb9d55ada51f", "value": "T1A785AA394D2682F7C7EEC63CD08C0BCEDAA6A8877B918F1AD495D7C6025770BE48855C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329731, "uuid": "3d0272f6-4cce-4e58-8e79-6438ecb3e423", "value": "6144:txd05BAl92z8P2GhNRavMIuLAhwQI9To0TM4pONBMbvoyA4KhD3Njzx6D:tx+c5P2iNS9ZPysBMcz3Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633329731, "uuid": "1ab6dbf8-89d8-435b-8f83-9e04261ff528", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633329731, "uuid": "c872b83a-e815-459f-9e52-9ff3994524f6", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329731, "uuid": "58fd0da5-515d-4cfc-8c32-58079a96d410", "value": "DOC7790.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a627ef4-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633341714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341714, "uuid": "5d027a4b-7046-426e-9183-522ee4a96f61", "comment": "Malware payload (Gafgyt)", "value": "cd6bc2a0ba599c8d932d80e940853cc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341714, "uuid": "1472717e-98fe-4bab-b88e-3eb1cebe7ff4", "comment": "Malware payload (Gafgyt)", "value": "7341b63b2930c33bc16f7e6f34d71d0f52e3ef7cb0b9a967beba5ed0212cd61e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341714, "uuid": "1a704058-6917-438d-8101-fc4f09e35245", "comment": "Malware payload (Gafgyt)", "value": "f7d5451ae1642a7f99654fda0967773f70ce7062", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341714, "uuid": "0c47fbc9-a362-484a-b132-439f59b4d803", "comment": "Malware payload (Gafgyt)", "value": "2381750ca96908ecc02a3ab4a30760676aade30e5f887d3723c5c0458d74eb3197a722ce5ddc6bd48324faa75f1b5a98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341714, "uuid": "3ce65ad3-0cab-4daa-80db-b521b881f15f", "value": "T1CA834CD5B8014D7CFD5BD6B981324B09F92173009FA30F2BA6ABFCA76C331999E06945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341714, "uuid": "666194c1-96af-4b0c-8824-a3c1b05cba68", "value": "1536:w0TY9J0qBSn1c57gjYcMWykPkOg9+Je5Q6XQVMH6hzFOZFfXtGn8JM/u:wMbn1c5Mj1Mlk/g8OOeakXM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341714, "uuid": "86e32d66-111b-47ca-9484-80c5fccd631d", "value": 83276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341714, "uuid": "3728ef39-083b-457b-b032-7552dd279b73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341714, "uuid": "d798c6fe-3550-419b-b996-a960c93aa480", "value": "cd6bc2a0ba599c8d932d80e940853cc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715d832d-253c-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1633370207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633370207, "uuid": "613e4999-6d7a-4ca4-93a3-6624de271919", "comment": "Malware payload (AZORult)", "value": "b8375b25960a45d8f241f8f9cca25596", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633370207, "uuid": "b56bbde4-a229-42ab-8c52-e0fdb6666ce1", "comment": "Malware payload (AZORult)", "value": "735d4133a6cafafb214a0a9e566b04a0b5c06a28ad2887c9856230c938b65f86", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633370207, "uuid": "ffeae978-dff0-4831-82a8-cfb220fb218f", "comment": "Malware payload (AZORult)", "value": "9056e7f4d0b3f6b4f4ca9dbaa654d27a8b443fd4", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633370207, "uuid": "bc31287b-de9f-4093-a484-88f613cd87aa", "comment": "Malware payload (AZORult)", "value": "f63b52874f072daac61e4de1aa7efd0926e9bc7cfd693850d92d863cc2a003c1811459646996648ef99ceed0ac6d1eb0", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633370207, "uuid": "48703da1-783f-4665-ae3d-540b3dc756b1", "value": "T1C9B3197AF6C19272E02808BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E1C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633370207, "uuid": "4160b710-7089-4d55-9958-2eed524a7c1f", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633370207, "uuid": "3aa20d50-366f-4d9a-b67a-9cc4c6ab3f30", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/ixg/:Zzx7ZApszolIo7lf/ipT/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633370207, "uuid": "2fbbafd5-4db9-495d-92bf-2119180ced78", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633370207, "uuid": "34ea0b4b-bdf7-43e5-81b1-609ffa1c531e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633370207, "uuid": "e2dc1fc4-3167-47a0-8bc7-01174f71d075", "value": "b8375b25960a45d8f241f8f9cca25596.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5c4760-251b-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1633356214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356214, "uuid": "c604bacd-36ec-47f1-8e61-66790343f635", "comment": "Malware payload (QuasarRAT)", "value": "8891fee231a2c148515252d04f196006", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356214, "uuid": "ef085e97-54e9-4d98-801b-8e9dfd505c05", "comment": "Malware payload (QuasarRAT)", "value": "73b4cacd6312608c4d24f0aa9995a7e7bbb4d8d233eb6b424ea7e2831181bdb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356214, "uuid": "5f8ac657-b182-444d-94bb-20d10beca3e5", "comment": "Malware payload (QuasarRAT)", "value": "81b706318ddc8b617014d74a29fc8e024249893b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356214, "uuid": "89354cbc-ea3d-4109-9b06-5b471f020e68", "comment": "Malware payload (QuasarRAT)", "value": "780a0c75233d91daadc98c70392e3977c61091afbe12dd3dc623dc0d2a83a5bd1422edd8cd89f0d0961117819f289663", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356214, "uuid": "1b587376-87bc-4387-b0af-c8bd818ab006", "value": "T1A035293E55582848F36640BDB9B18CFF0765BC1F406778B7A44CF88B19B77C26612B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356214, "uuid": "715cd826-886f-47f6-90e6-32b105bed248", "value": "835f485ca718411734d873f35af1695e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356214, "uuid": "61fb3aa3-9750-49c2-9d77-55d2b421b0d1", "value": "12288:/h7l38OKJBWkzfwS/M+2GtL9pEXBiXfHSeai10566f3kwc2FLL5W7:p58OgB5Ux89pEAHM66f0H2FJW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633356214, "uuid": "643f76ac-e905-4267-bb4d-c45020ad4434", "value": 1144232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633356214, "uuid": "4327874b-412e-4fce-8c21-b06c462f017a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356214, "uuid": "b2e7ff74-350b-494c-b0f4-70c4ec6502ce", "value": "8891fee231a2c148515252d04f196006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ccf6c3-2501-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633345015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345015, "uuid": "eae6140c-29b4-4f10-be87-5a441134b56c", "comment": "Malware payload", "value": "4609172d3aeb3dd270cc9afbeff2940c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345015, "uuid": "8f66a31e-d4fa-4a52-88d7-cc89047558cc", "comment": "Malware payload", "value": "73c19a778500c6fb04f60d60527ea76a870590ed9e0f6014cb03419d02ff0457", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345015, "uuid": "7b2ee31c-979f-46ce-9ff6-d16a621e128e", "comment": "Malware payload", "value": "cbb8e106862623cedb664b0d7ed7b44b283563cd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345015, "uuid": "7672f123-77d2-4b25-927b-188843d3e124", "comment": "Malware payload", "value": "d86324006224f64d4f8cef43155f02cec060ab1ecd4865173eb6da1380d84cf5d182fa6fff7f621ed837e74e9291fcd6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345015, "uuid": "ddc69530-33dc-4a9a-9472-c014ef1ec5f7", "value": "T1F495F180F758A42FC47780330AB6077A22169D4ECA96C75746B5B31C6DBBAC14FA9FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345015, "uuid": "c17ea03e-0071-4e17-9c59-9491d1a4002f", "value": "49152:JQpffMUqlGuZfvmnf6bkLx/BCJJcNZE+b2MufaHEUBrgee:JQpfMbGuVmnfD6rcVat8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345015, "uuid": "ff791ebc-a6bf-4fdf-a874-290c0b8710fc", "value": 2012946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345015, "uuid": "746acfd9-8a33-447c-a184-e3d8718e1aa9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345015, "uuid": "b9079442-59ea-49c1-b411-3ea5c94cf180", "value": "NTTsecurity.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf93d99e-2536-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633367761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367761, "uuid": "98659910-5588-4930-903c-a7499eb1fb1b", "comment": "Malware payload (RaccoonStealer)", "value": "a6430897a63ebda6908bef00def1058f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367761, "uuid": "e21c3f81-904f-4084-a264-8ada925b3639", "comment": "Malware payload (RaccoonStealer)", "value": "73f2d6971fac776780e59a33b3f3e4771527c250eaceb3040af59129829ab5e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367761, "uuid": "a3cdcb90-3e86-492a-ba53-fda18270755f", "comment": "Malware payload (RaccoonStealer)", "value": "53c444955221a5c741be7a560461828541b35669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367761, "uuid": "1e9f303f-81e2-428f-a5f0-a566c560bf3b", "comment": "Malware payload (RaccoonStealer)", "value": "2f764810482c314d387cce7b34a589affd16ebdda6bbed3c629824b153bc8f622706d010699acbd7f741739d0637f58f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367761, "uuid": "8b2202d9-88a9-41a4-ab9d-f109f8278c20", "value": "T1BC449E09B1C2D7F2E2B60570A7A6C7F049AEFC6D4E65524F2794272E2F383D19621363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367761, "uuid": "d1dda5ff-4f9c-492d-b494-d8c8372a2e38", "value": "820638e32882fc55584544cedf889893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367761, "uuid": "9903a7a3-a451-41fc-a228-44d3954c6780", "value": "6144:le/1NAxbFxhNP8P2yUUROhxxpeTr/ekIw:a1No//xzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633367761, "uuid": "fc6630a3-447b-4f5d-ae16-b4f0229ccee4", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633367761, "uuid": "ff00f9df-5d14-4353-9d5d-571f22285d3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367761, "uuid": "043ac281-f7c2-48cb-b9df-ab8f8234cc0f", "value": "a6430897a63ebda6908bef00def1058f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18e1193-24e8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633334210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334210, "uuid": "1168fbf9-3af9-46da-b61e-3c14186462d8", "comment": "Malware payload (AgentTesla)", "value": "6360cb9fe59b8ae041c11f651e377c1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334210, "uuid": "aab11267-e125-431f-a716-b43dfcc8839a", "comment": "Malware payload (AgentTesla)", "value": "7410ac67979b82ac850d90f1e3a66494c958952c54fcd1035f78f3b84ed4d7b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334210, "uuid": "39fbbce0-57d2-4310-87d2-321412d4378e", "comment": "Malware payload (AgentTesla)", "value": "b89170abea3e65a825aecd679e047d4839654fca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334210, "uuid": "cc757e2f-c6b9-4ceb-9e6f-40d6cd24a7e0", "comment": "Malware payload (AgentTesla)", "value": "e1cacdc17bfdc9cd002cbc0737d4abdbfed8b620442d47f46bee33e94f39b6206d49c297c7175a31c970941313ab65dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334210, "uuid": "80da21f0-966e-42ec-afd4-a67946a0a5fb", "value": "T149D4F19C33AB8610FDBE47F9787450904BB2B8126416D33C5E8464ED1DB3BE48AD9B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334210, "uuid": "39a175fe-dd4d-48df-a81b-04bc4a2a3861", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334210, "uuid": "75a5c787-f5dc-4b5f-899d-2f46922c0bc7", "value": "12288:TZoeeR5lI2CC2l/ADeW4MbI2qfbEIg7JT6YashlM0JT6YashlM:1JeXG2CLYDe202MbEIg19ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633334210, "uuid": "437af3a3-3f19-46a6-a989-d9bc67128ade", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633334210, "uuid": "e1c49806-80ad-4fce-b5a1-0e039ef8136e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334210, "uuid": "810466d1-8a57-4a3a-941a-b6b1000395f2", "value": "VIiA31jPUBotFdM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c222372a-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633354880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354880, "uuid": "29833307-655f-42a9-adfb-7eb6f7901678", "comment": "Malware payload (RemcosRAT)", "value": "c1ff928c1b7354c05f601174d116d286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354880, "uuid": "d34150f7-c307-4265-8fc5-6cd88aeaa5d8", "comment": "Malware payload (RemcosRAT)", "value": "74e993c4fb12fd900b34e98beb526946ec83ca7bec8a39b7d7fc97c9ccf9c752", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354880, "uuid": "bd937176-1537-40b4-8e6a-6b98383722b7", "comment": "Malware payload (RemcosRAT)", "value": "7ff9c2e49b0e2e31271ca8e31d220d89c897f554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354880, "uuid": "eb579f86-c082-477e-b0c1-b4c2668ff9bb", "comment": "Malware payload (RemcosRAT)", "value": "6969dd5e2ca531669753762465fd52af137b831c181a4ba8425d0617109c022dca30b00e9cd950cb690c5009336ea522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354880, "uuid": "90be2804-3bf0-4e1b-bc31-e283260cc621", "value": "T1BC058E91A293C972F82E1A3D8CCA76549529FD903FD89C669BF4EE791F342903D1804F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354880, "uuid": "22b5900a-76be-45ca-b09c-3734f455427e", "value": "459f402db2809e477a1dda0946703c4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354880, "uuid": "690712df-7bd7-4d31-b47d-d234b017480a", "value": "24576:+0KXbYUlmM/OwPVPZzKHrCHW2h8DAaTY2kjpPPobRf+0awpxh9aWRZEfhqdrpXem:+ZmMjxVW2h8DAaTY2kjpPPobRf+0awpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354880, "uuid": "f45c8810-0279-444d-9c85-b12d299f9f48", "value": 807352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354880, "uuid": "4f50b94b-5a11-41a6-a29f-40d79992b313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354880, "uuid": "32bffb95-0cd5-4656-b47d-c9357c2991ef", "value": "ORIGINAL-JSGT21101098-4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d32b940-24d0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633323895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323895, "uuid": "76a4a22e-af6d-4343-9536-6815f9086e60", "comment": "Malware payload (AgentTesla)", "value": "6b919ecc16f15b301f83fafe705187a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323895, "uuid": "fdd0d40f-71d6-444e-8fdd-7c303a371052", "comment": "Malware payload (AgentTesla)", "value": "755f9880585db4240c8f03cbbc99cbf6c174e33a62ed3130488633ea232c8924", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323895, "uuid": "5f11dc58-c205-49cc-af24-0e3424c44c7f", "comment": "Malware payload (AgentTesla)", "value": "ae1596e395904698c071bf20c34f5a945be84557", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633323895, "uuid": "8ebbc031-1c2b-43a5-9b1b-cb6823c77722", "comment": "Malware payload (AgentTesla)", "value": "3d39cb6e9d44ca4d6b7a497779fe9d20902f6a0c31aace48db667f351cebc4a3511e87e97dd09f2239ac437934e3e485", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323895, "uuid": "a903883c-68df-4d10-a9fa-09428df0dd88", "value": "T14135D75113EE99C3F03A1338B0121DE7AEB97E3DE276CA0C59A639D64E75F80461EE44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323895, "uuid": "fca8a564-f9a4-4c13-ae9f-fc3c833c470d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323895, "uuid": "1a2fc0de-0133-45a8-ab10-0d1d908af29c", "value": "12288:0mBKc9Bilo3NA30RQfQ5JHhuU6wHV+fVvuLnReDG2K046Mnq0UnsO5lJkKzUvoPe:DR/M5g8Auzol3VUmSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633323895, "uuid": "11f3ccb6-5c80-4d68-8fb4-a214acd784ad", "value": 1154560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633323895, "uuid": "dd2083b6-06ee-488b-97c6-c81114ea381b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633323895, "uuid": "2444287c-cbc0-498f-b6ca-4204e4af4a18", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d685c28a-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633353197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353197, "uuid": "23e717a0-1d01-4eff-863c-a186dfa61d79", "comment": "Malware payload (GuLoader)", "value": "5eb45de9c81c5fcfa53807243708deff", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353197, "uuid": "07661a30-b668-4659-a8ef-cd68e735ccf3", "comment": "Malware payload (GuLoader)", "value": "75be4e60003f6678eed014a9e89cef038ad72c23be76e126a2fa812444308947", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353197, "uuid": "5b2b7684-69ff-4049-9af6-43ea99c8470e", "comment": "Malware payload (GuLoader)", "value": "a34b12c11219e00a042fa9d29a025a45b5a8ac70", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353197, "uuid": "40529a4b-4256-434a-be2f-8fa6026170a6", "comment": "Malware payload (GuLoader)", "value": "904c689c9809203f4d458baf55ec83e55590a2008ddc5056830ed20c14fee48d5532187d17809ae313400d8463ca5228", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353197, "uuid": "f72bf4ff-959e-4ec6-888c-6671b24a9949", "value": "T1F9B3AE23D6856A20D78BECB0352368E26343BC52E5005F5F31C9FEA86EB04DF65B574A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353197, "uuid": "0c20d6f1-c53d-4f23-8a66-60c4610010dc", "value": "a661671ef02a6d0e6a34eab52e2e0015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353197, "uuid": "b7a413d6-2580-474f-91ab-a71919c75b62", "value": "1536:URjmNsqt+deYJzdX3nMVS8siIQllGPyMaVl1iidW8UIMG127:qmNH+debVS89vlGPhaJiik8UIVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353197, "uuid": "c2f69a5b-559f-4a49-899b-80ca8b53f2a9", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353197, "uuid": "c440eccb-f9e5-48c9-91ff-a7f6a2b4eec7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353197, "uuid": "dad40b8d-6415-490d-9355-98137f59c214", "value": "justificante de la transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92998285-24df-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633330319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330319, "uuid": "73e73585-6dbb-4b70-a8c2-6e8ab486231e", "comment": "Malware payload (AgentTesla)", "value": "63d8a5137c89703ef5ca531a7499195d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330319, "uuid": "385e24dc-80a5-4f9f-a800-8bfb4e73f87d", "comment": "Malware payload (AgentTesla)", "value": "76653c52cd8f33c7b22a8fee3ffa43c05bef91c63464ce9474084459ea9dd575", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330319, "uuid": "a586ec4b-5afa-402c-9525-6392439977e1", "comment": "Malware payload (AgentTesla)", "value": "bf4cceca4de1b93b5d214fff63bfe21b602345c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330319, "uuid": "df894d80-cf9d-4e66-bfcd-81a30b75080d", "comment": "Malware payload (AgentTesla)", "value": "8d359816d8ffa184fba7321985873cf0a9bcf61b02c4376d5f4e75997a564decc1de9a394eafdd437b2eb3489e2181ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330319, "uuid": "d6a2f485-d2ca-4415-859b-a22eeda84a6a", "value": "T1C0A423506A123C05B8D5FF83F50896D36AA5224FF7290088BA0DBF4DE9B9DCDD6D2D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330319, "uuid": "7c3e3bf9-064f-45d6-af50-0a1d33da5bad", "value": "6144:xtulYL0QkHPK0L0Ti79Bm2+p4dzxEZu/I5U9GcHDmpyrWh0J41UEf:xtcQ4P0TMXmTpwtguAgRjmpy6hk41UW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633330319, "uuid": "0b7d1656-6862-4abe-a812-3c56a7d5585c", "value": 466720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633330319, "uuid": "ce76cbb2-7266-401a-ac5b-c8637b07508f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330319, "uuid": "2b9a0c95-da3a-4e24-b82e-1d77fb536113", "value": "TT SWIFT COPY FOR USD 37,000.00.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283c5dc3-24f8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633340878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340878, "uuid": "93ed3939-73ee-482c-aa2c-3e3efc520a2c", "comment": "Malware payload (AgentTesla)", "value": "8f222bc8d061cc80d9a5bd52733d3428", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340878, "uuid": "0fdba694-b916-46e7-b640-8b5d900fc894", "comment": "Malware payload (AgentTesla)", "value": "7684c99305d6886407f7c50f0d6aa584955a76b881c774bfee84cde6bf04feae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340878, "uuid": "60c5f0c2-0201-4af4-b1c5-7732f67b5ba9", "comment": "Malware payload (AgentTesla)", "value": "325ec6c59804ff32df7549496bced0bea5669334", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340878, "uuid": "c56e518d-6ac7-4d76-bbf2-bae49d04aad1", "comment": "Malware payload (AgentTesla)", "value": "517ba0465ce96eebd2aeb50bf570550cdebea77cfb6fa8c6facaf09bbfc2fde341d9029b777ec1a72698ca905631a615", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340878, "uuid": "bd0f9c40-d0f2-4eb4-a2ac-b16c407cfc7f", "value": "T1BB84B090F289D896E8431EB6487BDD3160A7BAACD474450D554E372A1BF338720AFE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340878, "uuid": "8ea36953-150c-41eb-ab29-dacb2a6fcac0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340878, "uuid": "2adb14ad-5e88-413a-85bb-39c8c37059fb", "value": "6144:18LxBOeAwuYWi3iiYf9QLitf02yTjxJZy8XihhRMMN1R8kB0GdWDEna5evSMF:LeAGWi3A/payEizeU8kBjADEnME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633340878, "uuid": "03e177f5-a932-49d4-b8ff-5c8253de6d1a", "value": 382012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633340878, "uuid": "eedbc12e-a1d5-473b-a97c-840c60d79e86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340878, "uuid": "1012425b-8c05-4298-9211-44be47b893f1", "value": "shipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eca0525-2538-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633368377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368377, "uuid": "0da1fbc1-e356-4e33-8bd7-9e0eeb508c5a", "comment": "Malware payload (RaccoonStealer)", "value": "12f3dc5821b251267e852f44e136cd99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368377, "uuid": "694a7a25-efd8-4a55-bc75-1cd649801ddc", "comment": "Malware payload (RaccoonStealer)", "value": "76a2373a534c4aaded3a7db99312c17f4873f62dd29e2daa1557d528092ef902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368377, "uuid": "b3508fe4-3de1-4bf1-8eac-8520c422457d", "comment": "Malware payload (RaccoonStealer)", "value": "362072d504a49e9fc9747644ab028b12abd36624", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368377, "uuid": "1ee40e3f-a0bb-4e9d-93b7-4c03186539a8", "comment": "Malware payload (RaccoonStealer)", "value": "d8625d2528f468dae495b658ef9d1496c6f1fe2de448ee18110cc26242dbc1ca501e488e2464f6dac9bfea3ed34336d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368377, "uuid": "b7a2bde6-8531-41ef-b182-14b53ce609ac", "value": "T136C4F10931B1D3B3E6B21571AB65CBE4753EBC6C482652CF27A42E7E6E393D19721302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368377, "uuid": "f8a45be7-a941-4429-8524-4779a71837c6", "value": "820638e32882fc55584544cedf889893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368377, "uuid": "e0c2e2f3-c055-4572-befc-4cee7ed42b1a", "value": "12288:QchpZ9vIEUUoH22j9RO/SVc+YlEKrv1KzsZqCbfzxp6L:Q4Z9AEGH22j26dyXZZ7b736L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633368377, "uuid": "30d9479d-f07c-4f5a-ac8a-57286cd9be31", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633368377, "uuid": "63a68565-7344-42ac-9e33-ba28a6c5f4ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368377, "uuid": "a777a6ac-281b-4251-a8de-8ea2b2e04dfe", "value": "12f3dc5821b251267e852f44e136cd99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f622e236-2517-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354538, "uuid": "9d25407d-748b-4328-816f-0691eec8d87b", "comment": "Malware payload (AgentTesla)", "value": "66e800ac6f85bb27cd37da24c6655123", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354538, "uuid": "0ebd9f6f-d93e-4429-8522-f3ee2218c261", "comment": "Malware payload (AgentTesla)", "value": "7763a867efe52a8933aa85a6d5627d10842c711bc027ff8e922f5edb53901520", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354538, "uuid": "2297fa6a-69b0-4dc5-a015-ab0a86ed7b65", "comment": "Malware payload (AgentTesla)", "value": "af666f7c8282a2edf2803214e63be1a99da5479f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354538, "uuid": "0b62a3b4-fa2b-458c-a743-b603854a49d2", "comment": "Malware payload (AgentTesla)", "value": "07287c7d437430f7d51a6ffe495ef5889bd28c4845c8c040c5c447a51ef8c251eb82f02af9e82093811a1c1803ad87b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354538, "uuid": "3f319b19-0c62-4680-a7ab-2420d3c24c7b", "value": "T1B2252A9053CB9EC4F07B2734B0121CE7A6FE660DE379CB1569963AC78DB6B40461DB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354538, "uuid": "055d9260-0189-4783-8dfb-6cb14b41a763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354538, "uuid": "ee89469e-9ade-41b5-8e87-71a61ea07da1", "value": "12288:fmBKc9Bilo3NA30RQfQ5JHhuU6wHV+fVvuLD/ya2K046Mnq0UnsO5lJkKzUvoPUj:YkqaCt7K3Ut097Ii3CPsIQfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354538, "uuid": "61c3d764-2444-42ed-8942-5bc2014a667e", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354538, "uuid": "cec27b5c-f388-4cb9-8d50-b9aa0019a164", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354538, "uuid": "edf11d34-38a2-462f-b3a0-b257b00ed6f0", "value": "AWB & Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13a98b7-2510-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633351470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351470, "uuid": "19976894-11af-4a78-b489-3e16f9f10067", "comment": "Malware payload (Loki)", "value": "cb1aa8895db7b5598823e583102f9fc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351470, "uuid": "e1d768c6-be23-4f2e-a5f3-c39651cc1368", "comment": "Malware payload (Loki)", "value": "7986de346479a9d3203949e22f990d9e8fadf86b7cdcf573ff9a2da2d7d9867c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351470, "uuid": "ff1cb035-b58e-4d67-b840-45789775ce3e", "comment": "Malware payload (Loki)", "value": "deb295c1985b41b581ffa83b738cb1393d9d29b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351470, "uuid": "949bbab4-7e93-4108-b2ed-31932647ad70", "comment": "Malware payload (Loki)", "value": "a4a085634811ae860550b5cca4f69975d3b20a40aa871556e0cb1a23189b0aa375c2761b9ac9e830e0164a7f9831c975", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351470, "uuid": "1e0fd435-71ad-4b15-bfed-3fe0c560b38d", "value": "T19954BE183080D7F2D6B60530ABE6CBF4592EBC6D4A66568F2BD4371E1F393E1B625302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351470, "uuid": "87d114b6-e833-4cdf-a4ca-7d892f327761", "value": "00e4a9909e1dd2f9b23ab751bea778c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351470, "uuid": "df46d36d-8999-4be5-8ce5-3134c39fe2fd", "value": "6144:KQx21wWMsvXOWHDNVHz5buM7+ROhxxpeTr/ekI:D21wWMs2YjFuKrzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633351470, "uuid": "73097344-e35f-47fe-aaa5-e2c849864fd5", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633351470, "uuid": "8d420144-6f1f-475c-8975-522270d33929", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351470, "uuid": "84716a6f-4e49-4107-91d6-6766390d1468", "value": "cb1aa8895db7b5598823e583102f9fc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146142e5-24f5-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633339556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339556, "uuid": "60a811c8-e15c-436f-b77a-0914d13c40f0", "comment": "Malware payload (RemcosRAT)", "value": "74e043e3597365ae5b27f6b40fe1fcd9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339556, "uuid": "2c8b669e-8c2a-4fa0-b3ca-aad763c14758", "comment": "Malware payload (RemcosRAT)", "value": "7a30ee147983ae5664dab25082f5973b2ca00d35e770b5182ed4517ffb91f5ab", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339556, "uuid": "bdaa6dc2-e2a7-41ac-b0cd-6ada66c255c5", "comment": "Malware payload (RemcosRAT)", "value": "3b8b4c90ebb1a6f32c2e0e7cd992f368489b8b20", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339556, "uuid": "62a13848-9f73-441b-8f3f-ccff44b0ebfd", "comment": "Malware payload (RemcosRAT)", "value": "2cee4e1bbab47e108c91b8a0df868ad8105cfd110dc8dd78ee54e2b9c64731ee7fe76c7581aed73ae45bb7da32943180", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339556, "uuid": "1f557e74-13c4-4f21-8034-cfcc36d6879a", "value": "T1E505079291109369F02B3775F847550497DAA87D1E202B36F6442BC70B2F3EAADD293F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339556, "uuid": "3fd58eb7-8b4e-42b3-95ef-76d6df049cdd", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339556, "uuid": "d5f7d230-5dae-46a5-a28c-e116efa2ebbc", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyNuYAycjL7YiEFXXXB:Naeq3gF1Sf+WIyRAyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339556, "uuid": "eca8445e-5412-4f51-a278-f53c9c0a500c", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339556, "uuid": "0a211b7a-94b8-43a0-92a3-3b658ccef7ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339556, "uuid": "91df4fe7-c55a-4ff2-ac08-a2f8d6b5f401", "value": "Dhl Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f2a4f0-2527-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633361244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361244, "uuid": "e1f9b8d8-a1a2-40d9-ad00-8ef7dc992b5b", "comment": "Malware payload (Mirai)", "value": "5e1eb981009c6c7f386a392519a0d6e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361244, "uuid": "a036c295-ab92-4b97-a026-5132fd3abff0", "comment": "Malware payload (Mirai)", "value": "7a4a5d7d34ff48d484c8d9b6f97268dc1b12e873f1e08a733bb11a10cba888ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361244, "uuid": "0602d32d-517c-4769-8891-ec177dba8b1d", "comment": "Malware payload (Mirai)", "value": "ce31fe85bf453281e021d4e70215707de7c5f6a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361244, "uuid": "aae6b7f5-0e52-48d5-89ef-a84607267294", "comment": "Malware payload (Mirai)", "value": "6ae1c717c084a477081548ba844d41179ff8dd7283d47584f0e7616dbc472f33e784e4b37227a9cd9c50c544bbfdcf1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361244, "uuid": "f2714092-0b58-4c65-8d8c-f5df842db193", "value": "T1E4331981BC919A12CAC423B7F62E01CE372563A9E2DF7207DE216F1137CA92F0D67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361244, "uuid": "1d935975-f70d-4e1e-8bf9-6d66c4ce3b4b", "value": "768:a8YhuGUGrNMi4fnhSei7zpneelg6SdkwHUoOjqBNOS935cU1MV:mhuGUGeiInhSeinvHS6wHt9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633361244, "uuid": "d3ad6d50-9e89-4e70-833d-e46b033f4679", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633361244, "uuid": "75afadf8-9070-4617-b1dc-887f514e8970", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361244, "uuid": "6d04fc60-f8a4-4bfd-8dbb-0599078583cd", "value": "5e1eb981009c6c7f386a392519a0d6e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db221486-2560-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633385846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633385846, "uuid": "414207c2-1bea-48ba-963f-0e78b2d3b540", "comment": "Malware payload", "value": "81f01a9c29bae0cfa1ab015738adc5cc", "object_relation": "md5", "Tag": [ { "name": "Atom Silo", "colour": "#F571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633385846, "uuid": "a8a3a3c5-fe8f-4dfa-87be-0c1661b1fdbf", "comment": "Malware payload", "value": "7a5999c54f4588ff1581d03938b7dcbd874ee871254e2018b98ef911ae6c8dee", "object_relation": "sha256", "Tag": [ { "name": "Atom Silo", "colour": "#F571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633385846, "uuid": "13cf0c25-1aeb-42fb-9fe7-5ffdd99c7800", "comment": "Malware payload", "value": "01785e1801e76063fb63deb78a208a3ca6e02cda", "object_relation": "sha1", "Tag": [ { "name": "Atom Silo", "colour": "#F571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633385846, "uuid": "02a63f59-3132-4a78-8454-05f585d155a4", "comment": "Malware payload", "value": "d93fd1845e5738e64446c0f952b7c4c6bf44c63d28a0da9e52eb9c7a68e6cd35820640ec525abc8ade45507faa5d0798", "object_relation": "sha3-384", "Tag": [ { "name": "Atom Silo", "colour": "#F571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633385846, "uuid": "2734e846-9417-456c-bc14-e1b31c52dda5", "value": "T19F154B19BF9541B5D07BE0398992814EF6B23CE51B718FFB129127AE2F335E0493A721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633385846, "uuid": "fe48e068-0597-46f8-90d2-b79136ff0292", "value": "12288:oTnK/17QNhQO/JGWYgeWYg955/155/vowaNxpLPGC2V+BOGDFofg06zP:MK/1QNhQO/Jg7vGCS+BOGDF+g0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633385846, "uuid": "c3bcc3d0-e1d5-4874-bbb1-e6fae5b20254", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633385846, "uuid": "3f9f2a3b-b790-4615-b7b0-5d99b7fc62bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633385846, "uuid": "3e2842ac-9b28-43db-8cbf-cefc4044956a", "value": "7a5999c54f4588ff1581d03938b7dcbd874ee871254e2018b98ef911ae6c8dee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e9c1cd-2512-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633352368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352368, "uuid": "2a1cbc16-ac72-4fdc-8c9d-d96a8578827d", "comment": "Malware payload (AveMariaRAT)", "value": "40ace58fe70c61a6f552e38b2632a569", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352368, "uuid": "6a6d155f-eee8-4a90-a3d5-de9641da08be", "comment": "Malware payload (AveMariaRAT)", "value": "7a7a3daf875f119061c9bfbc15ed1d5fc271444858a74b1a603af7b19fadab15", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352368, "uuid": "4eb0dc78-c409-4f32-85df-d1085393fde2", "comment": "Malware payload (AveMariaRAT)", "value": "edf1411f2ba7959323de8a7464f5b98fd25b6e5d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352368, "uuid": "07657653-48dc-4784-a8d4-5d3d6d3c5bca", "comment": "Malware payload (AveMariaRAT)", "value": "a1e8ad8e87090ee288d5b699a923939da617af09bc47d8e1002ca08db5f1b1b039ce7f10e9ec6c8f028e5000f7784fb9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352368, "uuid": "3824609b-8fdb-4cc5-848e-01596c20a6fd", "value": "T10F251201F7D2C8B2D4732D325A39A7416D7DBD302F29DA5FA7E84DADDA301C05225BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352368, "uuid": "a9240f2f-1362-4c37-bbc0-53650bf46764", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352368, "uuid": "b00bcb62-8469-40c6-ae08-2eea178c3a9a", "value": "24576:rAOcZEhvxirQvKQu3hawU4H9H721vDMHKX:thxirQvjuJU4H9HOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352368, "uuid": "d8d2033d-46be-422f-937b-4f5c6f0555f6", "value": 1016571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352368, "uuid": "7a391a89-4020-4845-9031-175a8cc5f2ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352368, "uuid": "5f161929-e4eb-4121-93bd-708c45e6f76a", "value": "RFQ- 28300NB.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f6c08b-24ba-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633314382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314382, "uuid": "a007087e-e730-4a83-9504-5c504076b8f4", "comment": "Malware payload (Gafgyt)", "value": "289fc45a94fe513124d43a6430f2d527", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314382, "uuid": "49253c6b-cfc2-446c-9525-dbee33ef9af3", "comment": "Malware payload (Gafgyt)", "value": "7a88bf08753f90670a014cef9f17824d0d2d99e49775a346e2e3da12eb7d671d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314382, "uuid": "a88a57a9-557f-4ff8-8924-36dc5397761b", "comment": "Malware payload (Gafgyt)", "value": "76663b25bed248a9f9573f305c05e9539bb0ad2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314382, "uuid": "96d8d8fd-9465-4312-8704-46ca1796e617", "comment": "Malware payload (Gafgyt)", "value": "0228741ce740aff72eadd36c96238611d4fe51e2865ffde0970db79d0acefd6dee1db91a074dfef944f70d2486bf1f5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314382, "uuid": "693d0432-ce51-4bae-8090-7d2e33566bb3", "value": "T1DCE3926ABB618EB7D84FCE73069A4902148C95C653D97FABB2B0C56CE74B84F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314382, "uuid": "1d893b1d-7f8b-465a-92c5-cf380e8ba5dc", "value": "1536:P0/eTNRsHrRDjMcZkHNc1PYeH/Qs10FhWW+sPFUmkV0ZF01TDtM2ke:P0Hjn7bH/oFhWkFUmkmZF01TpM2ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633314382, "uuid": "2a0aa5e1-d163-462b-a413-b1475ced7d4e", "value": 147022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633314382, "uuid": "2ad6409d-9453-4638-abf0-a6cea3d6c9f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314382, "uuid": "16833629-0b32-4de8-9f2a-c512e2f01461", "value": "289fc45a94fe513124d43a6430f2d527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe249e1-24e0-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633330852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330852, "uuid": "b4c24521-5767-4211-b30a-50469587bbc3", "comment": "Malware payload (RemcosRAT)", "value": "9fded068bc9d316a09571d53e934b3f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330852, "uuid": "b19fc099-d8f9-4192-b4a5-642b8ec5c521", "comment": "Malware payload (RemcosRAT)", "value": "7aa3e6c93ac645c2b56f93eb9fe7de45a7fb9958d491190eb6d06198a65e6ca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330852, "uuid": "1c235b18-b5f9-4d3a-aa0c-ad522ccfe797", "comment": "Malware payload (RemcosRAT)", "value": "a439db1e068f029cc6b4e4aa177a325e4354a852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330852, "uuid": "08895903-85fe-4be2-9747-5761348a8d78", "comment": "Malware payload (RemcosRAT)", "value": "9e4f072c001ca797a3952ef1779cc079b8e594a160022829e51efb0d0f9d5765066a747e0d324387ce1b06fdb3d5ce9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330852, "uuid": "e00b84e4-ade9-4587-88d0-ade5868eb350", "value": "T10305182262405769F1173333EC13499A57E6283C2E10AB36E6E15F5B472F784AED887F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330852, "uuid": "e7ef2d40-cc9f-4a00-b333-ca45f545d802", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330852, "uuid": "768bc60e-8793-49fb-bb06-b9e7bb2e7a47", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyNiYAycjL7YiEFXXXB:Naeq3gF1Sf+WIytAyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633330852, "uuid": "e199caf4-29f9-4fdc-8edc-4c0dbbae0702", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633330852, "uuid": "08d3bae8-4487-4ac9-bbff-5dbf4fbfc6c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330852, "uuid": "b508dc31-9a66-4a69-9ceb-483469f77a63", "value": "Neue Bestellung WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f445d49f-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633339503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339503, "uuid": "5b87fdc1-015f-4eb9-a1ba-4b56ef6ec7ca", "comment": "Malware payload (AgentTesla)", "value": "759b49238cc787420a29ba23ac177aa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339503, "uuid": "fff1d7ca-dc81-4f76-aea8-90573f3648f3", "comment": "Malware payload (AgentTesla)", "value": "7ace65e8c9b2a4f79b1e29381e4f9885c6e45a96daf7cbad55cbdbe6cda329a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339503, "uuid": "d5b465fb-c576-4328-baad-5e4a79f6e1b9", "comment": "Malware payload (AgentTesla)", "value": "d873b72fc56c86cd4543bca5ae5ca0ee3046e9b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339503, "uuid": "7a5685b7-391c-4633-9bd1-23b2991c74c2", "comment": "Malware payload (AgentTesla)", "value": "9affc5667cc7c431e869562f35e0c3dd2624a53290f86c73e6431c44662fb49965daae76b8a90df82551ffa3652d1a04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339503, "uuid": "567d2fb2-a17c-4cbd-922b-8110b29e7ff1", "value": "T1B294F1786373A750CD7887F42928F6928778642A1069C37C5DDDE4ED3FA27B44AE0A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339503, "uuid": "6ac63955-f46b-4e6b-8f2c-1008ff947632", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339503, "uuid": "1c86b29e-8bfe-44f6-bd4c-e945e15c798c", "value": "6144:DtLiERQ+3HwOz37lwNcrJp79hVYYb7mZZ1To3bo2amQ4U0Lwh+SrMIt0:YESoPzJTjF+Vo386dUQw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339503, "uuid": "d2a967f2-6997-465d-ad95-67e1f747576b", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339503, "uuid": "f5c13c38-51bc-4503-a653-1e6d056b07f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339503, "uuid": "5c19e1ef-27f6-400e-b3cb-8d7ccfc20c8d", "value": "cotizaci\u00f3n.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809549d7-24ad-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633308814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308814, "uuid": "8438b54f-3a71-47ff-b797-70b694f6b44d", "comment": "Malware payload (Gafgyt)", "value": "916cd29c725907f209e0e9ae7984a854", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308814, "uuid": "b6225cc2-e25a-49a5-b827-637def77eb2d", "comment": "Malware payload (Gafgyt)", "value": "7bb6a5de7ada05349783a731f3c484129b2fa4f9812ad84393762eeb30379bb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308814, "uuid": "9347496e-62d5-4863-baa9-454f7feec20b", "comment": "Malware payload (Gafgyt)", "value": "6af788a0e47f4f1fa71a2ede6ef370671d2eb264", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308814, "uuid": "957a7da1-673f-4e0b-9dd3-975d91d150d4", "comment": "Malware payload (Gafgyt)", "value": "2c996e713563250b400bca36cfe6ebc4e228da538bc20942eebfcad63ca64f3f170c2b799c699095cc33410ba3e619d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308814, "uuid": "a1e3ef44-b173-40f4-b14d-7222028babcc", "value": "T172B32937A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308814, "uuid": "fd05b36a-f041-44d6-af2f-a1151deaa963", "value": "3072:pC/4rdcvw3sZswR+phInmm/QcuLmHP6PNb:pCwr6v8sZsY+pmmm/QcuLmHP6PNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308814, "uuid": "c7dd1609-e5a3-4666-b940-0128c650a741", "value": 116785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308814, "uuid": "880284b1-d8b5-4cea-abec-d6cf90279609", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308814, "uuid": "a55583b7-dc52-47d8-a5a8-5a1db75de4bb", "value": "916cd29c725907f209e0e9ae7984a854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12af4b49-2528-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633361458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361458, "uuid": "8775a112-43fd-4ccf-8c66-0bd8f20d8525", "comment": "Malware payload (Mirai)", "value": "d6edbc727ecaa90a29db3809c3919e19", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361458, "uuid": "d3bb8e04-9aee-4c21-8da9-2b900408b187", "comment": "Malware payload (Mirai)", "value": "7c0e87a1dcf1920bfcd75a2ba5077077a219eef9e33e94808e61dac697973c3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361458, "uuid": "e30baead-154d-43ee-8ead-4acc59271227", "comment": "Malware payload (Mirai)", "value": "abc28c4495a808e488b772f7af0e257170ee3fac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361458, "uuid": "244a1ba6-baa0-4aeb-b9ec-a67d4e0058dc", "comment": "Malware payload (Mirai)", "value": "a8b304430800125d4601b871c36806fb0f866e85e3ec34889a8890de4c2dac068290c67013efec866094669919578b4d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361458, "uuid": "093af5e5-4619-4ab3-83fc-3d9e423b5ee8", "value": "T146938EC1E683E5F5EC1205B63037E7339AB6E07E2138EA93E3AC5532AD52701D54639E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361458, "uuid": "7b39c033-2f42-4e34-b3c2-532ecd2d6c59", "value": "1536:GlLaAtFVv1BXEoGEJTHVozbH0S5rvRP++0KpL1dHc/hrmBp2PSialb8:8ekLv1xEoGEJT6HRRvh++JL1hc/N+2Hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633361458, "uuid": "01d91d54-5279-4816-8fb3-a0e372135fb0", "value": 91216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633361458, "uuid": "ed015007-987e-4357-b670-c98fbb5bb90c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361458, "uuid": "ea001d4a-0d5f-4c4d-b7fe-8d6b38568d07", "value": "x86-20211004-1530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585bf257-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633335375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335375, "uuid": "6ee74e15-c9e6-4602-856e-da853948d4f0", "comment": "Malware payload (AgentTesla)", "value": "d2bb15eedc3467e3639ec37e3be2a2b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335375, "uuid": "4e577096-d481-4c38-a40c-638dd0c69b22", "comment": "Malware payload (AgentTesla)", "value": "7c204f35b9ee817d98670d20ad2a8d41e6d7a0cf96d86c5bc44cdf41d9296b95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335375, "uuid": "f143659a-61fa-4cfa-828d-74622107f89c", "comment": "Malware payload (AgentTesla)", "value": "512b355d73854196867bee81689e829ff83ba6c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335375, "uuid": "a370ee30-27eb-4d6f-a6d3-81a08db58a5b", "comment": "Malware payload (AgentTesla)", "value": "615334678a207688fa9909960fe8937be5be87a25b250638c5ff3e42685d29f29a085dc819c5cfb95427881f17026ab0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335375, "uuid": "f34b738d-6a59-4017-9b09-4308d61f6768", "value": "T13284125631C49997D2862B300EB3B3BAB6359E0487464B86B7D43E2F7C309C7AE056DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335375, "uuid": "cb5083cb-10af-4753-a62c-39f46a2ca77e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335375, "uuid": "71838892-6bca-4618-8123-5698b104fe0b", "value": "6144:18LxBDGeKGDuGyGNQjdefxSLNfZv1YGI3dnPvJpVIjDWXwfprk/y+365:ljfNFiJUj+wfprkS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335375, "uuid": "6b960fe5-e7e2-4a2c-8206-f6965d6da9f3", "value": 379196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335375, "uuid": "1566b978-6550-4c3d-867d-d87046945267", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335375, "uuid": "30a69a05-1a08-4142-ba0e-31105f132e52", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080bfdfb-24c2-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1633317631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633317631, "uuid": "6adbdcff-c6b3-4cc8-bb44-a6338a3de8b2", "comment": "Malware payload (njrat)", "value": "103aa6d5669a9f0246d44a5fadb767cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633317631, "uuid": "d9f10a82-6e7d-4536-b96a-fdf51e90f194", "comment": "Malware payload (njrat)", "value": "7c38da59f7862d189ac6e2d4959016d062c972d3c89408fe7e3602cb9f4a002a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633317631, "uuid": "3f352a35-e022-43e4-a9e8-29f6c17df6e8", "comment": "Malware payload (njrat)", "value": "b01d65d6b11d48dcb75fbb7e02a6d23c6d675b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633317631, "uuid": "fa3a0700-dd5c-48d3-8359-21acfc252ca5", "comment": "Malware payload (njrat)", "value": "46d9607e4061ac42199f9cbaa25e9164b35aeae673efeef24cbb4b412838c581b8d00dff7944aced98e201e9d78995de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633317631, "uuid": "1e3dbde6-cbcf-4652-8513-c6e815441c7b", "value": "T164A416F93CE0759EF4DAB031CA781C64AAE1EDEB571AC14ED01375AF6A3C567BA00091", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633317631, "uuid": "f9dcb8f5-ac36-4f76-8cf0-0abd25c8c4b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633317631, "uuid": "75099d5f-ff49-45c7-943c-4c68d4d4abf2", "value": "12288:PEYG7ywzVxKHZFRupFRulhx+vhx+Shx+whx+s:TuduwmBDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633317631, "uuid": "4b758b44-b3f3-4e20-9291-88736fada0f8", "value": 460993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633317631, "uuid": "e0386d46-0b71-4a9b-848a-ef4b42bf89a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633317631, "uuid": "b9ead43d-5815-40ff-acf2-7b9b63cf5f56", "value": "7C38DA59F7862D189AC6E2D4959016D062C972D3C8940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd4a856-24d7-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1633326825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633326825, "uuid": "4bedb3ec-96d4-469f-bdb0-f1beb450acbc", "comment": "Malware payload (CoinMiner)", "value": "3f2579841c134be51a00920dcc0da8b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633326825, "uuid": "8da153fd-e782-4d28-9f8d-20203b9b4b05", "comment": "Malware payload (CoinMiner)", "value": "7c3f390f58bd6635171375748cbbba82ccb9502687004595799cd497c3fc8615", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633326825, "uuid": "5ea74dbd-e42e-49b7-bee9-59c220d68a71", "comment": "Malware payload (CoinMiner)", "value": "0a57eb7f233634568f7d08de6ff06ce33422a79b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633326825, "uuid": "965f5372-4b02-4e7c-91b1-481597c82bfc", "comment": "Malware payload (CoinMiner)", "value": "df4f9a84e0ac2e9cd9daffc1ed169e881db30c75571793e93613ead6ff42aa60f50e01c3946fa2e9311afe9805f07452", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633326825, "uuid": "3da1926b-9a9b-4e97-b002-3440715ab5e4", "value": "T12C55DF6535CD6B33D5ED07B285D3EC599F30CA228786F30FA1C21661142A7AB8D0EB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633326825, "uuid": "37a34582-3252-471b-9773-7d5b717bcc9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633326825, "uuid": "dd391f9a-b92b-4d2e-ac23-0e946b3759a1", "value": "24576:GOpBEHSTE/sgN+4L731jMZExzdj4W09efp0mCUBiwyc907kqoA:B4iy1jkExzB4W098ifUnypwqoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633326825, "uuid": "825668c5-8190-44ad-a311-5d60012c3c0e", "value": 1379328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633326825, "uuid": "89dc845a-f20d-45a7-aa96-78e88cc13307", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633326825, "uuid": "7dbbd044-ca71-4757-9093-ce855b8e4091", "value": "3f2579841c134be51a00920dcc0da8b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3ff94f-24e3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633332058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633332058, "uuid": "c87c272b-9eb8-4949-8e18-624c20e9e7a4", "comment": "Malware payload (AgentTesla)", "value": "2c344bc41733cfabb02374cfab1ae8f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633332058, "uuid": "7657b085-71c9-4b34-a830-848034882f99", "comment": "Malware payload (AgentTesla)", "value": "7c9db09b727fcd8d7cad535a77911b8b9fc0c2508366c9f7a90e1f8a8c6ad1dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633332058, "uuid": "5f51ea7a-dad7-46ee-952f-35ed72380cae", "comment": "Malware payload (AgentTesla)", "value": "6e89313923b0f5003d718b6af9d28c83ed7c09a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633332058, "uuid": "4f93692e-f493-475f-964e-771a065ec865", "comment": "Malware payload (AgentTesla)", "value": "ce7455a3a8b93d87e2ee26a9a5bbb6be8159dec41426418416ca0d19614eba3ee8a639bd24073cf32078246c3f701067", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633332058, "uuid": "f7b53c19-1c49-4eab-b34d-62b7de8ed659", "value": "T102A4015A636B479ACD7883F22C24A15117B96C2A206DD33C1EC8B4ED7FB3B7455E0A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633332058, "uuid": "c98ff351-4230-4f45-a250-e6b207b86da6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633332058, "uuid": "bc1b5f98-4fb7-4237-84a9-0780a23da66c", "value": "12288:tlESoH4dO8qiShP6iUJtRzC5iMKtzXazeX:tlESdU8qioBktRmiMKtGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633332058, "uuid": "1fd405fd-3783-4b46-8242-bf44115bb041", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633332058, "uuid": "dee2d2ed-3dac-4d89-93d2-cc6fe9629292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633332058, "uuid": "93f8ff73-f1d4-47f4-a911-c7a26bdf632e", "value": "65339917748.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef6c515-2500-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633344352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633344352, "uuid": "3bee7a4f-3885-42b9-87ba-bd1147fcde80", "comment": "Malware payload (RaccoonStealer)", "value": "0f56a3d1e74e85ccbb1588218c8ab4a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633344352, "uuid": "53db8d75-be2a-4a20-b6cf-3f52458bc0d3", "comment": "Malware payload (RaccoonStealer)", "value": "7cd0e04ae6cb26444707130e0d56860e56345c9a2153078621eb7bd511ed1f29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633344352, "uuid": "986ef425-b6f5-4a8c-a89c-d98e54175901", "comment": "Malware payload (RaccoonStealer)", "value": "70ab361fe1245f762e6f03229ae71493482c960c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633344352, "uuid": "4f819ecd-1c81-4fb4-9a0d-51a364b71b59", "comment": "Malware payload (RaccoonStealer)", "value": "b929d3984aa296feb59fd231111322ea722dc6e65312007b3ff63848a76eddeba197253a82271fc2300c69056bb858d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633344352, "uuid": "049f533e-3fd0-4e4d-8b17-1b8309d10e46", "value": "T151C4F10831A1E6F2D6B64AF1A766C7E4096DFC69096559CF6B4CA72E3E3C3D1C322311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633344352, "uuid": "c6325741-8509-4b79-ae36-428eee13d4ea", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633344352, "uuid": "0478498e-75bc-491e-9e41-454c208fe5a8", "value": "6144:leqYQcoPj2WlQGQfqu6FrEaAE7tKGfL6C6JPVFMMuFEGSZ7WX9tZP6fQ2ROhxxp3:HYXc2W2GEwP7dfL6DnKG6njzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633344352, "uuid": "60c39d99-e9a1-4ef9-8b3d-bf5276f2d571", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633344352, "uuid": "49a8207a-787a-4ea3-8f1c-20ac71d391c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633344352, "uuid": "d1659fbd-1026-4f90-a9a9-18a0046ea84e", "value": "0f56a3d1e74e85ccbb1588218c8ab4a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e51c223-24f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633341398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341398, "uuid": "cf07570b-c378-4513-a10a-250b5caafbe3", "comment": "Malware payload (Loki)", "value": "c6ee9fc0d11ede8373b7313db998bba0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341398, "uuid": "cd7a77da-f044-441b-a8e1-5a0c5fd273c7", "comment": "Malware payload (Loki)", "value": "7cf4902a674dd38dd699992bd6664ebe5130fe93daffd14965bbcf6afea47569", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341398, "uuid": "3d9a9572-6495-43a2-8981-8e57a5b22b61", "comment": "Malware payload (Loki)", "value": "ecc160e61ce237eaafd81d0c41685bba0b09be30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341398, "uuid": "76cafcd2-5887-4072-a8bc-ae636feb0025", "comment": "Malware payload (Loki)", "value": "99eba856ec150ac3c890a91946e01fa9dbd4204b39d1436f15d53d9cc4aa2b48251c915b0c7ecd574a772168714c9701", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341398, "uuid": "b80b7ad1-5bad-4d94-96ef-79eb1c0ccbc7", "value": "T1DEB4E09D23AB8600FDBE47F979B491909BB1B8131415C33C5E9064EE1C637E48EE9B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341398, "uuid": "8eb336ac-459e-444f-85e2-1427a4393e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341398, "uuid": "f7b544ff-7841-4fac-91cd-3a99d14282ed", "value": "12288:reoSB+d1TZ/ah0nmfJADBji8RZQnJT6YashlM0JT6YashlM:6/419kmzbZQR9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341398, "uuid": "a7122ae1-97b1-4fd2-b8fe-f1007c7366ae", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341398, "uuid": "d9c93af5-825f-449b-bb01-da2bd43e3bad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341398, "uuid": "113bd67e-760f-4b45-8206-a5095f652d19", "value": "c6ee9fc0d11ede8373b7313db998bba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3ffe2c-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633363412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363412, "uuid": "b9fec116-de5e-4652-a9f7-80804b4c7b0c", "comment": "Malware payload (TrickBot)", "value": "2233c325a93b90103c15026853b69e3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363412, "uuid": "7d4cba34-6f31-4115-bcec-091b28f77ea0", "comment": "Malware payload (TrickBot)", "value": "7d588ba83fa25ee7e7911f192df709b8a19872de243ffbfc4c56428d903702e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363412, "uuid": "cc3e49ee-639b-4d77-b908-567798842497", "comment": "Malware payload (TrickBot)", "value": "0dd97efe60ca216086a26650f74d0c8b0510f9bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363412, "uuid": "3dd61be3-843e-4b1c-9f0c-c228464d3945", "comment": "Malware payload (TrickBot)", "value": "5878a4de0c344fe8bb72e9d84d97c8f14bed16ea6e6012fc5983ca4e219549cdd55b8bee8d22889c6af65f872a5b06f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363412, "uuid": "79de7cca-6108-44ef-9d43-18bc0a371253", "value": "T11494F1123AE0C877D0A745314EF58B79B6BAFB504F318A6F23D90F1E1D31A518A26376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363412, "uuid": "bd96dede-9701-419b-a0cf-ee8017babf4e", "value": "220580f49c2724e661575b7bf3bd58ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363412, "uuid": "90c2464f-cf73-4625-b1ad-ef18abebc46f", "value": "6144:h0lJVu5xP+ogEm8NG/wBHRSIAR9687dX9szOHMVT+R6NWPFgQAXaneCrvD:h0lJ4jP2zwn+96sdX9szOHMVFCgaJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363412, "uuid": "e79daf03-ce1d-4477-bd2f-fc700fd12115", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363412, "uuid": "c8c47085-fba9-4ff5-a3fb-010a32743187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363412, "uuid": "e3c5ddd7-4ae9-4673-b26e-7d123855a80a", "value": "2233c325a93b90103c15026853b69e3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056da264-24fe-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633343397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343397, "uuid": "20f53f91-8eb6-4eb6-843c-64b79b4b3eb8", "comment": "Malware payload (Smoke Loader)", "value": "2faec113d9e663803d2b5fb0df09b376", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343397, "uuid": "bd0a3805-f700-404a-9cca-67b8e43bf529", "comment": "Malware payload (Smoke Loader)", "value": "7fa11ed8064495f0a83c6fdf3136c6767f3eb49c4d7bdb7322ff90d08accee18", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343397, "uuid": "2ddcbeda-a8cc-42c2-bc02-53b98f2d8a0f", "comment": "Malware payload (Smoke Loader)", "value": "97cff55f5dffc1d956caeb1a5492b72a4f8a5469", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343397, "uuid": "b5ea7d62-63a5-4022-9e9a-bf2b13fe762a", "comment": "Malware payload (Smoke Loader)", "value": "0abef695e30f611a1d878ad25a47b5454994c800c9cdfd5721363b05b6e4896a7b4001f91e1b46081b4ddcbc2b138c16", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343397, "uuid": "c84ec976-126f-4727-8301-880ee25645d4", "value": "T15744BE1931C0CBF2D6760570E7A6CBF40AEDFC6D4E56528F2B98271E5E383E19722252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343397, "uuid": "349a53bc-2744-4758-873d-86d6e108e47e", "value": "ea6e9add4feec4142f4eaf80b256f47a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343397, "uuid": "e51e79c7-a87f-4d79-99fd-7490e083e9bf", "value": "3072:bQ/tuH+nzLQy+0YYLmJ6w3q/PaQQUT3KYPhfsVBBQWvbvPQiaDhxxMeetkkrsC96:bQ/U2zLmv6qQB22U7ROhxxpeTr/ekI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343397, "uuid": "0c7fbe12-667f-4e7c-91d3-d734eb40509c", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343397, "uuid": "d1ecef70-a865-4624-8486-c861d907c2c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343397, "uuid": "5140e074-ccc5-46ca-9cae-c199d119cd4e", "value": "2faec113d9e663803d2b5fb0df09b376.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a289e69e-24d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633327340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327340, "uuid": "9f4ffd60-0e5d-462a-b126-dd5371f19006", "comment": "Malware payload (AgentTesla)", "value": "50f2a046899d8c953f0590f926184d1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327340, "uuid": "dacc9dd2-54ae-4d01-9b7d-953c44a17e11", "comment": "Malware payload (AgentTesla)", "value": "7fad4f82f5c9379a7f7b522917956b3448b8c808a6ffabb484ad328592f624f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327340, "uuid": "2b4c5008-3531-4b69-809b-b196e76c6c27", "comment": "Malware payload (AgentTesla)", "value": "6627aaed42c573a2f8f2ddc704efc41bd42bb839", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327340, "uuid": "9de1a947-9fad-4d1e-aa60-8ffe961075c9", "comment": "Malware payload (AgentTesla)", "value": "37caeb6ca6e100bc6d796fd32d35ad557f83c536607ec5f1a09e790e699a375834a3170296f4b986f8dec1e1b614d3d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327340, "uuid": "7e127e56-ee67-40d1-b8f3-e1176f820a6e", "value": "T106942381617AC2D7DF7AFA3E6CF17A08A037315C650068B4FA071A15E446C9A4ED6BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327340, "uuid": "b51ecefd-e4c4-4e85-8ddf-9c00b19c9228", "value": "12288:QvUJZnRv5MtoQSiAUkKOUKNPoZzAdmxFYLaJr5qkYZ:Q8JFHMtfSiAPkCoZzVFY0lqkYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327340, "uuid": "12e4c413-1b3a-48a2-b8ee-b20f6b02539d", "value": 445753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327340, "uuid": "108455e8-9b68-47b0-bf5d-95992594dfd5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327340, "uuid": "1c85a589-48a9-4326-a73e-dba4300fd13d", "value": "Confirmation 4500159299.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f83feb5-2512-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633352031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352031, "uuid": "7b01bc97-39de-4e62-9536-9c8d399a22dc", "comment": "Malware payload (AgentTesla)", "value": "72e7c1c354f2680beb148df6723b10ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352031, "uuid": "82c17ecd-e31a-4615-8177-d1dd73a9f21d", "comment": "Malware payload (AgentTesla)", "value": "7fd3d9d611f69b2a54329cabc7c5000e65f54a733b52ec771a382f63fa820617", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352031, "uuid": "f373c25e-033f-4ebe-aea0-04e3c0563117", "comment": "Malware payload (AgentTesla)", "value": "cb251f36264a34f6bdcb1367e7632f37c1ba80a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352031, "uuid": "d7670bc1-c49a-43eb-8bec-cb78e1994eb5", "comment": "Malware payload (AgentTesla)", "value": "3aacd3a59c3cf6300666f45055413a7f66a314d5cbc7530997a4be906285a1e00897dbaf79acf34a62921e6658f829a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352031, "uuid": "d1069f17-b324-46d6-8248-214825886e4c", "value": "T1716412837AD15CFFC6D212312E73867AFB7B8104A6415B870F324E371B29597990F1AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352031, "uuid": "d6567ba4-230a-4e3d-af74-f436faaf9378", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352031, "uuid": "eeb366d0-64f6-46bb-963a-c081281e51bd", "value": "6144:F8LxBsWND9SaE1oekh8KP8I3WlaJ5mVKzPp2xnMVmKeUyTP83RKHE:/Wx9OYSqpNgMVmKexT2IHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352031, "uuid": "1d39024a-c02b-411d-a6ce-043904064327", "value": 311612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352031, "uuid": "f50a0e56-744a-4ae5-be53-f2f21149bcb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352031, "uuid": "20859e4e-06a4-4ef7-9845-5bbc0e2844bd", "value": "72e7c1c354f2680beb148df6723b10ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0180521f-24f0-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1633337377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337377, "uuid": "81105489-cd4a-49c9-a6b8-13bde8cbffad", "comment": "Malware payload (Neshta)", "value": "866d989d919c96e981a9b8ab1af9d8fb", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "Nestha", "colour": "#C38FA6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337377, "uuid": "db7bf63c-92bb-466e-991c-7495847d68f4", "comment": "Malware payload (Neshta)", "value": "7ffcb9f6daf4464de0fc3d659e47b76673c16c0f864ad0d2d1ac40f4b295ddfb", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "Nestha", "colour": "#C38FA6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337377, "uuid": "03d873b2-aa23-44bb-8385-170c4d070e85", "comment": "Malware payload (Neshta)", "value": "1ba7069a23eb4cbac7bb6653fe6d6e461ccdcbf4", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "Nestha", "colour": "#C38FA6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337377, "uuid": "373d1537-a2ea-45a8-869d-98599cdd6a52", "comment": "Malware payload (Neshta)", "value": "5c3d3dba96a6688e81ad883045df9b7d355baff24908510100e9137f86f5ce1cd298165316a3ce9fc9e97f552060fa68", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "Nestha", "colour": "#C38FA6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337377, "uuid": "33b729a0-351c-480c-84bc-86aa26821c8f", "value": "T1B76412A3311B4F86F4D3AFBA34E78835A968ECF88FB5C4581150723A9B71F099771216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337377, "uuid": "f28bb44d-66ed-41d9-872f-2fd39a01d766", "value": "6144:Dh/KGd/O/WgZJxNGJC8yPXO7RavRt10DfohnxdGEzL5nC:DhTd/O/FJxNGgRoaZufohxdGsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633337377, "uuid": "f041eaf3-8264-495c-98a9-f0def40a92b3", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633337377, "uuid": "8f90788b-0d5a-4fd3-8ff9-ff9754edfd17", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337377, "uuid": "3e982484-4679-449c-85e4-fa65b3ce079d", "value": "PO 20212702.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcf6365-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633353212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353212, "uuid": "b76ff187-a12f-41fc-975a-e8724bb4292e", "comment": "Malware payload (AgentTesla)", "value": "f32cff7e0928e3a0756e709fd828ca9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353212, "uuid": "dd7d2833-6e92-4d1a-b554-7835c241853f", "comment": "Malware payload (AgentTesla)", "value": "808ae58786047cf26587db3b1d57571c395e0f5fdba9a864eab7dc3a75704f6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353212, "uuid": "44a90565-ff2c-46e2-a5e3-b74d9ea6b194", "comment": "Malware payload (AgentTesla)", "value": "1ed2a891c27ec057dca037f2271a46e5cd490971", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353212, "uuid": "3e98b14d-98af-40aa-8328-727d7d35c29f", "comment": "Malware payload (AgentTesla)", "value": "79dacd7acf7f49542bbe58c7d95cfc2776a56f39f8c9c4b34d1ad10614c39fc22cd35dc239b3db1c97fa483d3a471c0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353212, "uuid": "506db762-081f-4c3d-aef1-19cadc5c3165", "value": "T18D25CF2063548566F0BBAF38D47294218BFFEFB69076C55E5CC2B59A0E32349801BB77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353212, "uuid": "37f789fa-41ae-47f5-a22a-3be3395e1290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353212, "uuid": "8ac4fcb4-e697-4fd9-a7b7-3be68ba9c589", "value": "24576:BA6nFu9pbeXfo4nlL7dWkqPWcBvQ+FotL8:7nFu9pbePNdW5lQ6otL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353212, "uuid": "a0fe2704-a3c6-4679-bdd2-af13ae09fef2", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353212, "uuid": "0afa0c74-adba-4a7c-a58f-8dba44998062", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353212, "uuid": "ba8321cd-00d5-4316-a96b-dd2cf2fc452c", "value": "BL INV PACKING LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ed26cc-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633343312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343312, "uuid": "df18705a-b9e1-4bc5-bd19-4d28983ce5a6", "comment": "Malware payload (TrickBot)", "value": "ac1e846a280d6bb2c5db68a2d7293301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343312, "uuid": "5393b918-1671-4374-9d01-7ae780dd48df", "comment": "Malware payload (TrickBot)", "value": "82c3c81ea8c5fb605e216367a214caf5573fa2f4fce9cd4f4dbc9baa9ba12fd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343312, "uuid": "8cc69af1-818e-4607-9349-e8f2900f76c1", "comment": "Malware payload (TrickBot)", "value": "c7fa76e67204a2c4b4352ad2f6a2c11f03b44ad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343312, "uuid": "6cd104c9-b05f-40f6-bef6-4f7c8b587ca5", "comment": "Malware payload (TrickBot)", "value": "a2b40ff249bb49f42700064ba78af577a5e9db62bc36e265ecc6156bded171763b6e93e28533bd71a79576d9cb09cf53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343312, "uuid": "1b169940-2e9d-42c5-a605-405a0f215357", "value": "T10A94F1123AE0C877D0A745314EF58B79B6BAFB504F318A6F23D90F1E1D31A518A26376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343312, "uuid": "83a99db5-3228-4770-97ee-e068443e0348", "value": "220580f49c2724e661575b7bf3bd58ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343312, "uuid": "ee2c8572-3b63-437a-a2af-4b03903fd4a4", "value": "6144:h0lJVu5xP+ohEm8NG/wBHRSIAR9687dX9szOHMVT+R6NWPFgQAXaneCrvD:h0lJ4jPxzwn+96sdX9szOHMVFCgaJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343312, "uuid": "2fa5c799-07aa-4c3c-bbb4-6b5ad5d400a6", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343312, "uuid": "1bee5628-b053-4666-b6f1-2411ce837d45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343312, "uuid": "3f61efc8-9bff-4b52-b159-393ffccf0760", "value": "ac1e846a280d6bb2c5db68a2d7293301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0858ef-24f5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633339596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339596, "uuid": "514c779f-23b0-41ef-960b-fd06784b613b", "comment": "Malware payload (Formbook)", "value": "044240be9a10909fe16659868b1e7d62", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339596, "uuid": "7da1d340-39bd-415e-bc34-0bbd68ae105c", "comment": "Malware payload (Formbook)", "value": "82fd9e906979a54a687422b5bc8f310b4eff4c44c0383999f4383f8e8689a9d8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339596, "uuid": "6e0ee452-abef-410c-b9fc-040c9bbd86f8", "comment": "Malware payload (Formbook)", "value": "6761b6879de9f607b6b148a18291383aac6ad048", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339596, "uuid": "72977923-22d6-4f35-888d-590de370c5ef", "comment": "Malware payload (Formbook)", "value": "d171065ba894af117c8de8f46c4bf3cdc1743c5085a06a2f4f8a38b15f65726b93af55823166a6b11e0ffe69fddcc4e7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339596, "uuid": "831e51f3-7f45-40e4-a650-ef0a98ed7b5c", "value": "T126A5EF06B46576D3D32B14F012AF7A0E811C788691C91C8A885AC7DE6CE5CFED349E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339596, "uuid": "1868d8b1-0ba7-4159-9bb2-7eca869c89d3", "value": "1536:+i/Zfvkkdi3T3f3m3+3I3h3f3i3k3W3C3y3I3G3y3n353U333i3k3W3C3y3I3G3N:V7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339596, "uuid": "754dcf69-47f1-4187-859d-fad4bc6a216d", "value": 2241225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339596, "uuid": "9a48f402-b493-4221-b65a-3757044045f6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339596, "uuid": "d334a90c-252f-441b-a8d9-72f747a77803", "value": "DHL_Online_Receipt.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd21db3-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633339196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339196, "uuid": "f06a4aad-3233-491d-838c-331c395adbcb", "comment": "Malware payload (AgentTesla)", "value": "83a3c7bb5e901f6d1a9dc4de55796bd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339196, "uuid": "434ea5b9-e7e1-41f8-b940-3209da5a4275", "comment": "Malware payload (AgentTesla)", "value": "83001e2e1d6343c0c16d4ea5f976b9e06435c360902f8983bd74d3bf7d599342", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339196, "uuid": "033d6929-c215-4330-9ee3-5834ae10951a", "comment": "Malware payload (AgentTesla)", "value": "f88d596ca6e560fd7d026108529beb28489e91ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339196, "uuid": "accae5cd-fd66-4150-a44d-28d98b474531", "comment": "Malware payload (AgentTesla)", "value": "271253257de4c8e271a1de626c186477c40e916bec511378e783962973c48b460dba857a4549f01e1a47afab3298261b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339196, "uuid": "a92c13ba-32d0-49d6-844d-9db18e6e2b2e", "value": "T160642394B263D7EBCCCACA715727FA38E366C81440D759CB4B241F7B26BA64F260E150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339196, "uuid": "90371105-74bb-44f8-b55d-9101e391bfea", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339196, "uuid": "d5849f7d-1f90-4920-a4d0-d73de41b0cfc", "value": "6144:F8LxBs8CW5/k7KS5/HVgJFdgo3bXN1Q354tg/8bP:/jW1k7Ko1kKo3LNQp/87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339196, "uuid": "a5acf7b2-8d51-41f7-b882-d781a88033ca", "value": 309425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339196, "uuid": "75c8e332-9b1b-431c-a7ce-1b5e9c654a8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339196, "uuid": "c50ee909-87dc-4acb-b43a-c803e905dd54", "value": "CMR-3071149_PDF.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901f9257-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633347924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347924, "uuid": "f5f5356e-0675-4078-8bac-e3039338288f", "comment": "Malware payload (Loki)", "value": "5d6978a50bb6d6fc1ee7d26c327663f5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347924, "uuid": "0d8927fa-9c21-4875-9513-e157e9a18363", "comment": "Malware payload (Loki)", "value": "8374e43960d0eb49b6230032b40619dd29448fe89809d625766d4465b640840c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347924, "uuid": "589b00c5-574a-4458-bb5d-1696e38e6023", "comment": "Malware payload (Loki)", "value": "9fb84131f465760b4bece2c037f173abfb52d6e0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347924, "uuid": "ae61c563-1057-4cc1-9501-7f9cee3af94b", "comment": "Malware payload (Loki)", "value": "dba8113ef39886ec7dd494378cba9b0756fde979eff0f965125bb91472bfde376a655c3178b95a970e58023aab67430a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347924, "uuid": "8480ad71-eae2-400a-972f-31465a16fd05", "value": "T157D3012866BFB3B6CC27D73AB0A116B8451F9FB016EDA6C710963D484D71C1929B2F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347924, "uuid": "b55957b2-b45f-401a-94fe-f44fd1845b9f", "value": "3072:t9X5fP/NrrfP7M4+8jjOJAPEeLuBZdbtLGXuZhQ0on9uMEmT0EKqjO0DljJ8MM:TNP/1TP7zjjOJAPEeShbIXMhmMME62qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347924, "uuid": "170b3d21-c0d1-4ef8-b603-55622d924bff", "value": 141496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347924, "uuid": "77851d02-1d30-4fa2-ac9d-d0e8150840fc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347924, "uuid": "17bec886-980a-468c-ba41-9d5d2505d3f1", "value": "ITEM LIST PROJECT-PTU2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423fc303-24da-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633328037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328037, "uuid": "e95bdacf-80d8-4fa5-9e0d-e44d9c1d36a8", "comment": "Malware payload (RemcosRAT)", "value": "3a7199d2c5335d8f4442cc332589ade5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328037, "uuid": "9f1b0126-fbf1-496a-aea7-7a10fa08cd37", "comment": "Malware payload (RemcosRAT)", "value": "8552402ead517097114a73e0c23f8765d59ac4e8462a6d4b3ac86f74b45d0596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328037, "uuid": "b21c294e-c1bd-40a3-8801-eb01ad274670", "comment": "Malware payload (RemcosRAT)", "value": "c13144186447560f1108febde6bbbb157e07ab34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328037, "uuid": "d473a8d5-88ea-45fd-8b44-94a41aa7abc6", "comment": "Malware payload (RemcosRAT)", "value": "1aa5478e8535ad933cc6dc2fe618d605010d96ad6161a2d827be65deefb5292a8dcb394618cf29beb4a8fa8455ca89ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328037, "uuid": "632a9951-e176-445a-9d2e-b358a495ed36", "value": "T1E8056D5BFEF088B5C421063D2D8A93987435AF772869945427FF1D1CA72E773381A2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328037, "uuid": "7c88f4a2-c248-4ed5-958b-ca7e452ffd68", "value": "8bef6a4d96b506b71db09bffc4184dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328037, "uuid": "bc9b11fe-a1f8-4725-ad97-3dafa917bdbc", "value": "12288:tFJgcBmkZEwyRiET71YDWV0YLE+VotReP3mfCL9tZK6O90Oe6jkOGbGR:HGe5aXRiEiDWVxL8qPm6L9tZ2jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328037, "uuid": "b6372f5f-99a4-470c-8daa-0db2b7364a46", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328037, "uuid": "2ba48039-bfa1-4d96-8d5c-17288bd849bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328037, "uuid": "6c354af8-faec-475e-baa6-00cdec01f8d5", "value": "NUEVO PO 2006-020 MAQQO,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf23f2a7-2520-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633358338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358338, "uuid": "966a00a0-0473-46fe-847f-a28b2b361530", "comment": "Malware payload (Formbook)", "value": "f8096c1b1e3cc83ecdcc58539d6b643e", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358338, "uuid": "5027db05-0a83-48cb-a03c-f6dc5ec7d844", "comment": "Malware payload (Formbook)", "value": "85b20b341d86b43b4da52abf6a661f16ff07cf2f3b8701689fedcc3e036bd1a4", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358338, "uuid": "67ef04bf-9842-4972-8903-75cf66200707", "comment": "Malware payload (Formbook)", "value": "64ef2b5a72a1cce92fdf5f546fe8943ca1f6d365", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358338, "uuid": "561c9b79-360a-4a0c-bfe1-58902c308682", "comment": "Malware payload (Formbook)", "value": "db9248caa9a5c793d8f7dc7a2a5ff68382ef1fb241cd220e70fec0e4912fbe73430ee959692a5116a502021e0189e5b8", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358338, "uuid": "46a8a457-f49b-4c4d-94e6-cf17ffeb5c7a", "value": "T14EB423C6BD48F35D617F1A2117BC12BCE9F929AEDD0AAE1FD272CA34330155AC130949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358338, "uuid": "d302fb9b-985c-4f9f-8ee8-fd178c478184", "value": "12288:uoebB2KGrAPC0NrqX+zFBbE5A70lwJM75ANl1:ObB2cC0Nr8G8A7wt75AN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633358338, "uuid": "5a3bef68-9f5d-4a1b-9932-a5842505dbc2", "value": 510439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633358338, "uuid": "6d8af890-b8df-4b0c-8274-d3626ac70e00", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358338, "uuid": "ae092ac0-b467-443d-87c4-4aff90c713e0", "value": "MAERSK Shipping Information_Pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508042e9-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633348247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348247, "uuid": "575a2b02-00d8-43a7-981e-dfb8703dbc77", "comment": "Malware payload (RedLineStealer)", "value": "97f1e93b35cb783925224bbdf45bba65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348247, "uuid": "52665057-9c49-40a7-9afa-24d1f8093764", "comment": "Malware payload (RedLineStealer)", "value": "86cb8b7414c5f6b1b16eb79f85869bc5eb35fd7d3bc42be74df61a241ba51768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348247, "uuid": "24ccc27c-c686-483a-8e5f-306b5d56f328", "comment": "Malware payload (RedLineStealer)", "value": "dbe01132ae6a2ab97939e59e0b6e561b353aca40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348247, "uuid": "21508f17-92e6-45ad-8dc0-d60b1319aa81", "comment": "Malware payload (RedLineStealer)", "value": "369f82af3624c335a3f043044f3702df777dd50e49c2f4a001035303eab723ab8d73faa9869116ddce2a6743367a5e60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348247, "uuid": "82856d9c-7e99-493f-855f-2dd18a6f37aa", "value": "T123B41209DA9E8379CAAF9BB97530700017F190693C63DF56AF41726E5A3B3C24B10E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348247, "uuid": "3e5e25d7-7c72-4a8b-a4ef-b05be4bd4121", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348247, "uuid": "7df84878-69b9-47fa-b786-da4af32a1fcf", "value": "12288:V4MXtU31Wf//35DeQiIH5MkybNLoMymtiK5o:/C3gfX3F5DCNLly+Fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348247, "uuid": "1ac56077-c3ff-4e16-ad19-35800ee4b773", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348247, "uuid": "eb359393-cd7e-4076-9d64-e0e84c1f9408", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348247, "uuid": "abaf4ee0-3826-433d-ad84-bf10c231e522", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb9872c-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633352856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352856, "uuid": "55321db6-fd3c-47f5-8e3b-0c38ade44f89", "comment": "Malware payload (GuLoader)", "value": "4fc7e5b54fa37da84e0ea8c5c1b9fabc", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352856, "uuid": "0bcf73c3-0fed-4523-9940-4b1a5edf052e", "comment": "Malware payload (GuLoader)", "value": "881397081db32078d4ceb1d900d1188f01602eb739996e3bba3c91f8056d3d13", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352856, "uuid": "4daf8768-6278-4063-a02b-a43d408fc10e", "comment": "Malware payload (GuLoader)", "value": "ac8c25c1161912e8f21a21635671ebdd31328837", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352856, "uuid": "d8528f8d-2959-4b3b-b9a3-15a648c677f6", "comment": "Malware payload (GuLoader)", "value": "0f79dd81dc8cfb4c4dac74355d2d5afea75537b54d2f5d5acb751e3974fcc1875bd1eb37724747d9ee81c47e6e0ef392", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352856, "uuid": "e2dfa075-16c7-484a-bcc8-be1046d237b8", "value": "T15513F2C805247EE4EFEF41F14B160927EA1C9A3BDF3B521A580C7CEBB665A0B9069C15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352856, "uuid": "3ed61cb9-d3dd-4ab6-a686-4486fe841ff6", "value": "768:ZVYnFiCuEiHtDdyY8u0oB+OyGlG/1NEkprKfoRjlUAJMRDyNow:wnFDDiH1dyiB+OyGnWrugxBGRDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352856, "uuid": "b237a984-c13a-48da-b58b-229c8405d558", "value": 42974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352856, "uuid": "30f22538-8771-4bd4-943d-1c5ba20e9e0a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352856, "uuid": "be0c214f-64fc-4568-bf4c-07f3ecf21f46", "value": "FACTURA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcda364-254d-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1633377472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633377472, "uuid": "fab013c4-c60f-4274-b673-ea5643035417", "comment": "Malware payload (Dridex)", "value": "f9cd129d87758bcc632b02e785a61770", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633377472, "uuid": "280026d6-ac8f-4909-be8b-b1971b3e20fa", "comment": "Malware payload (Dridex)", "value": "898c5ae1f036965b06a029e399512dd0ca78492529ac62df7daf181d6b89d8d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633377472, "uuid": "15b891e0-21c3-4543-8504-1a511b22f863", "comment": "Malware payload (Dridex)", "value": "44b781c1fa2e942ca63e8778594e6136782f2fe7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633377472, "uuid": "ad11408a-4e87-482d-b74d-6057ee1f2359", "comment": "Malware payload (Dridex)", "value": "fd345779b4e8874c839eac3f246b932ece35a2e00040d5aed7775a589d6b703f4e3b3dbca3ee9416a45d080579219dc9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633377472, "uuid": "11b39be9-0c20-48d6-8cff-eead6ea6ba2f", "value": "T17D04C046F5AB0294F43E3ABA25CDF3A7267058569738F05CF327C987A036B0D3235669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633377472, "uuid": "44b33029-ead6-4a88-bdc7-f1cf9cb2ec0b", "value": "c68e7650efd3d15ec218f4a10322a97e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633377472, "uuid": "622c4bf9-277c-41d6-8da0-bfad77636ce3", "value": "3072:FAIkqXpPKnXkU64fT/O7fbpvcI2yuOssp5kSmrzzV4S5:FAIkjn0GL/O7lvcITYekSS3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633377472, "uuid": "7a15ba91-05c5-4ede-bcce-9b32d07662bc", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633377472, "uuid": "8371dcbd-407d-4a74-9523-a8515a0bb245", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633377472, "uuid": "498c388d-7350-4c9b-a635-e87d9bbfba81", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.18015.16391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2c95a0-24fc-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633342796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342796, "uuid": "2a09320c-d8b7-4d36-96dc-8b91aad720ac", "comment": "Malware payload (NanoCore)", "value": "67067b34d97401bc13ef0e10cdf23d68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342796, "uuid": "a4e5eff6-abd0-4308-8b36-378e46fb52e9", "comment": "Malware payload (NanoCore)", "value": "8a133e2bcad2160bb5e09cb6002493f4a7cd4825e09f8f2db2eaddafe284a12f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342796, "uuid": "461cc0fe-7423-452f-a5f0-a6d75d66f3ba", "comment": "Malware payload (NanoCore)", "value": "2a21fdfea636dcaca27561997d216790df137687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342796, "uuid": "2608e299-4ba6-4d67-9228-5a9c023a4961", "comment": "Malware payload (NanoCore)", "value": "0a35a844f7b1191dcbdd4cb4cd2a79fa55760cca5f5c845f44dc93c53190494eb780211b665704319faf4799e2402355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342796, "uuid": "edce5dcb-aac4-47bb-8dae-9bb45ee06a6b", "value": "T10BD4E086E3576D06FDD9CAFF12DAA5A36B6309020803C92F69D036DE292F67D15113B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342796, "uuid": "a4d41d5e-cb32-40ec-a4db-17cffe26ede2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342796, "uuid": "90dbfb67-dd60-4a40-8925-f9ac8d43765c", "value": "12288:01jYT43sVRFBywLxtRr22GD49RpfJlS4yPg9WGVJ9zT:01jjsjyU7rGD4JJlSno9WGZzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342796, "uuid": "1ac7c8fb-1bb2-43e4-a28c-e9eb1803d465", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342796, "uuid": "85fde802-1279-4207-b470-b47bf3b63083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342796, "uuid": "4dba3261-e342-4fd7-9f58-3ed3e96e0441", "value": "67067b34d97401bc13ef0e10cdf23d68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021914b3-24dc-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633328788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328788, "uuid": "075b5626-595b-493a-8eb9-aee2bbc2e509", "comment": "Malware payload (SnakeKeylogger)", "value": "3e538a2bcfd2b69fd9bf65ff03c15df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328788, "uuid": "8d2f3faf-89ca-4c3e-9a10-a7f67847200a", "comment": "Malware payload (SnakeKeylogger)", "value": "8c0cdce2996d1a5ab9c8c3c83c28ec88bb0d6a88793bbcfaa1599d67f6a247d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328788, "uuid": "68fa36e5-32ae-4cdc-95e2-c53b59d49131", "comment": "Malware payload (SnakeKeylogger)", "value": "9834ea82eaa4f9a6d93b1910f50b2af7864aa6f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328788, "uuid": "8d8cf518-aeaa-4cd7-9031-0a3a99d1545e", "comment": "Malware payload (SnakeKeylogger)", "value": "9ff6e7790edf09d3cefa725c6ecff6004cdcb171d61103d10cfe071146f6b4f16b9e63afd901df60633ac9917cff4089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328788, "uuid": "5bf95e5d-d022-48ff-b1bb-eeb3feb95d86", "value": "T11A841269271F1449CD7947FA68B682C1733BA532A25DE3BC7ECA309D65973BC0AE0047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328788, "uuid": "0f521fff-8121-4ace-8e98-f3d607ef964d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328788, "uuid": "5b0833d5-e447-4946-9d4e-023119453fec", "value": "6144:PIO/lGqodH+8eYU4ElxkPD2xOV7kWXizSiMgIhUzDSxzS/NDe3a+wlZcIL+F:PwVH+8b2sVGSidz+xzSsa+yiIL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328788, "uuid": "45767cd6-b784-41cf-be42-1c04f6137ee5", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328788, "uuid": "4a5b6e42-37f9-4c15-a4a6-e41d680b2c76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328788, "uuid": "716fa8f7-1a53-48f0-b2ab-498e5400c6d6", "value": "Order Quotation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7936315-2536-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633367828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367828, "uuid": "c6dd8875-9085-47fb-aa17-01821cd3080f", "comment": "Malware payload (AgentTesla)", "value": "832b824e7990970df3068285a1b8a4c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367828, "uuid": "58ad7ff0-d2b5-4693-819c-a3a48b3c1138", "comment": "Malware payload (AgentTesla)", "value": "8c886bf2cafc10e480574711e621564a30180cfd60c887a82c0cd637543f2103", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367828, "uuid": "b59fa4ef-1216-4181-b010-e06c7398d8d5", "comment": "Malware payload (AgentTesla)", "value": "820fbecd2e89fb10e62c39bb8d9530d5571d703b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367828, "uuid": "40500d9b-8c5c-430a-8d66-567c7d73f040", "comment": "Malware payload (AgentTesla)", "value": "0010db88f51c8f9e41d8a635f3ff693a5d8e2682cfff22c055fe4f349bfc293c0ce5e30a0d1b9cc6dd623702a337a1fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367828, "uuid": "77814632-bcd8-41e0-bd7a-1d5f6e675426", "value": "T17915B5D43386B5CDF577D239F4101CEAF9B8311EE31ACA0260632A968D6C682EF2D5D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367828, "uuid": "242fd979-fd66-4e4f-ae7d-b814c946d279", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367828, "uuid": "21e6631e-959e-45ad-8696-99ca7dfab523", "value": "12288:TX6XgiC36qeoNy3B046Mnq0UnsO5lJkKzUvoPUu9Yiqi+S6xzWYqgyMvo0ZFsqaZ:r6XE+hxzvvBgNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633367828, "uuid": "eab184a0-f04a-451e-b974-17597671c838", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633367828, "uuid": "09e3702d-4be6-4aae-8921-94170a063420", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367828, "uuid": "79c1fd81-4d29-44d2-8ee4-a5a68d35ac19", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7159ec05-252b-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633362905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362905, "uuid": "9e3469bc-12c8-4873-9461-bc4776e20300", "comment": "Malware payload (GuLoader)", "value": "3567ddeb52e9f1af0ab1828546357e8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362905, "uuid": "746fbda4-b6bf-48ab-9c53-0d4ce7e3a1ea", "comment": "Malware payload (GuLoader)", "value": "8cd25fc3ae7605ea83405055754e04767ad4b19c61efb152a091d410ccc87b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362905, "uuid": "52281440-6447-40d1-8c7c-4df591321466", "comment": "Malware payload (GuLoader)", "value": "1f40e2943dbb18b996b67565bf1098a94d570c96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362905, "uuid": "14926cae-ae36-4dfd-9a3a-1bc37db70d1b", "comment": "Malware payload (GuLoader)", "value": "012dd9e06bcedba68df57669ba8dfbf330dd7fce34ed5e3858fc34908d234d483c0f2103e998cced897277ec9190a1af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362905, "uuid": "719a63d9-696e-4f12-ae0c-b3acc79f7f54", "value": "T17EA3D332E490DBEAE914C6FDF775F4B600E1AC22C5566E0B72497F1A39F60C664F024A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362905, "uuid": "cec728dd-9026-4e55-9005-3cc7d90c8e0a", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362905, "uuid": "9bb326c6-5d7a-49c8-80cc-29e1a7b1b844", "value": "1536:tBVgIP5ciUO4oGSZPWH7C+k5pB65iFphjp:tBGIPOROMSsbC9pBCipjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633362905, "uuid": "44f7dd40-ae62-4a23-b363-49b836b57f36", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633362905, "uuid": "fc9032c4-22ac-485e-bbe4-ecef42613b0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362905, "uuid": "baf99ab3-d0ac-47a6-98a0-a42011a5709a", "value": "factura n\u00ba0248325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1041c94-252d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633363978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363978, "uuid": "4f5caaf5-26e2-4cac-9c18-d8759978bb9c", "comment": "Malware payload (AgentTesla)", "value": "964ecfcb2d909a8d942058e28bf621a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363978, "uuid": "3945f5fd-0e49-4385-801d-56166873eb25", "comment": "Malware payload (AgentTesla)", "value": "8cf87dbdb89855ed5e7ca34b9d4addedbd36d67b4d4bb571b36e3f69f0d29049", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363978, "uuid": "9bf4d79b-4017-4e46-8713-d5c486225368", "comment": "Malware payload (AgentTesla)", "value": "e3ce5fefe127d9868b9885db1da66d8407b1617f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363978, "uuid": "3258f29c-7241-4fe8-a000-ebe85d5da73f", "comment": "Malware payload (AgentTesla)", "value": "e9200a98017cff9fd4794cb90365597fce85fe311223bc23a845bf3107a14e357c71a23de787a080946aa6a624616233", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363978, "uuid": "8b721331-8f3e-4a95-bddf-eebc1d5a2100", "value": "T111243A562754D520CB6F527EC01A820831F1D707972AE2DF5AA5D8EA2F836CCF90BCE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363978, "uuid": "efdc1656-fdc2-4026-b66b-cee4c2d269b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363978, "uuid": "1e1037ac-4f81-4da0-bbc2-814c5bab32b2", "value": "3072:AmQwnrLiwhLK4T/DmUvVPoNsRJXfRdtWlkun+PDVP5Pc15P+75mUacy:A2KtUO+RJ3CkunqVPZc15GcUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363978, "uuid": "be67bc69-567d-451d-84d7-4cb08b0de96f", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363978, "uuid": "61c981d2-7345-4d32-8714-2a120c2516f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363978, "uuid": "36a6c144-409e-45a9-b04a-c440d3adddea", "value": "964ecfcb2d909a8d942058e28bf621a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd232bd3-250a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633348913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348913, "uuid": "268f018d-3891-4dfe-aef5-cdf1d51ee70c", "comment": "Malware payload (AgentTesla)", "value": "6e45385a0a033e401aa7cf7e79809289", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348913, "uuid": "f34b9e10-40c7-4415-8af4-15f48a87d831", "comment": "Malware payload (AgentTesla)", "value": "8d44a400240fa9808245b944fc23e74589674035d67434a2c5ddfeabc074295c", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348913, "uuid": "ce110fcf-c5a2-4300-97b4-47d0990be65a", "comment": "Malware payload (AgentTesla)", "value": "fab2e5ddf4b1a2e50993421c7be1451d39f06591", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348913, "uuid": "3ef53cef-79a5-43cc-8001-e09faac89325", "comment": "Malware payload (AgentTesla)", "value": "402c2e4fab327a03f4de5c0ffa7f42610770b0768e7b4f6455c365df76b337e85102ca3f11a1e13b8e6f0a38d42c9681", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348913, "uuid": "722c5d56-deb9-4d97-a73a-1eca507151b6", "value": "T1B7942384DF9231DA11CF21699A1F531A338252BCFD5E0D546B8E3520AA3BD75A8CC36F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348913, "uuid": "1b75bbfc-53b5-4780-a405-0d40cb959631", "value": "12288:WmWbzPER/0Anw8JWsqq6+IE/J5e3uM/Zf3sNiD:uzPc/9qqtI+J52ukf8NiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348913, "uuid": "4830e54c-7a62-475d-aa79-de80c0740cf1", "value": 425859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348913, "uuid": "1919f3a9-8798-4752-a121-afadd3f55979", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348913, "uuid": "2a23b197-7fbf-4d80-9491-a4cdca210967", "value": "DHL Shipments.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0050cfde-24f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633340382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340382, "uuid": "3e3125b0-a870-474b-ab24-b0fda97c2344", "comment": "Malware payload (Formbook)", "value": "4b3bc16cd95b6e2a277c15e20f2579aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340382, "uuid": "8782a1e6-6598-49ca-bc46-f8ceec9a4c26", "comment": "Malware payload (Formbook)", "value": "8f6e11cb2103dc67d8c533379c9e7b14662084ebbab86b5fe1eaad1b65f33ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340382, "uuid": "f1210e26-4f6e-41c2-a43c-3361151e52f5", "comment": "Malware payload (Formbook)", "value": "c43078bbd9cb32261f9b15e96a68c6413c4d86d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340382, "uuid": "6c4d1b4f-7006-4215-b63b-33a8c76aa96f", "comment": "Malware payload (Formbook)", "value": "a0687c6edbba13427cf030a861307ec30412e0309978fe7279bd94842d0a3bf1cf35748d5bf0758d90fab77283ff41de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340382, "uuid": "5419b1db-4daa-4f1c-8187-73d99f3f7bb9", "value": "T106D4C129B37C8A1FC5EF83BAF049015487E2F547739DCB889E81B0EE59EA735514248B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340382, "uuid": "7f2f177d-4a5d-482a-ac99-99442cc7485b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340382, "uuid": "b8e78c7b-a32e-4ede-a8bc-b2cef0d865de", "value": "12288:8SDH3lIF/OX2BeMAkaU4EoQ0Mgb1qH3W36u3d7:L3lIFbPAu4EJgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633340382, "uuid": "c502fd92-8b4a-4fe2-8d76-e1d0c6ea7f9b", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633340382, "uuid": "a8687fda-aeac-40ae-9a89-32a98181d032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340382, "uuid": "43317fc2-561a-4091-ba98-4f7815406c41", "value": "SWIFT Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6764412e-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633343132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343132, "uuid": "f1659118-0d9b-4229-9b2d-eef05214395d", "comment": "Malware payload (Formbook)", "value": "e78a8c49a3846c8224702bdfe143d6b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343132, "uuid": "07d31669-ed9c-41cf-8f46-0a2390b1edfc", "comment": "Malware payload (Formbook)", "value": "8f7fa187226287ba3a8858e75b00b021022fbfbc8f1f7ae01557cf692510fe00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343132, "uuid": "04904a77-6271-4a5e-8cb0-71ebe9f3f49f", "comment": "Malware payload (Formbook)", "value": "f35ee4878252d4a6c38971a0768b2adff12ceffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343132, "uuid": "7cccab89-6bc8-4234-99ce-0f44d25de4c7", "comment": "Malware payload (Formbook)", "value": "e9433b79e736eb74f604e49e93a0575dde7406a62c593bfadbb755823d3bbce8e0f3a6cf766c9558cf5e66aed109a019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343132, "uuid": "a4f1b027-2e06-49a2-9da6-79d393266253", "value": "T18AC4F16D339BAE67CE7D4BF93854919083F15223101AE3F48E95B4F92DD3BE85A80583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343132, "uuid": "cf411a33-327f-4f9a-8769-23a31e7f11ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343132, "uuid": "43429c7e-bb77-4b7e-bb9f-388697fd0287", "value": "12288:bEpO29Vm7Fru4efOhizn2MJT6YashlM0JT6YashlMCDvoP:4pXm704Tho2I9ashlV9ashlr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343132, "uuid": "18d59fd9-2757-45c9-9638-683e4410e6d6", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343132, "uuid": "9572b1d4-d287-49a5-acd0-52fabcc17c2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343132, "uuid": "cbae1623-c885-48ca-aeb8-18bd0a6d0241", "value": "e78a8c49a3846c8224702bdfe143d6b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde7966e-252d-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633363893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363893, "uuid": "2a094871-d476-48fc-ae32-f735976e2b37", "comment": "Malware payload (Smoke Loader)", "value": "d3546ba4a1fefb0a7f478e9af1493bec", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363893, "uuid": "c95eaeaf-a97a-45a0-839a-9785157e3dc2", "comment": "Malware payload (Smoke Loader)", "value": "90a2edd5280d702618114ba0a6822edbd249f3e3b02bcf31d977fca3d958582d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363893, "uuid": "665027ea-d03f-4308-aea9-72d94f16e566", "comment": "Malware payload (Smoke Loader)", "value": "ba5ec1494db7421467205d5a171878153639c701", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363893, "uuid": "5f34c87c-d648-4be6-b6c1-f50b198e81d2", "comment": "Malware payload (Smoke Loader)", "value": "ba6e9b68568553fdb81f8f402ed5ca4a5aadb50d39a965fd833c9fcc7b4b8e30b241a7b53c675edce9a8952c77714729", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363893, "uuid": "566fcc5a-1f2a-441b-81d8-4e7d466e3de2", "value": "T1C544BE0939C4D7F2E6760571A7A6C7F04E2DBC6D2D66524FE798372E9E3C3D182A1202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363893, "uuid": "baee3ec3-130d-4c18-9c23-58168cd5abe9", "value": "00e4a9909e1dd2f9b23ab751bea778c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363893, "uuid": "bc341469-d569-4cdd-9efb-7649214b54cf", "value": "6144:VJPf8Suz1YUgz8vnI9LUqROhxxpeTr/ekI:bfDuhC81zxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363893, "uuid": "7362559e-afaf-48a2-8788-aa511b55b364", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363893, "uuid": "fe10accd-4a9a-4038-8007-5571b4831aa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363893, "uuid": "069a98e4-92a2-440b-9734-a14721763a23", "value": "d3546ba4a1fefb0a7f478e9af1493bec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b1e840-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633348224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348224, "uuid": "362ff37b-5d5a-4bd2-96e8-ca309e06510b", "comment": "Malware payload (RemcosRAT)", "value": "530ed7ba1cd9425cc5bf2a8be3727305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348224, "uuid": "d0dd77fc-8341-4c6f-8174-b8c4e3b98bb1", "comment": "Malware payload (RemcosRAT)", "value": "90e9c971939cb7168124cf0fb865d1166e6218608ccfeea19bd507b6df20bb5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348224, "uuid": "cbe37d25-d236-4bb5-b6cc-f5c0ccef3b1a", "comment": "Malware payload (RemcosRAT)", "value": "af70062e4eccecd69e4e836607c5c3ae4c0d76ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348224, "uuid": "63a9e7ce-54dd-4605-bcf8-80706d7243f9", "comment": "Malware payload (RemcosRAT)", "value": "d936ea23e78b5bae823872c3ba66e18dc13598ae8308b0b03c28fb8c06459acbd8add740a8f4cdee35ba4f94a862e031", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348224, "uuid": "624c0a37-e3fe-408e-8252-5a912fd76331", "value": "T14A056C63A340597EE3330BBCCCCDB291B41ABE4139949D4B55F67E0EB9A68C079441EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348224, "uuid": "6d52bb29-6f6c-402f-a8e4-4c060cb30ed9", "value": "206016043cadf3442135e07afc507bba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348224, "uuid": "6f9677d9-6c6b-4515-9e80-1517879a21e6", "value": "12288:b71aIFXG0LBXveSLxZrJuGmxXQUTcQvPPRKUmQgMM4/YGu1q:bs6RL9veYLrJlIrTtnALHGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348224, "uuid": "72b3b0af-ef83-4298-b3ab-714fc3670add", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348224, "uuid": "16ec63a3-e0df-4f3d-b9b7-5779d297bac5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348224, "uuid": "3ecab6a6-f366-4714-a4df-70b9f2db5d77", "value": "BOSS NL DRINGENDE LISTENBESTELLUNG,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf61e3b-24c9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633321020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633321020, "uuid": "d23d8062-739e-45ea-bff2-fbbd0eef107e", "comment": "Malware payload (AgentTesla)", "value": "b3d8c1bfd2a6eb14db84eb4e88be99da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633321020, "uuid": "22947724-9f68-42f7-8239-38928ebd95d2", "comment": "Malware payload (AgentTesla)", "value": "90f685596a5055af02a893d6874d2a79f3a9a0329be04c362052c88658a2edb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633321020, "uuid": "f0f2cbb9-f61c-465f-b077-9d19ff4be3e7", "comment": "Malware payload (AgentTesla)", "value": "79a18d1b71c42504e8f59ec08f7b20971b2eaf12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633321020, "uuid": "2e9766c4-ed57-4aac-8fbe-85984390d65a", "comment": "Malware payload (AgentTesla)", "value": "63a47c5cba10ff4cf37f278ca4a18dedc7a98c3a042b43b2e2e9b5082207a0b9187a71c0f8a5bc23c785398d29486b5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633321020, "uuid": "f77af34d-8573-4a87-af35-0b30a339723f", "value": "T1F0D4F1AD23AB9900FDBB47F5787591908BB1B8171416C73C9F9428ED0D637E48AE0B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633321020, "uuid": "2c2a7066-3601-4d10-bba3-2f542e6ad48b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633321020, "uuid": "b970042d-55dd-4a09-965d-b8ccd940de62", "value": "12288:ZfoVljQMCAdtoX/CQjM1lnNLwoZfZa3190+ANJp932JT6YashlM0JT6YashlM:9sNCAdOX/rM1lnNlo190nd3S9ashlV9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633321020, "uuid": "aa756432-7af8-4ebe-8181-718375d22f5e", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633321020, "uuid": "81ced4d0-d7e2-4284-af3d-3f5e8ab95c6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633321020, "uuid": "107f6e71-232f-4d76-afea-afa03ac2234d", "value": "PO321456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a46902c-24f5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633339539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339539, "uuid": "16469022-a408-4d8e-b184-6b52b25abc6a", "comment": "Malware payload (AgentTesla)", "value": "d879ef5d250d2f5f77cf26ed3ca69506", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339539, "uuid": "d2170a49-afe9-47dd-ab39-31d1d2a93916", "comment": "Malware payload (AgentTesla)", "value": "9112bf6322a7832bbf2197b9c4f7a43ccf70519619965f0d38ee11e417850328", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339539, "uuid": "3d5ce69c-c1a8-4bdd-a1eb-629dd051d5dd", "comment": "Malware payload (AgentTesla)", "value": "d3f0f943d0c15c9c5975f726af3976dfdc794ca7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339539, "uuid": "d16f937f-e222-4f47-8749-215b3af14b70", "comment": "Malware payload (AgentTesla)", "value": "e5a4c6c8d69b9b3e96f877ec81a3269bb9ebf2042290cb75f0969ab79bfb1bb1e3dd1423230a1d047f921346486d0274", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339539, "uuid": "ca8d6b12-eec5-4eda-ba1f-70c5f887b17c", "value": "T10F84AF91F285DCA6E8471DB6487BCC3150A7BA6C9874891E514E772A1EF334320AFE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339539, "uuid": "a8fd12aa-4915-428b-977e-e7328a45af68", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339539, "uuid": "b006d665-b579-4e21-a36d-a207122156e8", "value": "6144:18LxBOeARnoXQswh/3R+bfspKESVgIIIuRpYAn4Zkqmrzivaf32pA:LeARoXQ95+TFEbIIIcdn4ZAivFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339539, "uuid": "b6a0812b-e4f4-494e-87a4-b3b26633f1e4", "value": 382684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339539, "uuid": "1dce73db-c1d6-4a9d-9a0d-ed0436f324d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339539, "uuid": "dea54788-e822-4668-8c8f-e633810a5a05", "value": "Dhl shipments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ff3580-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633341727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341727, "uuid": "0a00f3eb-ab0b-4768-adb5-b3ffca965a0b", "comment": "Malware payload (Mirai)", "value": "d82d9c4bb802b06b929edbdb8d54cd42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341727, "uuid": "354d0e1d-6a32-4b14-a163-6fbc736bb1a7", "comment": "Malware payload (Mirai)", "value": "9165027874f27166e68a9a50491717e4f900d49a91895b12b7845eceacb344a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341727, "uuid": "f7ead6d5-354b-4483-83b8-a02a44f849d0", "comment": "Malware payload (Mirai)", "value": "983903e3c3d5542cafad0bc7dec48710fae2a3df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341727, "uuid": "832f2d2b-9533-465b-b089-165d9a4803d5", "comment": "Malware payload (Mirai)", "value": "94d053a9d8aaf11cdd19a47523ae86d999d6b29d95b8c270f61e2a99e57f9f0b592c5075a852305c108530a06ba3c67d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341727, "uuid": "dfeafa61-9217-4ccb-af7b-1edf1ccf6e82", "value": "T16703E1EFE8841FD0D8DD1C3CC36A0BB79C695882340FD74D2319A992A67BC4262D94F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341727, "uuid": "3e7a78ff-8fa2-494a-90a0-4e99a29b0143", "value": "768:OPaRBc/7DClgXjejCbxiaJwtN0fRmiwpkywJylGi7CWM3:O+yClgzeIxLAMmi3PkGi72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341727, "uuid": "cebcd2ca-6c8e-4546-912b-96baaab7991d", "value": 38064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341727, "uuid": "69328127-e541-4e00-8b3d-63a4eeefd495", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341727, "uuid": "66b9ad67-dc2c-4b44-bc5b-630f383b34fc", "value": "d82d9c4bb802b06b929edbdb8d54cd42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b60d7c8-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633335407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335407, "uuid": "91ea0b22-c7ab-432a-b9ec-7f20c0acc397", "comment": "Malware payload", "value": "c0e935ffaa4ee7aae271710e073f8c2f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335407, "uuid": "77129459-355e-4ca4-aaac-f3de3d76ae15", "comment": "Malware payload", "value": "925c6e6f3af8fcb1f3431aaa2fb29d460bdaa3f1648a126b6883d95cd6f24fd4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335407, "uuid": "a4ec0f66-cc01-4444-a2e6-91145d882077", "comment": "Malware payload", "value": "1a57cd7c4c04798a2d9d48d5cb3b72132178c8fa", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335407, "uuid": "9426047f-c63c-4c95-a3e6-e524880607dc", "comment": "Malware payload", "value": "76fd3336bb550697c1994368ff9aa87b07c3823779e3d400afe9af83157a42ef9343bc30ee87c5c1a243ed4041344699", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335407, "uuid": "e22e72fd-6c3e-4d45-9416-16cd957deb38", "value": "T1CB757D12F2D24437D1732A3C9D6BA764A8397D112E38694B7BE82D4C5F396813E293C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335407, "uuid": "3daabe06-a4c3-43dd-9728-6577db3772b1", "value": "24576:+x/i3Jk0tuW5Ap8fzPw4XX8J9/PD9D1UtBp/UGO6YZMDTU+uzqe5OYrEA:+x6yDyPX8J9/L1ZUTPuZOYrEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335407, "uuid": "85787fbf-0c3b-44cf-ac12-ec986058abe2", "value": 1654784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335407, "uuid": "a0b91401-da0b-4ea8-a34c-269a6d740c1c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335407, "uuid": "b097ee5c-f78b-4e56-ac89-5530846e8efc", "value": "owxsbfecwjsjbcbkgkdimgxfagicynqwa.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144e2da9-2528-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633361461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361461, "uuid": "e6eff185-af66-492c-b6d1-e60f03be8d79", "comment": "Malware payload (Mirai)", "value": "05a9974d269eac62b0b990cdfd4a9784", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361461, "uuid": "8912cb07-f343-4bcf-80b4-4a8ba3cb1902", "comment": "Malware payload (Mirai)", "value": "92e9a55d00f2b364ab9c851b04dc8dfedf5c9d44c252cbfdd5e1481739b3d514", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361461, "uuid": "e12f40a1-8afc-4553-9766-5954de4e79a9", "comment": "Malware payload (Mirai)", "value": "34ed55d881bf26850085950cfaf8bea0635b26e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361461, "uuid": "bc393ec8-2e34-4ee0-a7ca-18d238c933d1", "comment": "Malware payload (Mirai)", "value": "503c31ef9064c27eb9b756166780613769678513727ef4075ae09badffebf73f09a105e703d30143d96c2a535986012b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361461, "uuid": "c78afec4-1aab-478e-a6cd-501524c55cb0", "value": "T1A5044C46EA818E03C0D7277AB69F014A3332A764D3DB73069D18AFB43F8675E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361461, "uuid": "0e8e0a14-b164-4e46-8589-6ff5e52fea17", "value": "3072:H722Jy/fZtDCnK+Mnv19Qai08bZqwBhN1217n3llHVH9LuM/9aeRKri:H72kyXZtunK+MvbQai08bZqMhATllHVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633361461, "uuid": "ab1fa76f-00db-4094-9aea-1c524908e775", "value": 184488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633361461, "uuid": "beec7853-f10c-4cee-8967-049a5dd8aa72", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361461, "uuid": "3fde1ccd-9c7f-4152-af68-bdc11316779b", "value": "arm7-20211004-1530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d24c184-2526-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633360697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360697, "uuid": "f6a1fe4b-7835-472c-9651-bf299ecf1398", "comment": "Malware payload", "value": "7b91fb6a2af857aad3c3cb5894107501", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360697, "uuid": "2ae478d2-87c1-44f1-bbe7-1a0f81991ec7", "comment": "Malware payload", "value": "934dbd56d0ed4e35844abfab11af453f81bd91571a3dcf75046f8b5c778c0441", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360697, "uuid": "f57765a1-fef4-46e0-bea1-547e1928e9b4", "comment": "Malware payload", "value": "dd5350efaecacb3c4c249bf58acc4bfe637dbf3e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360697, "uuid": "df825b6d-7ee7-4bab-8ac2-9183f72bcbc1", "comment": "Malware payload", "value": "625a5a3101bae890205f8f5781cad2e1531a3bff6d77bcf27ae9533730932f60f64aef881292eefa4379fa9bdb1dbc34", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360697, "uuid": "1e1cc497-060e-41f5-bb34-fd269e718fae", "value": "T1C4F4F6549E8E0813B7B4F6BF906904E2CE82E7F1CF58443AE1B4169D4E9B11373C7A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360697, "uuid": "822cb396-2a3f-4df3-9c78-eac0c102555e", "value": "768:dRFd4hbwmEUIy2HcOUIy/YSmiYRcDYSmiY85YVi+UhYfYpRfUvjaNae2YkYMzQYU:bmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360697, "uuid": "076d44f1-9d6d-4f53-8a8d-99cd5b674539", "value": 726366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360697, "uuid": "0f705cd6-0517-45a1-8558-d8e446513206", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360697, "uuid": "fe8bb265-1f19-4a1c-b2b3-b983ecf329a8", "value": "WindowsSystemUpdate.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bb1e0c-2513-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633352816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352816, "uuid": "39898e31-6c93-4e5e-b45a-88faccc617b6", "comment": "Malware payload (SnakeKeylogger)", "value": "0980b6fcca0018e0aa84f9b7a2c23ee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352816, "uuid": "f69b7d12-f132-487e-b68d-b7019dbacde9", "comment": "Malware payload (SnakeKeylogger)", "value": "93789f73943029eb9f31a99014bd2bc3d0453394d16f94a09f7cc4caf0966e94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352816, "uuid": "2533bd7a-03bf-4cf7-a682-066bacb4df0e", "comment": "Malware payload (SnakeKeylogger)", "value": "117e2f26a5b199ee9f63e01cc90a91f7e5ccfe28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352816, "uuid": "7f8ac5db-8739-433f-a4ae-db4b66b3f870", "comment": "Malware payload (SnakeKeylogger)", "value": "9f7cac660e192b8f703f197a784ba2f549397c3338ebff17d8a0c456374a023e8fbe41b71a9c4caef4387429924fd973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352816, "uuid": "a99dc349-d549-47fc-87e4-7fdf22d36320", "value": "T1ABF49DC13D47D89BF4DF2AB3986FC12011656E8D9161C73D2692BA2B55F331230ABE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352816, "uuid": "8f28335a-55b9-463d-bd24-07e97d729aea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352816, "uuid": "1578fe52-119d-4c86-9ba0-41f975766ff9", "value": "12288:05MTd5IeJPsmtiK5oyZEz4Mb/XYDBNi62uw9yjLWel8:AZ+FobXUbSfQyw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352816, "uuid": "ed00c122-4873-40c9-a64d-1e7717152109", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352816, "uuid": "39952455-f895-4098-931e-1f13f8e399a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352816, "uuid": "fd8411ae-f776-4420-9f47-9b3a649f5adb", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c8ca3b-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633342079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342079, "uuid": "868d258d-d0d3-482b-a40d-45c930fe926f", "comment": "Malware payload (Gafgyt)", "value": "7fef53c6eea95cef083555ffb6d40cce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342079, "uuid": "85098b23-3217-4297-8aae-595d32ed2292", "comment": "Malware payload (Gafgyt)", "value": "93f7ec4e10084acf6922dd5451f3428cdc9f958780c317ac2001d91689de5618", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342079, "uuid": "48b95391-d928-4372-8150-d361653be69f", "comment": "Malware payload (Gafgyt)", "value": "0345c1ecd5f9744b9f6a0925c4326bfc9fa08a3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342079, "uuid": "f62182ca-e279-43a0-9961-8469c1ebf192", "comment": "Malware payload (Gafgyt)", "value": "cc225cfb3d8d556f18c05be0bf8011c46dfbfc8af11b24b236065a2918ec1de612a488aba3933fc637c6a12b1657e6ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342079, "uuid": "6801f93b-e487-4dd5-a527-ee48a931b402", "value": "T17D9319B81995F37CE9F150B9E84310DA28610A1C379CD1E379C3547AFFB8B087269E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342079, "uuid": "05144586-343d-48f0-be05-fbeb288a3e0e", "value": "1536:lQHPNhpOTtsHT/WUXHaCw9iqLgaRW9yVlqN/W1cBZv+16whk:GH1hpOuHTd6CwwiY9ymN/WUZm16w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342079, "uuid": "46cb4ba8-516c-4154-821c-2dcf61549064", "value": 91588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342079, "uuid": "7e370373-5553-441f-b675-deeeca508de8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342079, "uuid": "ac1b61c4-ba27-40eb-aa5b-9070f1989e65", "value": "7fef53c6eea95cef083555ffb6d40cce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10553777-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633352864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352864, "uuid": "6459aee5-e7f4-4d62-a339-f94f95d5b61d", "comment": "Malware payload (GuLoader)", "value": "f3ac47838b4542df2e6e905b703c3f90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352864, "uuid": "c454b367-4ca8-44f3-9706-52a0c5150dda", "comment": "Malware payload (GuLoader)", "value": "94562bb510c9af666f0424ed8aa1767d17d18b79e8fad585b8d5857ec0eb4fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352864, "uuid": "b6fc1dcd-a2e5-42fb-9022-fff51c7c583d", "comment": "Malware payload (GuLoader)", "value": "6fdccda8c54dd05bb7da9c08498838974d3ae289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352864, "uuid": "fff9dba4-5aa4-406e-b276-62c18554b48b", "comment": "Malware payload (GuLoader)", "value": "4c50d89dce6618e5d902b46b5279ae47d386a0a92043511320233ff930cc1b615e3cac0d72d4033883437b6e7e084b6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352864, "uuid": "8b6b4e6a-3b15-4b90-a631-d72f89dfaab9", "value": "T108A3D271E990DBF9F850C6FDB776F4F605E2AC32D88219072148BF0A75F61CA11E1A4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352864, "uuid": "0266d78b-0770-4b6e-8422-893b33cad008", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352864, "uuid": "731feb1e-e388-4f3f-9096-029a2daa3987", "value": "1536:tkq8OIKvckVXgZSD1/4JWDeiCvGhPDoW03MCq1T:tHLvc8gZSDh4JZvGh8vl8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352864, "uuid": "5b6eb847-6157-4dc6-bf50-9b77372d4022", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352864, "uuid": "46fb45ae-7d47-468a-b054-8e405f6bccc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352864, "uuid": "081019d2-7696-4027-a398-f3f8e57f9dbf", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be7243b-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633347917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347917, "uuid": "6e22510e-f922-47f8-a471-e5d6dfc25b1a", "comment": "Malware payload (AgentTesla)", "value": "28bc7ed05e702e83b745b4abbf6989c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347917, "uuid": "14521a7f-d1da-4db0-9afe-60c9aaa9b2d5", "comment": "Malware payload (AgentTesla)", "value": "9488ab8a18f97b39ad2c02d4f99afb17dd638134068bd88b768e74c2b1e520dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347917, "uuid": "760006c6-b732-448c-817f-7e625a0e3817", "comment": "Malware payload (AgentTesla)", "value": "97685a2db49351dac3320da4f7dc493c893024eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347917, "uuid": "351b21f4-32f6-445a-b763-924c197cfd2c", "comment": "Malware payload (AgentTesla)", "value": "38ccd255004bb31d9a2637d2eebb14ca8862bd4292935a319fd6e6dac5e1d108f5c0ff1947542cd3f8778347fa2b9dbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347917, "uuid": "6d8c4cd7-c6dc-42c3-b485-3749896cfa5c", "value": "T1957423343413D787EF5314BEE16484831B83FEE2B222B2969749B6CA5D3ADB4095D473", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347917, "uuid": "c941330c-bd6a-40fb-bb96-121848919242", "value": "6144:NTfgUZG8sAJLLoFwP9x9kjWxa1KXesGGkXhRV7mp0etQkQJU2wkA0EAP7kC/MVI7:5fgj+LcwjWWxaQXkjX7V6pJtAwkVP4I7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347917, "uuid": "2c3636da-70e0-46f8-9f10-9a4c4d447a00", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347917, "uuid": "3c6e46e2-2c03-4995-9b55-e0c1c7cc5379", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347917, "uuid": "21556dd2-b368-4f88-819a-3a54ff6fc73f", "value": "SteelTrading PO-5579.xlsx.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39d1fa6-24ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633308524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308524, "uuid": "40611dd3-5867-4d5b-9818-3a65ddfef630", "comment": "Malware payload (Gafgyt)", "value": "1f6b29d1861c7e89d78f5e0bb51cd5ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308524, "uuid": "7ab5946f-b347-47ee-ac2e-8d71f449fab8", "comment": "Malware payload (Gafgyt)", "value": "95d5e533c4d3a1f4ecc982f06621727fb72e523e02f6f073bb6a396ff54f8e91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308524, "uuid": "5bc120a6-46d6-408d-a96a-b53b067c486e", "comment": "Malware payload (Gafgyt)", "value": "ab694ef001bfd8e59ba37a46d2699f1a748cfe37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308524, "uuid": "4ff59d47-74be-4353-82bd-98518446b66c", "comment": "Malware payload (Gafgyt)", "value": "737d414cfe06d34e651532d4f324c285b9e98b950302872cff2071892bd9523976da2070e511ce523b925b5305670893", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308524, "uuid": "f6fcc346-4915-4e62-a1db-b6e5fe5b965d", "value": "T147933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308524, "uuid": "63f606b1-bff7-4c01-a4ec-64c0a2ab127c", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+84l4umXxVqDrstKfz9e:Q97vk51RcG7Ayl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308524, "uuid": "d1d4cfbd-d1ff-496a-ae30-2c06ac9b6a76", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308524, "uuid": "dd9ffd81-72cd-461d-91ef-5cce02004b18", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308524, "uuid": "cf825e3f-937a-4c2f-a0b5-e5dee0573768", "value": "1f6b29d1861c7e89d78f5e0bb51cd5ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2941c4-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633343354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343354, "uuid": "04f31903-1318-4f47-ba1d-263fa0247e1d", "comment": "Malware payload (Smoke Loader)", "value": "84812324de986196e8552ababd02d909", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343354, "uuid": "963a6605-94d7-4203-8f4f-00419232175f", "comment": "Malware payload (Smoke Loader)", "value": "9673a34f01eed437cbd5c59c83a09835da02cb9d852ea5f4279e8f78198d75a9", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343354, "uuid": "e425cf21-df61-4f2a-a534-d0f97b541a6c", "comment": "Malware payload (Smoke Loader)", "value": "22869f5e47ae227209934fad4e042c28c37a54fb", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343354, "uuid": "24165651-7bf0-44d2-abb6-46aa179c1eb3", "comment": "Malware payload (Smoke Loader)", "value": "67e5547887c9594acfdac4e1248aa4a21eab28bdad2d187a4d9904ccf746752813ced25097595f89228aeea8dcbb253c", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343354, "uuid": "79bd93f9-9056-4223-acb5-42f3809c711e", "value": "T12244AD0831C0CBF3E6760275BB56CBF4066DFC6D5D6A564F2B89271E6E3D3D28A21242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343354, "uuid": "8c693260-2f7e-40f9-97e1-f3f50cf29640", "value": "7c0ea9b9018530ea377f1e33dcfa32b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343354, "uuid": "97db8318-135b-428b-801f-0d63f39f264c", "value": "6144:Qv3tVfQLTk6Xupdz/VeLoC8qe4F+ROhxxpeTr/ekI:qtuk6XupVVpqzFrzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343354, "uuid": "7f393a4c-66e1-47a3-85dd-b9709f76d718", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343354, "uuid": "cfb3dc3f-ed48-4562-b9dc-7386d924f0b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343354, "uuid": "94714a1d-def5-4668-ae11-4a1e0a39e9c6", "value": "84812324de986196e8552ababd02d909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81342f78-2520-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633358207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358207, "uuid": "c69a8db9-659e-43c2-a29c-ef925693e1a4", "comment": "Malware payload (Loki)", "value": "9bf7feae409cf0f13a226f48f440d18a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358207, "uuid": "a6263058-89ea-49a2-b53d-270b2b64a080", "comment": "Malware payload (Loki)", "value": "96bf6fa59f5e9f7ab817fd0c2ed49b9e6d4d011cc7884f4961865edd3d80570c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358207, "uuid": "ff4e231c-f38b-4672-861c-9496c6e89300", "comment": "Malware payload (Loki)", "value": "91c05f26be62738f4d8e97c6d0ba9bb03fb36a89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358207, "uuid": "032acd26-fd87-4ce3-af58-7d8ced3e6918", "comment": "Malware payload (Loki)", "value": "7e690875b030431331b54c129a98c5a3b697930aa3071de13de56332728492ed27784d865cd2950e7c8eb50c478ae064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358207, "uuid": "62438d15-7440-4c2f-9fe4-e211895b4594", "value": "T132A45A243BAB5019F172AA797AD3ECF2D56ABF622E02545B10D03F4776239C1CEC152E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358207, "uuid": "1bee3a15-35c2-420a-b5df-3ed52ee17718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358207, "uuid": "fdf6928a-e8c1-46a6-9470-aade4b677ce5", "value": "12288:kFWHCM2K4CZLx7a3FXoOKmVwz9SZIHCJP45:w3CZyFXOZz9SZIHCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633358207, "uuid": "30c7115b-e143-462d-9250-c4a43bf0b2bd", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633358207, "uuid": "c82e6cd5-80dd-4abd-8f6b-960ebfeffa53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358207, "uuid": "d8af6dd6-9355-445b-9083-caf4d920acf1", "value": "Richiesta di offerta 15\u00b709\u00b72021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b63d4f8-2554-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633380370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633380370, "uuid": "6fc4bd29-7376-4f9f-b854-adb72eed25b8", "comment": "Malware payload (RedLineStealer)", "value": "93d63abe062aa55a7ad4b06303003513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633380370, "uuid": "e8bae158-8363-4e91-8d25-702c4685dc8f", "comment": "Malware payload (RedLineStealer)", "value": "97ee5e1d402d8ae42f720953e145fcbe08555ac0db2dcf64edf0c49b740b5991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633380370, "uuid": "70ff768e-923c-4b3e-a753-39e937ac30d0", "comment": "Malware payload (RedLineStealer)", "value": "486ba0311d5b62961d3fd6f15c335b3be6546588", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633380370, "uuid": "5090a6c0-7cb9-4418-9787-ae8cce5aec33", "comment": "Malware payload (RedLineStealer)", "value": "955279202cee16c444b596b6041a1e2f9c82031ed72318964f622031dc3a4150c5d0b1c66c65b6df0627e74b5b940533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633380370, "uuid": "2795a9c9-6236-403a-8e08-64f9361fa4ca", "value": "T19084CF517291CFF1EB664A716821CBA4873BBC7E7920954B3790761FDE392E2C622306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633380370, "uuid": "0407a41e-109e-49d1-b6d6-293cad47ae0a", "value": "8edc63b1e502813168c877f42e306db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633380370, "uuid": "e80a2dee-71cf-4021-a1e6-f1bb65006af4", "value": "6144:6puEpvkUzCPScWbEuDCHn+HJN6JujgWC4Sn0zl1xpDJw:GpvkUzMWDmLHpvn0B1xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633380370, "uuid": "143b6c4f-81c2-4496-96f8-56fb81b17f24", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633380370, "uuid": "cbe6d56b-36f4-47b0-bdc8-de73b6433b54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633380370, "uuid": "be418fc9-1dff-4a17-9ac9-10e1eca21d10", "value": "93d63abe062aa55a7ad4b06303003513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fdc10f-2515-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633353620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353620, "uuid": "51c6f8bb-02d5-4775-8c50-434b0413e729", "comment": "Malware payload (AgentTesla)", "value": "b5b4e7d4f10a4864bff585c2a97ae219", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353620, "uuid": "8647edef-fa63-4476-948f-721fcb88b5ea", "comment": "Malware payload (AgentTesla)", "value": "9801c5cc156b573e2a8c9c7efb7e0bdaf62fd6956659dda3e7f500260fd50111", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353620, "uuid": "f70502fc-c791-43d4-acce-93de1f3bc9a9", "comment": "Malware payload (AgentTesla)", "value": "66546f21a161d165dcd8c17b513d63aad65f4ae7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353620, "uuid": "81736ae9-68ce-4152-a18f-41e9002e708a", "comment": "Malware payload (AgentTesla)", "value": "13cebba637834a8746a9371eeec768a411c628587425b5d55c1ece9c61b4bf8657926516bd8e23149a18abb699ba1101", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353620, "uuid": "47e8070b-c0a0-48e1-9bd3-87fc8f9bc8a3", "value": "T1E6254A0CB3A94394D5FE1A30D2B0857629F7A665D92F93ED2400555F1FDABC2F8023BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353620, "uuid": "1f7b8bf5-20a3-41cd-bb3b-e601d3f256ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353620, "uuid": "8ece680c-f9b2-4001-b60c-632377d8905a", "value": "12288:G7/NbrSMEUzWYzTPdxB/gecNU2zqX6lUB2Ake1F:yVEUKUjdx2DNgWUB2Ake", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353620, "uuid": "b2ae762d-312d-480a-9055-0450aec450c2", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353620, "uuid": "a5df76a2-a691-4e5d-979f-ab14e5753116", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353620, "uuid": "d90df225-7c6e-40f9-9f6c-5836d61c30f5", "value": "new order NO000274666500 dated 20211709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c173f43-24d9-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633327570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327570, "uuid": "195faf21-6232-4d64-b633-4f612c4a7f80", "comment": "Malware payload (RemcosRAT)", "value": "fc11ac8ba36dfa7e896dd65f9dbb5eb0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327570, "uuid": "0bf5fc5a-f81a-4637-9c00-139f6bb15cb9", "comment": "Malware payload (RemcosRAT)", "value": "9a50c056a96999f841ea1ef7bb6674da47579f5cafe02e295c75e980b36219a9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327570, "uuid": "605eac1c-3d04-404b-ad2b-1cb2085c2996", "comment": "Malware payload (RemcosRAT)", "value": "cdfdd0fcec5dadacd248dce62b7dab57dc56d2aa", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327570, "uuid": "83936f8a-ed30-4f3e-ab9c-0a3e1fb8fea6", "comment": "Malware payload (RemcosRAT)", "value": "f8faa1314248313a6a7c4f7c78f585851d5c5ffc25d66fb86a4345d673932bd708b13dc9dc4055af7d1c60359f0773f6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327570, "uuid": "21f14553-23ac-4524-99e8-ccab29a34f80", "value": "T1FAB26820E4434DB707DB9E694EC2A3625AF603CA545A054FB748BFBC008ABCA6DC51F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327570, "uuid": "a4767f4b-ffb8-4738-a548-254d4aab20cf", "value": "24:9n9pXuQJzRlzh/J1eSO4SHSRS6USuSCSMzP2KDchVMb7FQgcC:17zlzf1ezP2KYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327570, "uuid": "c015c7d8-1eea-4a2a-bc65-16100f6dca22", "value": 24885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327570, "uuid": "961a1d0e-a760-4348-83de-e9d70f3d285d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327570, "uuid": "038cf447-5c83-44f4-9cfa-f9e754d5d6cf", "value": "Doc. no. MTSMEXP-30012021.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e7306e-2515-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633353682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353682, "uuid": "1a30184c-debe-4d4d-8dfc-fb2e2a1421c8", "comment": "Malware payload", "value": "e47e65c99ce34d110b11f6d6d8bd8cec", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353682, "uuid": "0721fcd7-8a71-43d6-b804-95de2fceb5f6", "comment": "Malware payload", "value": "9a7cbef792c85067a900b522e9340eda90beb69754134f0fb78aa295f5ad35f0", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353682, "uuid": "dbd02d9b-c482-408f-aca6-8a8438751702", "comment": "Malware payload", "value": "d53768c7a35d8316c1def4f309c08b3b0c32f89e", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353682, "uuid": "a01323fc-a594-497e-ac5b-335fadc79fb4", "comment": "Malware payload", "value": "385e7d38d0aa89260839a784486014526e238d037d825ae222a230af7b5ab590ba7a5a62cacc2413bd4740341ba47d22", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353682, "uuid": "16d31c6b-f9b7-4f14-b2ca-5e2df9b4e34d", "value": "T1B651A61AED4AD1589FBA235BFD8BDA62FE1B801C9E731044B2ECC219570480D5A6CF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353682, "uuid": "60c5f3fc-4fae-43f4-9ae5-1f6af424edf5", "value": "48:Av47lELuD4jvUKmc4TQ0QW9H3iPq7JjBKUfWiTPkPl9x9Ytl3EJFqq74pYrl4i:j2hre1/0QJP2ZmlUDqIrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353682, "uuid": "5fd254d2-2f95-4ea6-8ed8-d761f3a2af62", "value": 2898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353682, "uuid": "2ab168d0-d41f-4744-a967-9a2b88c77232", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353682, "uuid": "cdbceb4b-f83a-4290-a03e-1d7e3ae4fdaa", "value": "8mNWjEvj.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a881aced-2543-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633373306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373306, "uuid": "9ba31b9b-d40b-4740-a285-e13db789a587", "comment": "Malware payload (Loki)", "value": "c208dc846cb784a780a5e0904fa565e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373306, "uuid": "edc4070c-89df-4b02-8fc1-fdb2eaf40b1e", "comment": "Malware payload (Loki)", "value": "9ad51ecb3971298b78eba210bdbcf5c6cf8ffaa27c7a4754f4023553c4c7661f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373306, "uuid": "0e5e698f-97d0-4166-82bb-044a2b2175ab", "comment": "Malware payload (Loki)", "value": "a48fb4a33ede6822ffeb8c9ebd9ca57134e6856a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373306, "uuid": "79658ba5-8449-4cdd-b1a3-cd6f2fad9add", "comment": "Malware payload (Loki)", "value": "58f3a343dd21b04427329167109668a64c5acbcb8e447c4f6234724b24054bb6c7036f41e0669c057ee73cd10d177d0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373306, "uuid": "26f7b6f5-8ffb-4d46-b81c-ef0a917b0a61", "value": "T1F3A32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373306, "uuid": "bf480942-0c7f-4c16-800b-f7a99d1e08a5", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373306, "uuid": "d9032f2c-e865-45dd-97be-e72c919377a5", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633373306, "uuid": "90bbb994-961b-4bd0-baa4-cb7a5d50a556", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633373306, "uuid": "815deab9-f94a-4894-93b5-e93e6eb46e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373306, "uuid": "abbeb3ed-40c9-4bc2-a90b-dae984987b32", "value": "c208dc846cb784a780a5e0904fa565e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a46c18f-24da-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633327943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327943, "uuid": "3f54cda5-2cb6-41ad-a954-74a6936ae867", "comment": "Malware payload (RedLineStealer)", "value": "b4d7cf0c84aa8bfc6f1fa2147291bdf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327943, "uuid": "8a75bbfd-e9c2-4bef-a212-0318efe53f7a", "comment": "Malware payload (RedLineStealer)", "value": "9adaddce663b4bea46de89ba6a98315467990af64508236d40e5026f400d256b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327943, "uuid": "d9e0d522-3a0b-4bd8-9453-8b3b72169265", "comment": "Malware payload (RedLineStealer)", "value": "7928f16623f85c18114a8fbe66100ee44f47ad0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327943, "uuid": "3c6217aa-a08b-46b7-9517-afd926be2b8f", "comment": "Malware payload (RedLineStealer)", "value": "cf5fea217892c8a0f46e22e4b9665378a7784f748bec6ed5886e1f35573347ba1738655c0d31efcb47d41007189980b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327943, "uuid": "838ec1ce-fc65-4407-b5a6-4013ea22205e", "value": "T152D238267790C5D8E2E58D728CD7EC6046F0F9634442E76A72D03B5F2E33B87E616286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327943, "uuid": "f910ea1e-fc2b-45db-8623-0b8d899f927a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327943, "uuid": "b1b62a08-733f-4984-b6ed-4ea508595608", "value": "384:TgRjx9lLIJSMVdD9c+A4mGbJNKZYJArdI5N056z+/+KDQckRKDVbJapdKDGPGAPC:TW3TqDS1GbfxJei0r90PGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327943, "uuid": "204ced47-88c4-4e68-945a-bda4a064f59f", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327943, "uuid": "d16cbf84-2c6a-4d2c-8455-1842a21fd5a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327943, "uuid": "cf9ccb09-ebc2-4f3d-a987-b2b9662c3115", "value": "C8587548778347643AT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7ef489-24ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633308245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308245, "uuid": "5ed239cf-7da0-43a6-baf2-f5c28a7b94ba", "comment": "Malware payload (Mirai)", "value": "01849028340fb8d46c6d0d5498af090e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308245, "uuid": "744bac1a-cd22-4c02-80d8-847d3fcb468b", "comment": "Malware payload (Mirai)", "value": "9b05f4ffc408bfce3d1e64746609a77dcc08ffd9643e9a7ad83ab2c02ae7d676", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308245, "uuid": "a2862275-86fb-4baa-a854-74d66bea3029", "comment": "Malware payload (Mirai)", "value": "0a32ddb480f7288e48c24854f11f460d5c2d97b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308245, "uuid": "e0288634-2767-4804-8a9e-9eca9d4c27dd", "comment": "Malware payload (Mirai)", "value": "de79450c7340aad7ab9e0e40f5ae00c03625bf6377a24c6512d2275a369d70f97c785839630a221eff07c9d286486fda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308245, "uuid": "2f5e7ae0-e2d4-4ffe-b933-192616639537", "value": "T163C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308245, "uuid": "3aa9a0df-e5d0-475f-8ae2-01f759a7af88", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqU5M7+mm/QMurB1PCGNb:SMQpl65Rmm/QMurB1PCGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308245, "uuid": "c51ad21d-51ba-4644-9a95-2b5ba35a321c", "value": 129855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308245, "uuid": "2379b97a-0530-4703-b3be-5c8b77b6131e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308245, "uuid": "42848073-ebac-470e-b0a1-687791700700", "value": "01849028340fb8d46c6d0d5498af090e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd03672-24af-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633309638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309638, "uuid": "de7ea3d6-c6e9-4611-b26f-c345bd8ec99a", "comment": "Malware payload (Gafgyt)", "value": "fef4e6718e894db4f5ad603506d1ebf8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309638, "uuid": "9f81ba76-ca91-435d-bd64-2120bde19a2b", "comment": "Malware payload (Gafgyt)", "value": "9b098ad9191a62d5f7614ee038df2df2cc2e756cfff0c80114b0641a382c9d5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309638, "uuid": "3fe3e141-5963-4d5c-80e5-1c1ad05e023d", "comment": "Malware payload (Gafgyt)", "value": "80070dcf3ec8f313e82e1988db13fe947b6c9863", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309638, "uuid": "27674fba-dd44-4ef9-b547-1e47ea0769ba", "comment": "Malware payload (Gafgyt)", "value": "0f6cf5a26dd7454c8ea0e7ea74fc2b7b22db131a4ecbf360b26659cef5256a0bdc78b47ea6e59cfac8b690656a1f6c37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309638, "uuid": "b7e25ef4-21a9-4766-820c-d72819998f9c", "value": "T1C1833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309638, "uuid": "0b9e3f2e-ab64-4f03-90a9-1d53b9e6d1a3", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCEdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JrBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633309638, "uuid": "42319b39-7bfb-4303-8d3c-c44ddee902f8", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633309638, "uuid": "6d83b8ca-b244-485f-b032-531e3e468889", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309638, "uuid": "6f58f717-553c-400d-8da6-6d23c2963df0", "value": "fef4e6718e894db4f5ad603506d1ebf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86458f06-2511-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633351773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351773, "uuid": "fb3e871a-a6b4-4d74-a8d6-6a8916b7eef5", "comment": "Malware payload (AsyncRAT)", "value": "4589e8f916643c5d21b413d5ddaa0105", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351773, "uuid": "9b38581f-ed4b-4dd4-87f6-a6f7ab9745e4", "comment": "Malware payload (AsyncRAT)", "value": "9b41bf8f85747590a77dcb1f08634cc250eec349b6b3f25d640fb4cf0c69713f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351773, "uuid": "eb517b85-47d0-47ff-af99-6446630e5aa9", "comment": "Malware payload (AsyncRAT)", "value": "9632ee7d485059e9fe8bbc70ba55a7b45427d530", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351773, "uuid": "5406562b-0f33-4223-9ced-bff55c27a0f4", "comment": "Malware payload (AsyncRAT)", "value": "a14fd1c90a826093d0ce99ebc0cfe32afe908590abad938be1e212058a702296d24839e419b4d76f0efc28e40315c441", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351773, "uuid": "e21a190f-22e6-4c46-8b32-7e022ceab9d7", "value": "T195944E7C256E5E4CF79094BCB1758EFF23A2B82F45A774F3901CE1D70AA9BD05902226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351773, "uuid": "cc60466d-80f5-41b5-a126-8f5853959f9f", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351773, "uuid": "09b7000d-1c2e-4bef-81b3-a5ee09586c21", "value": "3072:pwAM4NjvB4vMdq5hs5Uz/nVu4wLT+4aHBgMwYX7aVKiEgjeSTsxCatgfVapBXt:pc4vq5hs5I/nc4w0oVKiEgKaratgMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633351773, "uuid": "07b64d4f-466f-4845-a3c5-e1014818b8dd", "value": 427400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633351773, "uuid": "10b6424e-3332-413a-b4e7-0302769c6485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351773, "uuid": "582502a0-a4cd-40cb-941c-21fa48a3cd2c", "value": "4589e8f916643c5d21b413d5ddaa0105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cd14cc-24ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633309385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309385, "uuid": "322d2f66-d6b2-4834-a76a-dbdf1e26d058", "comment": "Malware payload (Mirai)", "value": "0b9dfb28777c574a50d4f8f5710b4a65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309385, "uuid": "47a008c9-3d7a-481a-ba54-d9ef256e15d8", "comment": "Malware payload (Mirai)", "value": "9b8f24014f4644c2e4ff9990529d7a66b20cba64c9f5a3bf681b08c8fce77025", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309385, "uuid": "bbd35203-e689-4676-a91b-2b3a872af7bf", "comment": "Malware payload (Mirai)", "value": "8841a192badc34b93dbdb52e6719a0752a09b39f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309385, "uuid": "0529b2b5-a282-404d-a9d2-597aa12726fe", "comment": "Malware payload (Mirai)", "value": "13bab5939955197d17cd86986d9d69b6eecd9277b65b4fda03524613ca154cd68012c11707392c0495277a2ae727f54d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309385, "uuid": "d7308ec1-7cae-46b8-8d91-f4f8963fd62e", "value": "T1CBB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309385, "uuid": "79829d90-6ed6-4192-9b6d-301112941f27", "value": "3072:Ydg8GIbDvGIk1MG8+mjypvKgiJmm/QcuLB1P6DNb:YuFIHGIk1MHypy/Jmm/QcuLB1P6DNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633309385, "uuid": "cc79db89-d525-4682-86ea-e50e8fcc86ff", "value": 118089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633309385, "uuid": "af09be88-f18b-443e-bfab-4bd4df9f75ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309385, "uuid": "26da0e0f-89b7-48a6-86a6-0f6cacae5151", "value": "0b9dfb28777c574a50d4f8f5710b4a65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa85d9ac-252b-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1633363135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363135, "uuid": "bcfda703-91e6-42e6-957a-54d1424f303c", "comment": "Malware payload (XpertRAT)", "value": "5028df0da2732dc8528ca9b7d7e41be5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363135, "uuid": "63cdf832-bfb2-4ac0-ae1c-2633e04fa7a5", "comment": "Malware payload (XpertRAT)", "value": "9bd273556358606717f3d0e7d4a2521dba396d6838d8dfccb78bfc5c98590b84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363135, "uuid": "ac2d5b37-6f29-464a-93e2-322fceb0d2d5", "comment": "Malware payload (XpertRAT)", "value": "462a178ab8063511109a91e11d44443485edd49d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363135, "uuid": "ad2f8e82-a678-4daa-bb90-bc0383998c2c", "comment": "Malware payload (XpertRAT)", "value": "0fcd06624e87b293f9250bb17f0c5e052c2167f9a96c5ae56b50e9ddcb408bcdce4be98a55e1790f70a169f03c7b8a65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363135, "uuid": "b3156851-65c4-4434-8800-c3f82ade69dc", "value": "T184927DE5B3909E95E5D647F7FD33DB800BB4923A8412CA6F148C53AA7D93701CB22716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363135, "uuid": "b5de651e-8681-450a-ac78-a0de756afee1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363135, "uuid": "891f9f23-849b-4cb4-849c-662d446b1e66", "value": "384:/8Imr3BwrGM+015Wb0ZciRjd4ph09D0KY63JElnT0UUKN7KV:/C3TM+u5WbYd4glJqNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363135, "uuid": "e5b1d3f7-b996-4327-8265-a09b7520c0c3", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363135, "uuid": "9aaeb19a-e6f3-4579-b8b4-5563904f0d50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363135, "uuid": "7fa5a624-6ab5-4688-9776-fa3b6fca81fc", "value": "5028df0da2732dc8528ca9b7d7e41be5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72df068b-252b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633362908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362908, "uuid": "a9e3c6ef-fc7a-467c-bb1d-03adeb6631b6", "comment": "Malware payload (Formbook)", "value": "98a4496b6ba500b3bf0a4df0dc48f79c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362908, "uuid": "f49ceea7-4e31-44d3-9810-e8abbccf3b25", "comment": "Malware payload (Formbook)", "value": "9c36e836116772df22669a1d5e2af11e49cd8425e730b457f5d6979ca6d00dae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362908, "uuid": "fed0ed07-db91-4fc8-b82e-fe2b13736ab3", "comment": "Malware payload (Formbook)", "value": "cd91a828fec3d162ab64e6720c67187c2345f238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362908, "uuid": "aa6f4a99-e427-4155-a661-f104e1789841", "comment": "Malware payload (Formbook)", "value": "68121efba54a8bcc6e91c8f5dca8ec2dcb97027817732ce280f40dd27bd48eac136735dda25d9f25190cebb9e7852864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362908, "uuid": "62371a53-e196-4c12-8939-068faee90f70", "value": "T100441266A0E4CDB7D2D25BB30E727AB9E3BE411041127A0B83943D1B7D56EE54E023A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362908, "uuid": "7acfde30-e31a-46bf-b521-c656ffa7302c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362908, "uuid": "36c6a5ba-58ca-4f87-9d2b-8375d4751a27", "value": "6144:F8LxBsijXd92QqOH+0RpV+4rrz/xXajfw3:/EDtH7p/rrz/xXEw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633362908, "uuid": "3db25b6f-d9db-462b-a0a4-43f76f423032", "value": 263200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633362908, "uuid": "c20ababd-efc9-4697-8024-25d8df05131b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362908, "uuid": "ce5cb93a-2eb5-4d0a-ac01-2e31c8cc15ed", "value": "N \u00b0 5501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c81bbf2-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633339194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339194, "uuid": "15942f81-5486-4ee7-bf8f-d43256719bd0", "comment": "Malware payload", "value": "f8b9ae776115173b617128b333f2a04a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339194, "uuid": "57fd5b79-b509-4970-b7d9-daf467201ed2", "comment": "Malware payload", "value": "9c8dcf18fa56fd44ff9235c6fb9e71ace8459203e66508f9e0521788704c0564", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339194, "uuid": "8bfb1477-da4e-4164-8fd9-dd315eef238d", "comment": "Malware payload", "value": "90f80f1219a8b8b26536e71c45bcdbfb7d3f29de", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339194, "uuid": "f667bf19-86b7-463c-a142-641608cf69ee", "comment": "Malware payload", "value": "ec6757d0466f6557b0f6d148c6e3181fd0daed70a2a06484bad93ce4517163f488e5b8d8faa0fad23b041c08c9f9b731", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339194, "uuid": "73cff8c3-b20c-4fe1-ab57-8392b45d1ac9", "value": "T127110979D00519C30BA2B064D7DD21E69C3AFBF966EE98C06605B4DF117C192095F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339194, "uuid": "0f5dc222-27ac-4861-a68d-95ef73f31ca6", "value": "24:8TTTTTTTTTjf9MigvY/w8LTTTTTTTTTjf9MigvY/wgb:8TTTTTTTTTjf9zgvY/waTTTTTTTTTjfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339194, "uuid": "76c07ba9-9fe4-4dcd-9a79-2a7b3527f691", "value": 879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339194, "uuid": "a5709b07-ea86-4a0c-962f-b276320062c7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339194, "uuid": "6e3b5260-0ef5-42c1-b8ab-c97a14d78efd", "value": "State-ment(03.10.2021)VMEK.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f9f091-2515-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633353649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353649, "uuid": "f929e281-7757-472b-9d08-6b0cb9cd32c9", "comment": "Malware payload (RedLineStealer)", "value": "0d134b11ca6036be989e83dbfbce9883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353649, "uuid": "4eb28e1e-f326-4a0b-8f77-5820cac4748e", "comment": "Malware payload (RedLineStealer)", "value": "9c8f4d831f6910182d977a01e9d41f72eea613b261ee2e367406593a3e779556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353649, "uuid": "f39fd37e-fcb2-491c-bfd6-47085b895305", "comment": "Malware payload (RedLineStealer)", "value": "d8836ba6d93582f1fb736090f2e2ea8c64e41148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353649, "uuid": "07807c27-9f1e-41a6-9c5a-45019e48b321", "comment": "Malware payload (RedLineStealer)", "value": "577279a681934521c92ef7533b2d106d0dc388be6a37d48c54b65259ef334440daefa1c8c819c1f2812cb7884055dcc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353649, "uuid": "f9c30d3d-b39c-4bd9-ae62-bfb511bee82f", "value": "T16315B738ED0A21B7EBAAD334E4BA150AA5F418BB33349D5EC592774D090770374DA3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353649, "uuid": "1fad091c-c24e-47b9-9b2a-1e793d99fd49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353649, "uuid": "379575cc-6b44-40bf-b885-bbcf66414a6f", "value": "6144:I3+d3hdnXjtHutHxRf2gKD8KoH6OkJCkab8owcWV0DDMejZVtyYz3FkiWGDmNPY2:FV0DD9lfvRkTTrH70V3Y+VLu/8PxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353649, "uuid": "e63c039b-52cb-46a7-9a27-4b3ed577a8de", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353649, "uuid": "99ed2667-60ad-41d2-a2ed-fe6beed18d20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353649, "uuid": "b0a63c02-28fd-4533-b916-3ee49b16ac61", "value": "Invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec649204-252a-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633362682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362682, "uuid": "6e2442fe-2b22-44e0-874c-9a75d4f5ed49", "comment": "Malware payload (NanoCore)", "value": "733f6ee28a0087e631d4ae59a98aa412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362682, "uuid": "fb31ef23-d314-413d-8c54-d7125aa223d6", "comment": "Malware payload (NanoCore)", "value": "9dd6f3bdb3d91aa6b8c57ec59ac107f499a1e7cdad2465f60fede02bb60fba88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362682, "uuid": "8a146e63-53b0-40e5-aa5e-ca5daf8089d7", "comment": "Malware payload (NanoCore)", "value": "c26378061e30b109daa26fbb145dc5197fa3ba5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362682, "uuid": "76aa663e-9cff-4a3c-bdaa-b4da7d34e3ee", "comment": "Malware payload (NanoCore)", "value": "ceda7b34908d13631f4edcd0fd812e65fd8902aeee908f293139567651335749e64034d368c4955b2f8ab1241c930f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362682, "uuid": "b663dba6-7a8d-4a80-b53d-fd845ada24e6", "value": "T1E6F4D060B743D61BCE754BF028EDA640533AAF111659C32E3885BBBC2D737741A8C9DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362682, "uuid": "5729d055-68f7-4dc4-a495-d9d0a54790a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362682, "uuid": "e2747baf-8cd6-45f7-ab85-f4df159e4b94", "value": "6144:jFLFWVQ+3HwOExxuTbvtQuY2+os1Xtiu5lQkeN40GLm491esfUzsrHRd:/oXTbvtQun+d19lQkeN45398s8eH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633362682, "uuid": "ab29cd4a-cd0e-490c-a724-127585ec711c", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633362682, "uuid": "f3ade561-a341-4d8f-b6fd-e4ef9a46c754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362682, "uuid": "2d7b0b4c-6dce-4e78-8ca6-d14f22ceb20e", "value": "Scan0005936148.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d442f012-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633360924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360924, "uuid": "f7ce742a-a809-496e-8629-59d459d472bb", "comment": "Malware payload (Mirai)", "value": "fe146174ba7cfcc8b12c9557baa5ff4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360924, "uuid": "4ca6d2f2-d259-4554-bd46-b85b0b3e4143", "comment": "Malware payload (Mirai)", "value": "9dff3fa435fe7b5b2a5f3c10df8ddd4370861b19920b4e73e291a3a171bf3a26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360924, "uuid": "4c9bec8e-ac54-4a0a-bfda-afe6806cfbe8", "comment": "Malware payload (Mirai)", "value": "5ea3635facec07d5db0a136ee93666e6535f15ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360924, "uuid": "cdcc5578-b072-4fc4-9d8b-af37612508bf", "comment": "Malware payload (Mirai)", "value": "38b47f1b0c4886462277ce3aaca318b2c3ca9646a14f273e76488398cf21bc947f4cbdf02ebcdc93f5cc7dfd748b5f23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360924, "uuid": "78818636-726d-4586-af8a-40357263e667", "value": "T17BB39D9BF74B5651C86287F00BCB4BED3E2323119F67C9E7AD0E263949391CE4A06391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360924, "uuid": "5c26aca4-cd30-4e2e-a2d9-b4f63bc2ae11", "value": "1536:d1naGG0U5aCqYrdw23yaeT3u486cGia8gb/LW+:dFaGG0fClu8yaap86cGia8gbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360924, "uuid": "114708ff-1c35-4f2c-a374-49ad63d8d8fd", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360924, "uuid": "7632ff4e-180f-49ea-bfcc-2e00d01a8804", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360924, "uuid": "7f174e03-8c47-4d83-bb48-a3d977ec838a", "value": "fe146174ba7cfcc8b12c9557baa5ff4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73dbfe2-2502-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633345520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345520, "uuid": "ee675ca6-e329-421f-8c79-2b6633763734", "comment": "Malware payload (AgentTesla)", "value": "885de087b91a90b7d5eebae414a068d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345520, "uuid": "c856f50b-67fc-49b5-bc32-f107b1a35c74", "comment": "Malware payload (AgentTesla)", "value": "9e02c6fd13a8d6a59803ea116534bfe7829c795608a953d76cf182a904372e9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345520, "uuid": "2a66bc35-fab1-43e7-aef8-1b40fdeea199", "comment": "Malware payload (AgentTesla)", "value": "b9226be10fd9f8f9b86c2d15dd7cd5c2fa57c7b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345520, "uuid": "159e5bd8-ba30-4582-89c9-4a306cd3ab43", "comment": "Malware payload (AgentTesla)", "value": "903c10a16b5359957e8aa36af5968e27cfc63ee3bce3b2414399f0b2e86d8445d074871be6e6295e244bf676989f8c23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345520, "uuid": "9784b9b7-99d9-4c5d-ad93-c85faa67ba4b", "value": "T153B4BE242DFE5029F173AFBA9AE475969A9FB7233703E85D145003874723F80DE9193A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345520, "uuid": "258e843c-8ede-4d20-875a-17947ac49665", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345520, "uuid": "c849d860-b29b-4b02-883d-d42f502926fd", "value": "12288:/Vk4DbF53e0IUFLiy7gaSYi9T6vFAs5juYU53cDaxskxY:1v66tAIju6+xzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345520, "uuid": "a5a1e156-fb76-4f0e-a202-8a5a6f63df32", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345520, "uuid": "09efb99c-a559-417d-a9c9-e1d7f311e607", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345520, "uuid": "4e0745bc-41ec-481d-933d-f4292ee84329", "value": "Purchase Order PO-1254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14655aed-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633341704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341704, "uuid": "9c3c7e99-0cbc-4c40-b04c-5538a7388e48", "comment": "Malware payload (Gafgyt)", "value": "1a8f88ac9be3e1ac639b1846066978e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341704, "uuid": "ccb8c06f-1f07-450f-b299-1725f240716b", "comment": "Malware payload (Gafgyt)", "value": "9e2ce9b15496b110a6a4a691d1b85c42e27706fe2dd2af4ba0ea5fabe2aa3137", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341704, "uuid": "b190a81a-173a-43b4-9966-9949cea03305", "comment": "Malware payload (Gafgyt)", "value": "fd53df97004f10e7de89e7db0961cc8db4d90cb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341704, "uuid": "0b70f5e6-baa4-42fa-b633-0fc0ceef06a0", "comment": "Malware payload (Gafgyt)", "value": "92e8770e9b7a6580f6bbf70d24ce6cfad6fb9f05f02131bc4dd2f779c87a3a9ae71102e87b6e2254bdc560c8035021a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341704, "uuid": "75dbd6fa-6263-447f-86e8-ebd07fa2f8b1", "value": "T1BDF2E27197E261C5C67E113928263E1C88A3971FC714A2739FDD282785FAF321B296D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341704, "uuid": "6803ac04-7f28-4bf8-a86c-28b1842f87ca", "value": "768:oJ0zhfy/monj/s0YmgRCIRzGBdmDacK7UCdkczBxgk6nbcuyD7Ufyqj:oahYDn7s0YHGSDar7vkc16Fnouy8qqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341704, "uuid": "6cd959cc-f8ea-45dc-9f66-635241f14a4c", "value": 36476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341704, "uuid": "8c5ff72d-4fc2-4456-a616-9d54f6c21db4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341704, "uuid": "df6671fe-8fc3-4d82-add9-46a97ea0c6d7", "value": "1a8f88ac9be3e1ac639b1846066978e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1571f5c0-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633338699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338699, "uuid": "2ab1b422-4244-4a82-8821-b05905a87658", "comment": "Malware payload (NanoCore)", "value": "862fd7c997b5bd3331a69cbab1ae5939", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338699, "uuid": "4e9be0d6-48bb-49a4-9655-34bcdfbeacc0", "comment": "Malware payload (NanoCore)", "value": "9e6db3d6b3de6d91d3f45aefbdf0d17cfcdb634d92941795fa713e84b75a42f8", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338699, "uuid": "73bf8986-f261-4498-8e6d-6c24fc88982a", "comment": "Malware payload (NanoCore)", "value": "44bc99aa38e1ce0360da691a6361179c59dcf536", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338699, "uuid": "f0c2341a-ecab-478d-90a5-2638566b08e1", "comment": "Malware payload (NanoCore)", "value": "b0fca6310e7ed243223d56f6993776688eca0cea75103d50d35d51ffdedc331aac207747bbce8c319ee2aa3a3ba76a9d", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338699, "uuid": "279d3e74-5b79-4dbd-b657-1a89e6af04b7", "value": "T1106412687353A72FDB5695F69ED0A52A25E6FF3C612C3EB27858BA38313DB2140C4071", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338699, "uuid": "6f5e1bec-b73e-403f-a9b0-72e9120920c3", "value": "6144:z7Hlxk4Fe8PGv9aB5wQkgiE1CADtIVDOSX2S/ks78BVxw2HU4Mk9+cH:/lw8+v9a3wTgiahtIVSSX2EGG2Jom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338699, "uuid": "2cff1b3c-462a-4b17-91de-eb2a1ef80d82", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338699, "uuid": "6fbca435-4aa7-4dfb-90c0-2ffc4a2b8372", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338699, "uuid": "f338a47c-a855-4f02-b887-0a1242f543c8", "value": "Payment Requisition October 4.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c44e31-24ee-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1633336745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336745, "uuid": "c630ae0a-6941-4eb2-8c57-aed089a623f7", "comment": "Malware payload (NetWire)", "value": "14925819afe594fd71f2b4999a71e8fa", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336745, "uuid": "9a5040ba-c595-4ba8-a1bf-66d201682904", "comment": "Malware payload (NetWire)", "value": "9efc0aec4d264375125ea4d1a43bec1120178fe73221609db5bb5a900e77aae7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336745, "uuid": "e4c0a79f-da3f-40c6-859b-a3b1b43459e9", "comment": "Malware payload (NetWire)", "value": "b773320c17ddc2b3ed1b0cfabd126bc4815c1c2b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633336745, "uuid": "ad228bd4-4036-400b-9848-f894da140114", "comment": "Malware payload (NetWire)", "value": "da4ac0bd62f34d2d18f73b5a0057ef204626916b914d881445b320fb2de68a3bc3313df4da16882fad9a2ff0e8055591", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336745, "uuid": "2e3a83df-bbca-4b6b-ad39-94d7a71092a4", "value": "T19E05061221405B6DF5123735EC4705A4ABD5AA3E2E018B77F1A8179B4B6F381BEE183F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336745, "uuid": "8baa7044-823e-49d8-bfb4-26913030ac46", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336745, "uuid": "2554effb-9898-41ea-8a42-b4475b9bb7e4", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyNbYAycjL7YiEFXXXB:Naeq3gF1Sf+WIy6AyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633336745, "uuid": "115ca508-723b-4d6b-9311-875f8ef9f524", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633336745, "uuid": "5dc81cf6-8bb4-4e6d-b646-6deb2374a2ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633336745, "uuid": "609252c8-f32e-4e71-99f2-707902b9130f", "value": "DOCUMENT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45281177-24f7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633340497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340497, "uuid": "a18e974d-42c7-49da-97e1-5efe1c5ede33", "comment": "Malware payload (RedLineStealer)", "value": "cc332ccb5bb6d7e9c42d16baf8a9d61c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340497, "uuid": "903c7327-6d33-444e-bd57-e05b0d15822b", "comment": "Malware payload (RedLineStealer)", "value": "9f3823a99a60878260c9f7784d5aad74fb1126e0540104df3b36248387da25af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340497, "uuid": "828957f2-798e-4c9b-84bb-f700c62e614b", "comment": "Malware payload (RedLineStealer)", "value": "6725512e821eff5fd5fc25c037c33c3c7dc9a99e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340497, "uuid": "6b6cc93e-5b48-4c7a-be16-7e7d64e715ff", "comment": "Malware payload (RedLineStealer)", "value": "d883d95f0caa6db3340dff904265fec7b214534dd6f78cf13a02f0d54423d43083b90d5ce89116774456662d185243b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340497, "uuid": "39e24e34-460b-403f-a581-46a1e853fa43", "value": "T14315BF0963AC9B0EC6BF87FAB05351181776ED4B3E0DD6059EC230E91E75BB14A429CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340497, "uuid": "9fd28511-47ca-4007-b5da-b17ad03661b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340497, "uuid": "e5e0306d-d416-43a5-a3e3-4e351cfaeb47", "value": "12288:d3tA08aqa2yUDa3jKk7MDA46WTmQxhfd6bX+I+oqb+g5l8ao9+b+LgvfbTU5BnM9:CZIFeHbVSrsuu3wiTXpgj/F+VF+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633340497, "uuid": "cb8d0edd-baee-4a6b-ba7b-8bc2b01aa148", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633340497, "uuid": "5810cf5c-050b-4d09-a95e-01be71d0c093", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340497, "uuid": "4b792fc3-644c-4a1e-b13a-05f2130f7617", "value": "file data_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83db5a6-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633343294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343294, "uuid": "3095c77f-d52d-4045-bb72-ed452be42f64", "comment": "Malware payload (RaccoonStealer)", "value": "5f966e0bf752c6a90870742618cee4b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343294, "uuid": "3cbc6cbe-6845-4f42-8363-d31d1b73cf90", "comment": "Malware payload (RaccoonStealer)", "value": "9fbc2a32b58c53043d6697e93642837cd2b6ab5571794149736741a4ed208a9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343294, "uuid": "93901160-2bb8-4d94-bf2c-a40e160533c6", "comment": "Malware payload (RaccoonStealer)", "value": "9e963964c885f943053f8996e3ec796588d04c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343294, "uuid": "620de567-4167-4791-ad6a-b8289b8d06cd", "comment": "Malware payload (RaccoonStealer)", "value": "1124ddb79c99df0cf5e7b89efca76b11b92aaec534d12d9cc5757b5ba1e6b0f3cae8ae9d8eda2711cae9b918c3a3c4df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343294, "uuid": "aa0c79c9-ad62-4d90-9bb8-22b904daec5c", "value": "T1C5C4F00834A1D7B6D2F405B16766C7F4056FBC6C5C26568F3788276E7E39382A72E243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343294, "uuid": "5b1970c7-b3b1-49c7-95aa-fa0716e92984", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343294, "uuid": "f682f65c-a356-4f29-940e-140dacfdfe75", "value": "12288:8hXoVj3Lnyqr6XosxqMLgYDJe3aqujdYqUrfZ52wyCZzxp6L:8h+DLyqeX5xdg+03ZujdYqNwyC136L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343294, "uuid": "9eba86b3-fc5d-4140-9e40-b4abbadcdcd9", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343294, "uuid": "4d52b131-e34e-4b7b-86a0-558ed5812b8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343294, "uuid": "1d65589a-3185-4e17-8799-309f15d631a7", "value": "5f966e0bf752c6a90870742618cee4b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fd4770-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633339296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339296, "uuid": "bdf1feda-27b4-4d1a-88d8-6f501dabd661", "comment": "Malware payload (AgentTesla)", "value": "d51d52beb74ed6a22c4f924b0fcb17d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339296, "uuid": "4941e4b2-f9f5-4ed4-9a3f-86c19ce76a73", "comment": "Malware payload (AgentTesla)", "value": "9ff77a871f5507199c0fc44b9b827e7f89a1fcc3d8648fc9c834b63f1df76061", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339296, "uuid": "cf3857c3-6ceb-4258-b7d1-017a1763dc43", "comment": "Malware payload (AgentTesla)", "value": "47e44b9a40c418530f84dbab946d37c598fc0efa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339296, "uuid": "91301e3c-0a96-4d2c-86de-009fdb4d95d3", "comment": "Malware payload (AgentTesla)", "value": "3c5ff600798a98b361e0ab56c24fc8ea0724350b8ed62eb713d871df11bd8d5421f7d8df48243ebe7a8c718e3f767851", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339296, "uuid": "860fdaf7-73a4-40f3-99e0-529c4f2daebe", "value": "T168B38D40378DA605D1A91AF084E3D3A503F2DADB6637D75D3E8846E61F817F88D88BC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339296, "uuid": "0d216543-ffad-4ddd-bb26-4759e36b6c4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339296, "uuid": "b09e2e70-71ab-4c96-9fac-09194315f1a6", "value": "1536:/usLLljGUdQy+EIp0aSoxcIv6VjadS0Cy74CT3TrYz6vDpMQ43+41xPNfadF:rckDzRwXveeS0h0CTXYmvFMQ4b1Lfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339296, "uuid": "a887709b-ad82-4634-9c96-db66620c27b4", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339296, "uuid": "53b36056-b0ee-4a45-aa76-c9edd88aa2cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339296, "uuid": "3124ee8a-1261-41cd-9b41-5a428547b714", "value": "TNT Original Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7575614-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633360902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360902, "uuid": "9f17a1c0-690d-4d63-b0de-8d894eb3fd90", "comment": "Malware payload (Mirai)", "value": "241ae3d6ac7bb6887d71eb8c2e15e1a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360902, "uuid": "a3824c32-5990-47cc-9019-27ac2028a242", "comment": "Malware payload (Mirai)", "value": "a00c1cd877b990a01271a55ad9c32e9b8452d3b7106d399bb95036f157820f26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360902, "uuid": "422eb06a-d194-4436-9a84-f1ae77165cf4", "comment": "Malware payload (Mirai)", "value": "5a9215a7cecd58ffec5330b51a31c9004e7075fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360902, "uuid": "787ab0b1-2cfe-491e-97ca-fde9b33f0978", "comment": "Malware payload (Mirai)", "value": "00c620d10d32c1334b7a3a0581741ad9678ac686c5c27de9cae123136f9b0534581c571401bb9598ed793bb6c280d22c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360902, "uuid": "75eafd7f-d017-42f8-b02a-9ce504176798", "value": "T14A63965D2E219FACFFA886344BB35E20924C33E626E1C945E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360902, "uuid": "c4d6a9c6-3c25-4713-ba16-f3c90152fd9a", "value": "1536:58B83DOpSxUzpP+vntvnCEvnNY8QYdMz3mSrkN6XmTOJqmT:qK3DUSq5sUmSrkNomTOJbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360902, "uuid": "c450f96a-aec4-41cf-967a-cabb5461e2a0", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360902, "uuid": "6610cf98-d59c-4b87-ba04-53ddbf375973", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360902, "uuid": "2bef02b4-f8e0-4ba7-98bd-cb867072734a", "value": "241ae3d6ac7bb6887d71eb8c2e15e1a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5aa34e8-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633348390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348390, "uuid": "e41d596c-3d7f-4304-90c5-809d43675e25", "comment": "Malware payload (RemcosRAT)", "value": "213942b6c5059a947d38b427d58f8d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348390, "uuid": "9a8706fe-72a3-43ec-be42-2675b3370c04", "comment": "Malware payload (RemcosRAT)", "value": "a0abb27e5d01bfd0a7b7a1f23bd3145a6fa4a316cfee8a8e101128d482f2c80c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348390, "uuid": "2c97a4b1-bb62-4f9e-b9fc-68ffaa1b1c51", "comment": "Malware payload (RemcosRAT)", "value": "36ceb294782fb1ee762e43c631c1571751377860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348390, "uuid": "f5df5e7f-f6fb-4a55-ba2a-58334bb3d012", "comment": "Malware payload (RemcosRAT)", "value": "6037260003faf98cdf36c442ca2e3da69252421a577fab268f25360d2d685ac51b305b4d0e5e5a0be2d15930a740b33b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348390, "uuid": "dfb7290a-ad54-4490-a2f7-9cc5327633b1", "value": "T1EAE4F19174A8C1D7E5BA0DB2A87BF23420F92D9ED1CE544F3289B76A20B2352405F77D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348390, "uuid": "ee38aa40-8f2a-4671-b027-275daa23f642", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348390, "uuid": "8ecbdc1b-292f-4a84-9080-00e50ba1bcda", "value": "12288:AGlaKpNI+Z09OZqox70j754gfkAuRK5wTvIyvncbqqi:JlppNxS8Y7l3uc5qyq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348390, "uuid": "019de055-8ebd-41d1-b821-e7c9ed0f8268", "value": 674448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348390, "uuid": "6d65f4c8-9089-42cf-8c2e-10bd358ee23f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348390, "uuid": "2c365ca8-ae69-45e5-987e-d253e80340c2", "value": "FOTHERGILL GROUP - Payment_Slip,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bcfa8e-2515-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633353350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353350, "uuid": "e77ee098-f012-43a2-a0cc-f656cbc1bed2", "comment": "Malware payload (RedLineStealer)", "value": "056627e22924798f3909231a045d44e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353350, "uuid": "b14c1cc6-f595-4850-a8b2-7fb4b81ce872", "comment": "Malware payload (RedLineStealer)", "value": "a1b6ca8644c7908a5ee930558144d794e25a5a6a0bea0637396caa161ea04475", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353350, "uuid": "0d80be3d-4296-4f1f-a389-95b056088d56", "comment": "Malware payload (RedLineStealer)", "value": "8f82ea5bdb6e9de01c281642ba2b67028ddd0c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353350, "uuid": "c526578e-2cae-4864-975d-91cb84266dd0", "comment": "Malware payload (RedLineStealer)", "value": "4504d4d03b7f16019d44fd87c253d0ea66f93dc763ffb63bbd231830cf47b406e92b942ff75b4affe66dda5fc8938183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353350, "uuid": "fb210e17-2602-423a-a4bc-c1f546f06a40", "value": "T15F05C0202354C25AE1FBF738D4729471CB3EFA86A03AD95E6DC398DA0D65341851BF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353350, "uuid": "8ce4931e-c9cf-4f26-9bd2-8335a1ffe169", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353350, "uuid": "4b9b5f3a-f4de-4de7-a697-4db55c4ac9c2", "value": "24576:zA6oFu+UcN79a3JqP2b/h9HAOb6I2+Foy:BoFu+5N79UJnh9HBb6I26oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353350, "uuid": "95f20aa5-b7c7-44f2-a27e-b1133d25a345", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353350, "uuid": "e3563bf8-5784-416c-b2c9-2910a32075ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353350, "uuid": "468ae934-ffad-428e-b187-cffe7bb7dbbd", "value": "INVOICE.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193e5ff3-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633338706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338706, "uuid": "4533a4bb-70d7-4ff9-995d-7015ad954866", "comment": "Malware payload (Formbook)", "value": "cc8aa2f9ac0a59de457347286fed38f4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338706, "uuid": "5cebd07d-00b6-46a4-a31c-95b9a8301d8a", "comment": "Malware payload (Formbook)", "value": "a1b81702005bc0c0008777f10049624e5f882c367bac528f82a8895d2a3f1b29", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338706, "uuid": "2e5f9332-26cc-437e-a4f2-b65f4af9e038", "comment": "Malware payload (Formbook)", "value": "e08c061c1616f0c5820b19b0ef48db32deba4a63", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338706, "uuid": "d80532c5-1547-410d-b6c4-cd5e727af285", "comment": "Malware payload (Formbook)", "value": "3187977bf56e5b722eb38b0d88f5b480fde246d4f990bd345cce3965aac22b7f912914f695b60df93fc5061e5c2ab477", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338706, "uuid": "cc99b8ed-d434-4853-ac05-625c2d7964a0", "value": "T1C893E03126A60814E71BCAF716B1C5D479F6AC105E0D8F9D3069B6F85A7FCC016F22AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338706, "uuid": "eb8d68d1-9788-44ed-8443-60290082d863", "value": "1536:wh5BmqaJfyidRWjbDdxSb8e52uzbYuVoSJzlKq0R+E9C9iRAMf50F599DyUBiH6M:wXBDaJfRdYjPd8b8g2uFoCKqLmV50yUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338706, "uuid": "99627f95-9462-4b79-bb0c-a25a288bbf7c", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338706, "uuid": "dbba720f-bca4-4333-b9cb-2e3458c8ff64", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338706, "uuid": "46991201-0431-433f-90b6-ca07beca2cdf", "value": "statement of Apr to Jun.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a172d0a-24f7-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1633340613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340613, "uuid": "e3ede1b2-d410-4dd5-b109-8d64bf80c1bd", "comment": "Malware payload (XpertRAT)", "value": "313e01834a3b9868ecf72e1d42f801d3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340613, "uuid": "d68b5de7-55f4-4f3e-a483-e38262511b45", "comment": "Malware payload (XpertRAT)", "value": "a1d62f934ab413d0e31693103ad75caa80bcd1f4353f1355401dc22dfab607bc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340613, "uuid": "9cc06880-7999-4adb-a0bb-5dda53a3c2b7", "comment": "Malware payload (XpertRAT)", "value": "6d4534e9e492a331a3b164725e20bed8d9c2c920", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340613, "uuid": "973e4b2c-3d65-40d1-ae7e-e27247bf249a", "comment": "Malware payload (XpertRAT)", "value": "75dd26f06063fb450c220b5b819e8cf69d156bebc79301839d997739c953e66650706eeeb15d2742ebc866dd90362f99", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340613, "uuid": "e6a289eb-ace3-4749-9635-b84a842e4cc0", "value": "T1E6C4AFD458DA80A6B98105DDD9C0F44D9820FED1355FDE28C7AECC73AE596F8AEC408B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340613, "uuid": "74c0bd6d-4ba9-4f31-b22d-bd38456aef29", "value": "12288:S////////////////////////////////////Nss/dzFHRsU0:aRsU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633340613, "uuid": "52e99db1-4da2-4e6e-a4f2-2fce2b47e869", "value": 548313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633340613, "uuid": "bcaecf30-15bf-45ff-8d18-56a0ee6db637", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340613, "uuid": "c070e205-5796-4b97-91d9-6fda12da0775", "value": "IMG_PO-000120741.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be805eb-2564-11ec-843c-42010a9c0014", "comment": "Malware payload (1ms0rryMiner)", "timestamp": 1633387297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633387297, "uuid": "02d37573-14b4-41a5-a00d-bdbb51e83d35", "comment": "Malware payload (1ms0rryMiner)", "value": "365083d296e0ecbda12495d03bcb8728", "object_relation": "md5", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633387297, "uuid": "d757ea6c-2db3-4cf1-8776-953122ebc494", "comment": "Malware payload (1ms0rryMiner)", "value": "a1dc7ead6d6684ecfe4b23cd035fbf647e16278ffa31a287f24fe1bb27806a7f", "object_relation": "sha256", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633387297, "uuid": "5e7d472f-ceb3-4295-907b-43a77339402b", "comment": "Malware payload (1ms0rryMiner)", "value": "1442b77721b6258264109eceb73c404176e8fc56", "object_relation": "sha1", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633387297, "uuid": "63dd9d55-33ba-4727-bf92-7dc8f95eb7b1", "comment": "Malware payload (1ms0rryMiner)", "value": "08eb60e71d8f23778c5c61de370b2c163677daac4a3380808233c45365c282f838fa6b9295baee22fdd24a1a0a5b0edc", "object_relation": "sha3-384", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633387297, "uuid": "cc78572b-7487-4072-9c9e-eff91aa1d005", "value": "T116C3C30A9952C518D4A64AB3E562E1F2B8231C6BD6750D131AEDBC2BBB3F055CC3CF49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633387297, "uuid": "c852095d-8a11-4e4f-a590-0f88b594f22f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633387297, "uuid": "101073e9-f338-4143-9b79-f085c23c92cb", "value": "1536:dKGEuCacbpyGNJ+tmbQnQR8RVQJv2kiqXeSqQjUy8:GbIMbQneIoOQqQF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633387297, "uuid": "671123ae-0a2e-4948-a751-ea9c89e0ed09", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633387297, "uuid": "241f911b-ac97-4a55-abd4-007921c22001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633387297, "uuid": "36f4225f-09f2-4dc9-9dcc-d5b4030c6d19", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.4543.20176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42beaf3c-2507-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633347365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347365, "uuid": "bb36ad21-7f84-443e-a673-a2c6f5eb913b", "comment": "Malware payload (AgentTesla)", "value": "3c7707746ff018369119c5489b30a875", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347365, "uuid": "502ced9c-f6fb-4ab7-9f04-a1314731598b", "comment": "Malware payload (AgentTesla)", "value": "a217f5548ae1ac1d83d7ca132c55c17148f764b72d6411d516757cdbde3c0d80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347365, "uuid": "e2f54d04-d5d6-4f1a-8f1a-9ae4fca4725e", "comment": "Malware payload (AgentTesla)", "value": "6536e3278e789de76b8f47d4c00884db28e86754", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347365, "uuid": "eee29100-38b1-4446-9982-fac43ed515d3", "comment": "Malware payload (AgentTesla)", "value": "88ccf3271106679fc25371fe9eeff528159555e60b9f2f8730c548d2808edb0d4f9d4fe7e4cceaddc3464ee46771dbb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347365, "uuid": "6184ab87-cee1-4c31-ad60-529e5a8fd9a6", "value": "T155D4F19D23AB9900FDBF43F5A8B491904BB1B8271412D73C4F9464ED1D637E48AE5B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347365, "uuid": "a26d3a2d-7d37-4c30-b1b9-dc1cbb79576d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347365, "uuid": "2b75d826-c959-4e26-a10e-cdd6d0615dc8", "value": "12288:tro98FB2nxUIMnfpZUgvsMC004P5iMo2WYJT6YashlM0JT6YashlM:1nGxURgg8f4AMo2W09ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347365, "uuid": "6a001401-4c06-4d92-9204-e74e7717610e", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347365, "uuid": "33ce25d9-e483-486a-a6f3-028e43760cfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347365, "uuid": "3a6302d4-b8ff-4940-91a3-fb2427b20cec", "value": "RFQ_99705546,99805546_Mark Cansick & Company.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09935d3-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633348059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348059, "uuid": "0177a668-5e46-4600-bbbf-e4e4068e8782", "comment": "Malware payload (SnakeKeylogger)", "value": "bd0fb9bd82efed26643d421933d02306", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348059, "uuid": "3edd7d18-64c1-49e1-a975-6b0bf5b78d2c", "comment": "Malware payload (SnakeKeylogger)", "value": "a302f2cbec5e8cc21e1a421a628880b71bf933e5ddd5f80f53f30b36fed24f5c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348059, "uuid": "f1f988c5-ec9d-4ad4-bc16-0920955a4051", "comment": "Malware payload (SnakeKeylogger)", "value": "781477acb71ee4c62d287f993d9cf6d49d989db9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348059, "uuid": "387bf240-ab1e-4ea8-b11d-500d6af2c5b2", "comment": "Malware payload (SnakeKeylogger)", "value": "a6082eecd79100cc23acd96d15a0e04c0cc8da8868eb60fbf3c54f6be77764c00ec70b7e48ea7eedc0ec803e81769ee6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348059, "uuid": "f313af89-904d-45a5-b411-52abbbb2c342", "value": "T135542303B2CA97FB0EA59FF6C53E5816A71F86F575B8250DBA35EE571A8482C02C3301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348059, "uuid": "9f26570b-e75f-4692-9290-858365e7d98d", "value": "6144:k6Pnasbe5neOI1aiV79k+FafiUjNkBH/9X0/rL3qn3wmJYIIWDsvgK:Vfalswk79k+yOlX0/rIJagK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348059, "uuid": "cdd726b5-79cc-4cd4-94cf-330106a097ae", "value": 292275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348059, "uuid": "b539ab3b-575c-4c00-ae22-203308d84add", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348059, "uuid": "1991f329-2029-453c-a2c4-55aa32712a0f", "value": "Quotation sheet and Purchase Order #7283645.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c480c89-2509-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633348321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348321, "uuid": "648b3fdf-f5fe-4558-bb64-52be644c99d9", "comment": "Malware payload", "value": "ba4e3dc5249cfd0f468f7e2cacb33469", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348321, "uuid": "ba599316-6f23-471d-9baa-b1720234c07a", "comment": "Malware payload", "value": "a318e56c867c12209aa84d5020965513a05c3e9ef65cd1135e9c9753a189b6ff", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348321, "uuid": "8cc0701e-921c-44e3-8a92-022c311a64e1", "comment": "Malware payload", "value": "5bdec58ab4c7ca389bb0ac0231219f0c7c2ff9d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348321, "uuid": "e3b76a55-1753-4cd7-9051-d4663778182a", "comment": "Malware payload", "value": "8c3a882b7e54ded59ab841db1b140c083193d830f9b7fa2c6038df016a8c8b0b7c4242198795ba2e0b06013ab6a6ebad", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348321, "uuid": "d3b1d2a8-19e3-4eb8-a494-62ebe405e2e2", "value": "T169E37D0269B1AF25F81149B04BD5E6DE151C7CAF6AD1030A785CFB0F3B738EE64AE905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348321, "uuid": "6fe50afa-b31e-4c72-9240-79264786090c", "value": "3072:SSJpzjlDPX5gxkns7soDm8zqXgTOVN5g70l6:ZpjluxkWswm8zYgTOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348321, "uuid": "13189252-6215-4ea4-a01b-fe634d93cc8c", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348321, "uuid": "0558d4c7-b3da-4dfd-b0fc-6ae176ffb603", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348321, "uuid": "58f6989b-39dd-4051-8f21-214f10d7da14", "value": "File_09.22.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e88ce3-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633343237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343237, "uuid": "c9a24744-890c-414b-809e-29377d3cc12b", "comment": "Malware payload (TrickBot)", "value": "4968e11f8ccebb4d10032ae8a9ab8f5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343237, "uuid": "133a9696-42f3-45e4-9a26-01dfbc8685b7", "comment": "Malware payload (TrickBot)", "value": "a46307e0930d4ef8071bcb0a0e2837abfb5ca74f6c767eb06854cfa3f6ee066e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343237, "uuid": "691a1a6a-2bc8-4d86-9483-911d8ca2a09f", "comment": "Malware payload (TrickBot)", "value": "0c3dfe850acbde2e3dcb0376de2a42742c5d3c5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343237, "uuid": "b6c7571d-8100-4f62-8b98-bf954cdeed81", "comment": "Malware payload (TrickBot)", "value": "ad27288c9525aade6a8796a065c99d6a0fa722377039994240c83639cb51723b8fb07726be6d6869354004055ca2de4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343237, "uuid": "4d7ffae2-f682-4d5c-b436-761cbfa4afec", "value": "T1CC94E02236F0D877D16715309FE59BBCBABAF9104F724A4F33880B0E1D31A525A26776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343237, "uuid": "76cef25b-c972-45d1-b1c7-db97339a2ad3", "value": "220580f49c2724e661575b7bf3bd58ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343237, "uuid": "735fa707-a77b-4688-9143-8419065d4d93", "value": "6144:wkdJN4c+ePGcmr1tJ3VQl/XE3dAPr3x7835OPeFPQimA6Vk58qVEb9pE:wkdJLbPYtlCl/XIIx/lbVMlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343237, "uuid": "15d274d7-423e-426a-b55c-6b899cda4f35", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343237, "uuid": "eda15f1a-0dac-49c3-9ff4-1e07ede5cba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343237, "uuid": "d419721a-086a-4d7a-a4d0-93427273020e", "value": "4968e11f8ccebb4d10032ae8a9ab8f5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baebc9d-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633347863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347863, "uuid": "76e5bf1e-741d-4adb-aad6-776831db4a4f", "comment": "Malware payload (AsyncRAT)", "value": "a9eda8efe0588de2175c1c9fd42155e5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347863, "uuid": "e80baea8-517b-4d9a-8e20-221d9be3e585", "comment": "Malware payload (AsyncRAT)", "value": "a4dc28a4d88f3ebed9d958e399e5d01c6b086404132967adec80ac8c9cc9bbcc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347863, "uuid": "5ad1c31d-a02d-486a-9ade-5efdf543816f", "comment": "Malware payload (AsyncRAT)", "value": "88d8e015c535b8e639aa8e512003c8382f3b8ed6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347863, "uuid": "518dcc2f-aa6e-4379-8d4f-18ebffac57d9", "comment": "Malware payload (AsyncRAT)", "value": "2ae8101a65efc19d97e82fa1b719afca5218b652a624701ba95c503785129f45a239b0295eca5a1aa621d50ce5d587eb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347863, "uuid": "358d8e09-06c8-4871-9771-62ea0907c161", "value": "T100A1D6B8639C0886D707C473A555FF6712E3F66B8ACF1E9037ADF6A50B7F2201222641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347863, "uuid": "cb2f6520-3a0a-425b-8238-81c31ca968de", "value": "96:cavfCwFpD+ykIQUmJPXFC08IDWJWRKa32CWwQN8desJC/u+QC:tNqMW9dbRkMWmeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347863, "uuid": "187a387e-2d87-49f8-a494-31097c2a4aac", "value": 4633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347863, "uuid": "4d8f91b1-eceb-4015-a25b-5acc37c633ac", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347863, "uuid": "cf9b241f-7075-4f3b-bd7b-7a6aded036bb", "value": "Audio Inquiry 04.10.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bf9d85-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633360931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360931, "uuid": "f77e9f81-ab15-41e8-ab2d-03dbd527528b", "comment": "Malware payload (Mirai)", "value": "56e7a17aff6c1e3373bdd39ddfe41633", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360931, "uuid": "d45aa5d0-b584-442d-aa03-f63e6db268a5", "comment": "Malware payload (Mirai)", "value": "a4f02eb69bb8f3cf3412af2dd8037929b8c39f60fdd03d91cfd9c4749e4e55fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360931, "uuid": "ad263179-865a-4526-9b91-7e2c92337905", "comment": "Malware payload (Mirai)", "value": "cb4becc2d4d7b156d4fc5c41faa0fe9f0cc68d90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360931, "uuid": "18d3c050-a034-459a-ab93-55b6404ba843", "comment": "Malware payload (Mirai)", "value": "d4d8267798cb6f7ee3e598864f2e8854c2a0de7f618b54775731a82ad82d4073517b6f2884e69ed39755c24a29e444c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360931, "uuid": "02fe425f-e286-4a9a-b5c5-62941bd6112d", "value": "T14CC34D46EB408A03C4D51775BADF424A3323E755E3DB33069918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360931, "uuid": "b0da5ac4-cda1-4777-8120-7378344dc0e0", "value": "3072:zL2SkDxxTeFcVTScCliQFIkV+qLkM/9f+z:zL4DTTeqVTScClvFt+qQM/92z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360931, "uuid": "67e3ed2d-39f6-4700-8d1e-337b6c506789", "value": 125770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360931, "uuid": "82932bb4-9b1d-4f4c-9344-9f022568fda3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360931, "uuid": "03189649-fb9d-45ce-9731-c687a01a6121", "value": "56e7a17aff6c1e3373bdd39ddfe41633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97908c49-2527-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633361251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361251, "uuid": "e6854e54-ac94-44a3-91e1-a078886fc1b3", "comment": "Malware payload (Mirai)", "value": "b71c6b9418e498e56c7021fc6aac5097", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361251, "uuid": "f1ab4dfd-4123-4358-ae53-0ead296f7b27", "comment": "Malware payload (Mirai)", "value": "a4f20b63b0f91b94f549d628fdfbd60744854d9c4376d8e3569941b083b6d6b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361251, "uuid": "b590add3-9d46-477f-8d4d-40682a07018e", "comment": "Malware payload (Mirai)", "value": "b28ad7197f345f06649c4ad630bfa17c85ee3cab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361251, "uuid": "2e2df3f3-4594-48e9-aee9-cf8848f7784c", "comment": "Malware payload (Mirai)", "value": "5c820640b1aa0821dba2596506944b4a9ade27178377383b51b7ff1689b628383757ef9bb19c8e7871b5d7ac35718622", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361251, "uuid": "edc7684f-e231-4130-a01c-887c07e987e2", "value": "T12F133986BC82996AC6D02776B62E108E3321B3E9D1CF3217CD205F1177C9A2F4D37A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361251, "uuid": "b0f340f6-a2c1-4ff8-8c87-cca44cd464b4", "value": "768:tF47/ULgmWGg93AVu/L+1e321pmatr89kw0zS09rfvqoNNX9BNGl:tG88mWT9QViiK21pmaGWwyS09H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633361251, "uuid": "d46d325d-07e1-43a9-9700-4249bdd3cc67", "value": 44148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633361251, "uuid": "cbcf75e7-8415-4808-9a22-3dc87c99ae51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361251, "uuid": "69edafb0-5a2e-4ded-8686-ce396ed37dba", "value": "b71c6b9418e498e56c7021fc6aac5097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42667117-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633348224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348224, "uuid": "373bdbc3-7d16-46db-b829-5ec4cf3b4557", "comment": "Malware payload (Mirai)", "value": "3de4693291bf3104348c1b686acc4a43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348224, "uuid": "352686e2-157a-490d-ae28-89f7a5d64fc5", "comment": "Malware payload (Mirai)", "value": "a5478d848356f01e623209a4134171ba30d8f813c26033d8c9ad46262e6634c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348224, "uuid": "588bfead-984d-4280-a5fb-0a95518ae0e1", "comment": "Malware payload (Mirai)", "value": "d64674bb8531bfcc90c81b563d64a2c61e5e6fad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348224, "uuid": "bf5d9b28-e4da-41cf-b956-2eaaa71e14a9", "comment": "Malware payload (Mirai)", "value": "36dc8ae070b90ba8498c6956da23070d68715f4fdf535cfb7ddb315d97860b607cd124af4de0e174873a3fb0d912602f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348224, "uuid": "73a37f46-7b42-42dd-a9c9-703a0ecedc73", "value": "T183C2E10E031E54DEF821A0762AD44B7825211FF49541AC0B2F6A9CBD8D465ED34E7BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348224, "uuid": "6a9c0729-8bbf-4443-be04-d2a901a89209", "value": "768:05XvWWe02XfRc9kSAHhLvkgykJgGlzDpbuR1JZ:0K02XpfSA9kgycVJun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348224, "uuid": "3edf6cc2-986e-460c-be73-0b1ccd07ef2c", "value": 27728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348224, "uuid": "9d8b652f-74eb-4540-ba3d-1fb69717f7bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348224, "uuid": "4691a0f5-eb47-4f4e-b77d-cdcd5dcf7eba", "value": "3de4693291bf3104348c1b686acc4a43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26881d36-24f0-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1633337439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337439, "uuid": "7e19ad28-f2b6-409f-af79-d8e565e159bf", "comment": "Malware payload (Neshta)", "value": "fd31986696a39355b9e100754b4724e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337439, "uuid": "a1546ad1-6a52-4455-a6a7-7ac98cb8e8cc", "comment": "Malware payload (Neshta)", "value": "a58aca3d20dec5c5f100ade6a9f6182f5f7a783f8269cb032e20780041e44f08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337439, "uuid": "d00081e6-a844-466f-a5a3-6b3b3001af45", "comment": "Malware payload (Neshta)", "value": "4f1045ce5437b5a761c02a1446c0defd89280ddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337439, "uuid": "50dbc3de-bd29-481c-805b-18e6126804f5", "comment": "Malware payload (Neshta)", "value": "75132cbdaa5b2f6d854b02690452ae4c3c5600eba7fe1f079be91878946eba229db34ac8752a750d20c810080bd7bc8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337439, "uuid": "c0fc993c-a6b2-44a7-b4c8-c47062468f51", "value": "T19BA412B8276B235FFD3AC3F42D34218163F5502A1815F7785DCEB4D928627B89AA0D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337439, "uuid": "b54ace1d-1ca8-458a-b66e-86d306e9880f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337439, "uuid": "aa9a7b6c-e076-4440-8257-016ff6565c06", "value": "12288:fdKPgYSAtU5KRjV6J5ByyID7OAMmNQku0mVimPaZMknR0Eb5y:U1SA02jM5ByymVNc0mVigaZrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633337439, "uuid": "c79f8320-55d5-41e2-9799-29eefdc3c479", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633337439, "uuid": "a6cc5fc8-50d1-4c82-af61-0ef5aa3cf1e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337439, "uuid": "bada46db-7e34-4a59-a9b2-a5d04727e5ee", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0195cc71-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633360570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360570, "uuid": "10d5df42-1086-40e6-a8bc-f833fe0dbcf5", "comment": "Malware payload (RaccoonStealer)", "value": "6910d27a10eb129b6c7845d393d73aeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360570, "uuid": "c5757b4a-9b6b-459c-9c44-73e5746b12ec", "comment": "Malware payload (RaccoonStealer)", "value": "a5eb546e1572666d671b3872c3ac967634bb5522b15a58ffabeaf5da524c1d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360570, "uuid": "5c058368-d916-4540-ab16-440fa71ab226", "comment": "Malware payload (RaccoonStealer)", "value": "92b86313a45ee0d238303cea122e313eb4e7d1e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360570, "uuid": "3061d5b5-6a03-47e5-8e88-80bb97aa22cd", "comment": "Malware payload (RaccoonStealer)", "value": "dafab4e472e4dfe1c3471e221f1ba379e3e82497213f1e924529f2c9f840a5e8a218e1219f5412f827599715aca4f70c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360570, "uuid": "0c423fdb-d7a4-455b-88cd-ec037024b75f", "value": "T188C4F10834A1D7F2D6B44A716726C7F10A6DBC3C1D25768F7B94266E6F3D3A19322E02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360570, "uuid": "7024da77-252b-4bf8-b830-e1fc4237c064", "value": "00e4a9909e1dd2f9b23ab751bea778c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360570, "uuid": "5dab327c-cadb-4d93-8871-9d864a0974a8", "value": "6144:445yBM1172vRjMI8H9Zwl8lcCbl6M9dAje2uV+i0jFPtFJjRPnh+zoB+FROhxxp3:JyBM11Kv+YiFl6MTAKrc/FTNPzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360570, "uuid": "cca9995a-b834-466b-b051-4d10527528c2", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360570, "uuid": "815b4b26-d48b-4342-a987-f5694ad2ae8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360570, "uuid": "d07f440e-c995-42e5-98de-3866a0ea85b9", "value": "6910d27a10eb129b6c7845d393d73aeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8737158-24f1-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633338221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338221, "uuid": "46c3ee60-a6ac-4e8c-bb71-f704f31d18b9", "comment": "Malware payload (NanoCore)", "value": "d6f38bbee25e5e959ee5e3c058e251c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338221, "uuid": "f7ab64d3-14fb-4642-b288-33fb2b630d37", "comment": "Malware payload (NanoCore)", "value": "a658919df3185802e1e73f94a5a18e3f42c8c8c7f9f48a11eac0274d4ede6a57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338221, "uuid": "16ec093e-1ed2-4ba3-9e21-f8627bb5e3e1", "comment": "Malware payload (NanoCore)", "value": "867f3438257c48c816c0d47a8e4f471ee4e13cee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338221, "uuid": "865e7253-65c0-4872-9bdb-120f9733ac91", "comment": "Malware payload (NanoCore)", "value": "b14f51f8415d5d18f142b2cef6d9628efa4999868783797bb429362ef9b007a8edfbf5b2a8695c665bb087614276bc45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338221, "uuid": "6b49501a-3412-480c-a020-28044c70bd93", "value": "T15914CF1677E84A2FE2DE86BD60225252837DC2E7A8D3F3CE18D465B64F263E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338221, "uuid": "b7fd036d-8e0e-40b3-83ec-3d04dd5cafc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338221, "uuid": "a4616a81-7647-464d-b601-6acf4d2d45f8", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HISLF+BX+4D9kNh5y/NMCGEWo:gLV6Bta6dtJmakIM5bMJSftpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338221, "uuid": "6483cba7-8db7-48cf-9764-f306f4c6f6d5", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338221, "uuid": "16d923ba-1cc0-4a3a-8c6f-ec1436d8cdf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338221, "uuid": "79929df4-e133-48c5-b62a-f24685737157", "value": "d6f38bbee25e5e959ee5e3c058e251c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd795b1-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633363195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363195, "uuid": "a5e61e97-5aaa-4017-952c-c77ebacc6a5b", "comment": "Malware payload (Smoke Loader)", "value": "fe19ca0e7a58af76deaf8136a332980d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363195, "uuid": "4eb40923-a52b-4af5-a6bb-0705872553e9", "comment": "Malware payload (Smoke Loader)", "value": "a6e58febc0ae0db669343c61e926780b5c6c121aff886c8d5401ac5740025c45", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363195, "uuid": "18e3a5ed-ab3c-43ce-b773-5978a989206c", "comment": "Malware payload (Smoke Loader)", "value": "eb2db73c1d1a491c40b117c2cebda8487459d069", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363195, "uuid": "f67664e8-9dda-4845-882d-2866dc260229", "comment": "Malware payload (Smoke Loader)", "value": "2f7689d753e3f3385a1a585a8bbfacbd63c538615074fede6446a8dbd476d132dad0ae4d2d9849c9c7cdf9a2fa1090f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363195, "uuid": "36fdb192-9fe9-4909-82ce-11239f6dc7f1", "value": "T14C448C193180D7F2E2760570EBA6F7F04B2DBC694E79524F3798272E5E383E28625352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363195, "uuid": "b10fda89-cdbc-455d-8fc1-80768a911209", "value": "00e4a9909e1dd2f9b23ab751bea778c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363195, "uuid": "492e63af-ed86-4aea-801a-dfcf5135c9c6", "value": "6144:b1N1LRuw9+ltBdS/QfoROhxxpeTr/ekI:311u4+ltBd5tzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363195, "uuid": "7a9c95e0-7c27-4d63-b252-83c128cd09fd", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363195, "uuid": "7ae605e5-4f08-433f-b487-8bf588f70b30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363195, "uuid": "563baad1-574a-4966-a212-371a4a5b833d", "value": "fe19ca0e7a58af76deaf8136a332980d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019a431e-2537-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633367872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367872, "uuid": "9376e61b-452d-4e02-87f0-98c428732442", "comment": "Malware payload (GuLoader)", "value": "62130d3d9ff6f161a74e2498b6977b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367872, "uuid": "cfc720ab-ecc1-4d72-9604-0c8bc027125b", "comment": "Malware payload (GuLoader)", "value": "a73af68af80e885c118c828cc782e158a28ad61a2229f737288222a877c51291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367872, "uuid": "4a3e3d6e-f66d-4400-aa7d-f30eb6b9c9c1", "comment": "Malware payload (GuLoader)", "value": "d2ed48788319f61c045a03ba300d0bbf471e9d80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633367872, "uuid": "c4e1c729-4a12-4c3a-baeb-3b22f0986e1e", "comment": "Malware payload (GuLoader)", "value": "b4ac34e2335d0ed01a808c5e31265a96bcce5b5f3c4e6835b1b3ce04f636b462c62c7861c0e448cb1a00316b8d4a38c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367872, "uuid": "19b91df3-e2dd-4322-9708-1109d6e40ca4", "value": "T135A3B231F6A4DBE5F820DAFEBB35F0B614F1AD22D592890731487F1935F65C628E0A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367872, "uuid": "679591ce-8e8e-4fa9-9186-49de70ba4007", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367872, "uuid": "89599f9b-ec45-4120-a92f-1081ea479e35", "value": "1536:tvC6EBP1uhinBhzu2erq9Jom+al0ZFLGiU4KxM:tvvEJUczu2F9J9+G0L9XK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633367872, "uuid": "d6273408-1d78-4d7b-aadf-4eca65a2c896", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633367872, "uuid": "61a3216e-b4ed-4f29-bb09-8f3b0db8f538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633367872, "uuid": "46d4543a-d613-4170-9cac-b4786ca7abc6", "value": "0000004017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ec5ea2-24bd-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1633315724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633315724, "uuid": "8ce0e178-6bdf-4925-b095-dbcd081c5118", "comment": "Malware payload (Tofsee)", "value": "1f8f27ac53543bb015ef6c44b4da5f53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633315724, "uuid": "000f4b7c-ab95-481e-b1b6-8ca627b2543f", "comment": "Malware payload (Tofsee)", "value": "a773aa18c924c53e6d728cc0bb6a1a72ea6fdaac4536dd4d33aecb420f6aa1b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633315724, "uuid": "bf91e238-b02c-4372-9581-d215f760218e", "comment": "Malware payload (Tofsee)", "value": "21941fd2c5f3dd52a021c58bbda4ba24371c2e24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633315724, "uuid": "2c66a667-c8fc-4573-a324-c54ff23a2991", "comment": "Malware payload (Tofsee)", "value": "b37d9879e2eec539971ee70a9b596a8b8c7fbdc99a6e8b4c832f5fc51dde844d4594968072ab012b5df0493691a17ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633315724, "uuid": "d13c7c54-0698-40ef-b1a4-8160d21212f4", "value": "T1EF449D083980CBFED6760271AF16F7E0192DFCAD5D66568F2B99271E2E3D3D18621342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633315724, "uuid": "718781ee-5143-442d-89a1-0e1ef3104a33", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633315724, "uuid": "b2a99070-3243-41d7-939f-8edb46203dd0", "value": "6144:iVYm4fLO5mu5aPjaVH81QM8ROhxxpeTr/ekI:aYjkmu5aPj8cz5zxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633315724, "uuid": "75c842be-1ed1-479c-863f-04082c6fb4e9", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633315724, "uuid": "0204d356-9c08-4b51-b03e-8d3fff7760d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633315724, "uuid": "e56db28b-8b0a-48f3-b468-b9994ab9ecc6", "value": "SecuriteInfo.com.Variant.Fragtor.28226.23218.1122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05e12d8-24fc-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633342825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342825, "uuid": "e322e486-cc18-4ace-a9bf-f3f8093e666e", "comment": "Malware payload (RedLineStealer)", "value": "a61c8ee3775554f49f81bc819d6dacbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342825, "uuid": "96115eeb-beb8-47f6-8d95-9a46f6cfc6da", "comment": "Malware payload (RedLineStealer)", "value": "a7dfdd77617ff0d9ab80e43a147683d595b231369ddf9c18d2c4bf68d5133d3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342825, "uuid": "685019f4-01a6-4138-a1fe-92f724a6a004", "comment": "Malware payload (RedLineStealer)", "value": "f1486e9d6a07002930b13e731b2d456261c3ecb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342825, "uuid": "77926f9e-ed0e-4de1-b133-9ebb3f321f78", "comment": "Malware payload (RedLineStealer)", "value": "f5e7accfa9d709f23ba503d4b097c7fb3b8306b7f9d5e924faeb59ddf131d9790bf36b9eb1a1ea364c2987a3fe0451bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342825, "uuid": "5552b868-1c8d-46ac-aac9-f8c5ae6b0810", "value": "T1B8563322AB915971D5326D33902A7A45327ABA301FD88A5BA380567DDA73DC0F330FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342825, "uuid": "e602b87f-281e-4ad9-9873-c337859e2a9a", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342825, "uuid": "10c8cf79-ad36-4e2a-b4e7-24d2e0a72ef9", "value": "98304:PbgDp9rTdiYuZWZ/xK7yLobM3LmFAwxOjlWJzscojwosUIrNTlXnF/0kRYaRMyR3:PgTdOZw/xtp3SFAw2dcbosrRlXFcYvlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342825, "uuid": "bc3f8b4b-acdb-4984-8d7c-d49df468c2bd", "value": 6168847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342825, "uuid": "0ca60043-7aa2-4640-b6e2-b0b8d65eaeb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342825, "uuid": "b595a0aa-96e8-48c5-87cf-9835330ba3d4", "value": "a61c8ee3775554f49f81bc819d6dacbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f1fb3c-24ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633308531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308531, "uuid": "73c65eb7-0329-477f-84d5-ea5a81761a72", "comment": "Malware payload (Gafgyt)", "value": "51f8dc794b10c2bbf5869d90a88755a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308531, "uuid": "3520f685-2559-4f9e-8983-8ff7249173c6", "comment": "Malware payload (Gafgyt)", "value": "a83f268deb2fc06661c29aaed70556e3b9aaeafee2576e8104ecc9e817b71e25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308531, "uuid": "a9893604-d508-4208-a526-3a297f5a4f94", "comment": "Malware payload (Gafgyt)", "value": "897f4e9855f297a5723ce86588fe5a9636e7ac78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308531, "uuid": "038e66b0-91e4-4b85-ae68-94c951228793", "comment": "Malware payload (Gafgyt)", "value": "fe8a0bd34f4b160988ea96dda789198e94a2c941450fe827f96badad3f455b69300f107653e64f93ae836578603aea75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308531, "uuid": "86b0e559-033d-4831-9a8b-f8969733bed7", "value": "T110E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308531, "uuid": "83f5da1c-e331-4b3f-9068-cc7f4f1c6a2b", "value": "3072:CvPGwo3caBb53qHiCOvFO6aqB8QzbeskmhxQwoVqUNu:qfnaBb51FO6aqB2skmhxQwoVqUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308531, "uuid": "4786466e-82ef-40e8-9742-3386e1bed405", "value": 143018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308531, "uuid": "335d1132-ec81-4984-b813-e50147ff340d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308531, "uuid": "b61277ae-2ab4-47cb-a410-8051a999bee0", "value": "51f8dc794b10c2bbf5869d90a88755a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa593b4-252f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633364862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364862, "uuid": "8cfb716d-cff8-4852-a93f-8e60d53481a3", "comment": "Malware payload (AgentTesla)", "value": "9c2edb97aaf6013cb0f74296203e8282", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364862, "uuid": "202b31bb-562b-40b4-920a-5da255137306", "comment": "Malware payload (AgentTesla)", "value": "a8c0c2fcf4f6dbcaafc53a6c9cd3c50a58b6429d240577530e368ce4e27df294", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364862, "uuid": "ecf28b76-752b-400c-9a06-81ad42f2fefe", "comment": "Malware payload (AgentTesla)", "value": "167af6389486d80064b7321663876932b1934c42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364862, "uuid": "a9218f11-575c-42b7-89d6-22e0274ccd57", "comment": "Malware payload (AgentTesla)", "value": "10bc28cbf23d997e0c9e22442e5b3dbeaa74dddd89ca2963296062d24d32afd2c22af0b4cc1a0732a5e4eb50de7458a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364862, "uuid": "52b51622-aecf-4714-a73d-aa273605f2d1", "value": "T1E4F4D064B747D507CE3547F028ADE6406339AF111649C32E7C89B6BC2E73B742A8C9DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364862, "uuid": "0c203b3e-e038-4fde-9b92-a22b2ea2b549", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364862, "uuid": "ef8f93f9-2012-423f-830f-e9f988fbbea4", "value": "12288:/oN+kLUzY61AIUrf5OVatpTFLhDfdExSMZ:/GHrf5Ok1dEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633364862, "uuid": "b60d740d-1527-4941-ab67-ab75cd719b2d", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633364862, "uuid": "9b5abbaa-b3b8-4fc7-8415-816d1ed8bcfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364862, "uuid": "3e3460cb-3b09-48ba-839e-2700547ef4eb", "value": "#RFQ SUPPLY Unilever House UK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c77ad4-24fe-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633343389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343389, "uuid": "cb61aeaf-9dfe-4188-a4cb-07f0deeb5fb6", "comment": "Malware payload (ArkeiStealer)", "value": "6ea4170824b7282768324dbef4ed2c59", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343389, "uuid": "025933eb-6b60-40d4-95a0-52a717c99d63", "comment": "Malware payload (ArkeiStealer)", "value": "a9228e42fde014c8f92b6c0e3e98f23718f3c222107f9780d072fc29742d2988", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343389, "uuid": "aa8e815f-4a06-403b-9641-42e7a149455b", "comment": "Malware payload (ArkeiStealer)", "value": "f683a1eadbeefc4136c92c225b74052068590574", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343389, "uuid": "35b3927a-f41d-4ae7-86e7-4d0fdd648f41", "comment": "Malware payload (ArkeiStealer)", "value": "2ec96cde90b1191658aac1bf40142ac52bd27ef8364387208d04bd80549da2392b3c3c00c83eb0a5ebf888d79d610ed5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343389, "uuid": "6ede64b5-fa82-411a-89f2-fd741f487ae2", "value": "T118F4012C7081CBB2E6750271AB65C3F0455FBC6DBCA6DD8B6788671E2A3D3D28619313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343389, "uuid": "a6624d86-9430-4225-ac37-e5c45d43e5ab", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343389, "uuid": "c83d061a-ce92-4fbb-acd8-ddd6d2abc9bb", "value": "12288:wbtsBRIpsV6GGS9cnWiZjeSSvQwWj+xuefm1lMjRiazxp6L:wewJWiZaSJwsB8mE0u36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343389, "uuid": "b2a85c07-7102-40fc-be00-c824100f86ef", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343389, "uuid": "6cc6d922-4556-4850-bddd-c2a532639b24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343389, "uuid": "2cc36880-9ac7-4213-a329-86dc9bf49774", "value": "6ea4170824b7282768324dbef4ed2c59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4639ddbc-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633339211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339211, "uuid": "6b2ab876-a5f3-40f3-b4aa-65ee5191129d", "comment": "Malware payload (Formbook)", "value": "6e2732d297f1666f6c9eed9de730c39e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339211, "uuid": "a1c154a2-c837-4f23-9dbe-fedd7d1de13f", "comment": "Malware payload (Formbook)", "value": "a93b39035f5ae1ace569c25759239f8c0361bf2462cb22f2a780c14de2821fe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339211, "uuid": "9196ea1e-eba4-4fc7-921d-69bdf05dec50", "comment": "Malware payload (Formbook)", "value": "54df8b2dc7352b75dd09103f2a399fde314e4e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339211, "uuid": "21ae0517-be3c-42b9-a895-713dd1a5cd59", "comment": "Malware payload (Formbook)", "value": "a313ffac35977a089530490c39934dee4532282fa7a47e4f834692f9f58b1a24eeaed13166479ae052dbea2585f05f11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339211, "uuid": "f613a255-6801-46b2-ade2-4c36bf171a4b", "value": "T1FC156D576EE44CBAC45928BE1C4BC6D47A25EE170D2488636BFF0C5C6F3B36138186E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339211, "uuid": "4c8b1721-e773-4029-84d0-42dc7aba0d92", "value": "e28e7623fc562c080a8912e7dcd203b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339211, "uuid": "11ea36cf-ff6b-4d08-84e4-4c5ac2424b5e", "value": "12288:8yZ9wV/AHhLB8ncBBHpeNwoCoicmuYyqq606/B6O90Oe6jkOGbGS:fbwoP8ncbHpeNwoOc/Yyqq6nPjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339211, "uuid": "316597c6-3ce0-4fe8-8ed1-43bd86cea62b", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339211, "uuid": "bec3e146-a0be-4515-b345-5c432ef77431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339211, "uuid": "ed72dbeb-fafb-40e7-bc4b-7a413e1d04bd", "value": "Lettera di restituzione per Siberia LLC.jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176c8c10-24d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633327536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327536, "uuid": "3c57333f-eeb6-4b98-b8f7-eed6f6ba49b4", "comment": "Malware payload (Formbook)", "value": "2cc20247f6ebce280a98c53d28b5fae5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327536, "uuid": "de37df43-66ac-426e-ac7d-88c262a5d5e8", "comment": "Malware payload (Formbook)", "value": "a96a8e85a7635a0fd5a988375a5ab2136a0a6c4bb84357b2a2673f9c3516f4cd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327536, "uuid": "1cc3ccb3-b728-4840-8c0b-85445f505a19", "comment": "Malware payload (Formbook)", "value": "8e922b825ec13b57a8a9efbef7f0a2fcb233bf54", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327536, "uuid": "2a1b1d8e-3acd-4b29-8d7a-8ae1024bb94c", "comment": "Malware payload (Formbook)", "value": "340a17e9bfdc52e77969a678e30011b4eec1b7f595c9611aa23271bad25d5376ff9b474417fc2c30a1ae32bf09432332", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327536, "uuid": "89a75b84-0eb9-42da-8ce5-6689f172034d", "value": "T16AA5CE06B06576D3D32B14F012AB7A0E812C788691D91C89885ACBDE6CF5CFED349E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327536, "uuid": "1605e957-e76f-4f6c-8696-ed134ab8074b", "value": "1536:Oi/ZfvkkNBYsYAY9YVYHYqYAYBYrYtYhYRYHYdYRYIYiYbYYYBYrYtYhYRYHYdY8:cD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327536, "uuid": "f852a0c7-1db8-4916-947e-d9c3d7089d5e", "value": 2241251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327536, "uuid": "591cbb7f-f795-4fb2-8726-7938dbc6b5d9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327536, "uuid": "1afb3c13-9ef8-44f8-b6c4-1e9416d6810b", "value": "Offer No. 445331PT.Kimia persero TBk 10.04.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540fa403-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354696, "uuid": "65eac037-9f26-4616-8aed-b849535c061f", "comment": "Malware payload (AgentTesla)", "value": "580c6e505c690292b9dd1e6f35d4a996", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354696, "uuid": "4c58097e-06ae-49ec-8b10-b8ca134f78c7", "comment": "Malware payload (AgentTesla)", "value": "aa2ca75fe8aadc617a2a83718e06687463b23f8b73745f9733896a6e4122b815", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354696, "uuid": "11678632-4f3b-4b01-ae0f-62021579e4df", "comment": "Malware payload (AgentTesla)", "value": "a9a85a672cee8f3b17afdf6e2d912444092dfab0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354696, "uuid": "5ec46dae-a327-4d1c-ba81-a9d4e8787f2c", "comment": "Malware payload (AgentTesla)", "value": "45c31ab47fbdccb7d53d553ea4dc41c95fd07ff3dee55a38fe6d9868f7befc491ca0814c2dc4e5faee20ae733d6dba6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354696, "uuid": "29d3e4b0-1d32-47fb-ae9c-03c74c9a0eb9", "value": "T19994F1B923B7A704EE68C7F12C24A29517B9B426114CC77C5E98E0FC3E63BB856D0953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354696, "uuid": "2e453915-25b3-457a-99ca-c77a835ec88a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354696, "uuid": "ea44a077-f52e-4b53-b8bf-77e3d88c7c87", "value": "12288:rESoeY5HDsqRrvWb2NnNmI8pOPvi90BM6MigT:rESfIHVB+4NCpOM6Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354696, "uuid": "b60a2867-ccab-46f8-aae4-177f94941e83", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354696, "uuid": "54c596e4-ab45-4095-acc5-ba3c2e4e89a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354696, "uuid": "5e01ed41-a1fe-4469-9cf6-239741442f34", "value": "RFQ-Quote-REF-HYODA KM-Request (R ).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610f332e-24f1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633337967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337967, "uuid": "b38ea8cb-6f6c-4d26-86f6-0cc77d85772d", "comment": "Malware payload (AgentTesla)", "value": "8f587499da15e0223f720b2fc4da4b8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337967, "uuid": "3241828f-b982-427f-8286-c0e248a908e7", "comment": "Malware payload (AgentTesla)", "value": "aa5e9480e6915ba2106c9fe2ca217ee3f89e61aa084f6f00ae50045c66d22fdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337967, "uuid": "19bcc731-ccb1-4d4f-beb5-2dd7018c7e4d", "comment": "Malware payload (AgentTesla)", "value": "9cf2c5a2ccef02e56e4dbb48a7f631a71e9909b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337967, "uuid": "3ae5922e-1933-4c7f-a6a3-0133cfe1cc3b", "comment": "Malware payload (AgentTesla)", "value": "8ba0a29c10180a166fe58118a256881323be177926cfe11f9053fcf615075014d1461a5e561bdd71557c3ff5a1fcc2f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337967, "uuid": "75e3e7b4-407b-4917-b5df-9f691777dbb9", "value": "T13684024176D0CE9BE1223E707856E2F2EE330699121B88C39704BE3BFF9518979196DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337967, "uuid": "2d3a3849-97fa-4c39-9d9b-b812e9f74336", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337967, "uuid": "1d3682bc-c004-4334-90a3-1a6e5756c9a6", "value": "6144:18LxBcIMTTuMW0K2BqVWU0m9OVP6SQrxCnYW+Av4vEJs1eQgV+mVAu+IY:CETuMWwbt/PnKxzzv11eQwSuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633337967, "uuid": "b04801fd-1ea0-4238-9813-4161ffbb39e3", "value": 377768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633337967, "uuid": "5e8f023a-667c-486b-acf9-534fc7886459", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337967, "uuid": "c04a13ae-fdb2-4ad4-b54f-3a7c936807bc", "value": "Dhl Courier Service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6637793a-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633347854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347854, "uuid": "de6bb1b2-98a0-49cc-b853-cff53d19e8c1", "comment": "Malware payload (AsyncRAT)", "value": "a750d5f19524e4431550930c4e8a0a95", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347854, "uuid": "efbb4542-3375-4b70-99ec-10e8a3cefd95", "comment": "Malware payload (AsyncRAT)", "value": "aa8308e986d53702e8674ec11140bf6244deafd679135bb5c1b6dbe20475a125", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347854, "uuid": "3e3f981b-99dc-46ec-98f5-9dedc347ef70", "comment": "Malware payload (AsyncRAT)", "value": "4e20317001a8da032d85e12ee9a41fa570485daf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347854, "uuid": "34fbfc79-ff79-42c5-821b-65b52fdf4511", "comment": "Malware payload (AsyncRAT)", "value": "df52a6521cf50e48ec28f4c2763af3ce52911e6c83f3b442c0f0032ee0050342931fce431a4fe20e768ce8f230473fe6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347854, "uuid": "070d7287-c18b-4df2-858b-183730a1cde6", "value": "T153231A003BE9816BF2BE4F74ADF26146867BB2633603D64E1CC441974723FC69A426ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347854, "uuid": "6fa42860-8b6b-4496-a749-94cede7ecfd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347854, "uuid": "58bbdae3-6523-485b-bd5b-1a37db0d5a0c", "value": "768:iuyKFTMIGZ8btAWUumy6mo2q88CAPSy3PIE4q12T8sBTVe0bNlpmZJqtOlD2KsfE:iuyKFTMtkY2w6E4q12TZRRbDewMlDLsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347854, "uuid": "a72f9d17-e072-487e-8791-f1b40dc62579", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347854, "uuid": "64b89d5f-6201-4c77-be3d-5697021f8550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347854, "uuid": "ef2746d8-2bd5-4cfd-8ab0-c279e836abf4", "value": "a750d5f19524e4431550930c4e8a0a95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a900939a-24b8-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633313606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633313606, "uuid": "3d3ece7e-9095-4b9f-9789-b8af895669a9", "comment": "Malware payload (Gafgyt)", "value": "c8a770e87d9269780e68b9fd2b9dd0b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633313606, "uuid": "136de717-b6e1-4a9e-91e9-f18c838f57f0", "comment": "Malware payload (Gafgyt)", "value": "aacdba43c261727aed6a66de22af3b9a616bc060cd4401459879c66bc23d78f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633313606, "uuid": "4bbf09ae-afd7-4407-ad34-d0f42b8190f9", "comment": "Malware payload (Gafgyt)", "value": "73be3857d4f5ed8a4ac73cce767cd03db9194940", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633313606, "uuid": "8cc3e8c8-2ffa-4328-b6e8-44c904dd1ac6", "comment": "Malware payload (Gafgyt)", "value": "9d4727a079e1fdae1107c3e548814992c76d053e09fedc761308531b4cac25a3bd4eaf64d58cff584b89847b5ac8ddf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633313606, "uuid": "9f2aacc7-37bc-4dcc-9389-db07460b1b8b", "value": "T16DC32A04F9018767C2D327B6A68E474D3F3517E453DB33166A38AEB42FC27992D25E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633313606, "uuid": "56e09518-058b-40b0-887c-543167370c85", "value": "3072:jogfqPdx1YA2EFhGS5iqvIwLmUwrQRhk4rNXhLe:0Pdx32EFh15immUwrQRhXrNXhLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633313606, "uuid": "24ff6fc3-378a-4031-a3a5-04cbe8068d66", "value": 125549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633313606, "uuid": "1dd787f8-926f-47f4-9cb4-f96dee56a9ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633313606, "uuid": "3851ebd0-f977-46a1-b223-a9fdb444352c", "value": "c8a770e87d9269780e68b9fd2b9dd0b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365f0623-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633339184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339184, "uuid": "304ab123-1396-405c-9746-e76b224e01e6", "comment": "Malware payload (AgentTesla)", "value": "be7dfbfab41d6d58d7d8132170f900e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339184, "uuid": "335af068-6e78-4efb-9633-2f999812ffe1", "comment": "Malware payload (AgentTesla)", "value": "ab3fe74cb452ed956a8bafbe779d7629b466df11529fbe9b5021bff74af11caf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339184, "uuid": "616776a5-9728-40d4-830f-e5585721c5e5", "comment": "Malware payload (AgentTesla)", "value": "7d7742895b2e9013ec5448ac29d59e71194657ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339184, "uuid": "77b134e9-3928-47bc-99d4-fd884f30749e", "comment": "Malware payload (AgentTesla)", "value": "57b5ff7e42a9d21b2dddce3d39b28153ce8732ad667dde7a3eb6d2bbf3ee50996617d62d1e03a60059a800fac6401c07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339184, "uuid": "30e8acbc-24ec-421a-9bee-d4473c205271", "value": "T17564130AE3D28CE3E59749712E32FB3CF77E48798422A2478BA25F377A95651670C052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339184, "uuid": "beb1b41f-3684-4d0b-a69c-1fdc3a88d052", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339184, "uuid": "a69d97e2-0766-4627-b9f4-ff090fb2d137", "value": "6144:F8LxBs3eP4moA5cv1ogdfMiIpi34bILu9YaGzDxLj0Eal1xatzycl0gFk:/3eP4/A5cveMKi348LuKzVLjGQP0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339184, "uuid": "af20e636-739a-4625-bfe3-bb2f4e9762b7", "value": 310814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339184, "uuid": "d8a66725-4dfa-4283-9d8f-821f86dfef51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339184, "uuid": "c36c3719-d15b-4f49-b5e0-d2a9999a6c9f", "value": "CMR-3070169_PDF.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbc5b55-24d3-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633325317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325317, "uuid": "8c6f4829-3711-4dec-8392-27529fb1f3e9", "comment": "Malware payload (ArkeiStealer)", "value": "a5eedb55a05ec10c0be575560a0782f7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325317, "uuid": "a6e69bfa-ee9d-452c-abc7-ddc3cb11f354", "comment": "Malware payload (ArkeiStealer)", "value": "ab4877cc1ad675a827afa8f30660c48136207d0efc03ae91e296de373765549f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325317, "uuid": "3f51ddfa-7952-4c0a-b6bd-a46c7166e388", "comment": "Malware payload (ArkeiStealer)", "value": "c6b577a94cc7fe29963e8d9e71f83c31ca14f557", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633325317, "uuid": "3c4390a9-6d09-49bc-86c5-b41b6435833c", "comment": "Malware payload (ArkeiStealer)", "value": "b8692bf071d2cc629f7c43c2d2ef7f59220b33cb7641b098793aacffdbe6b11e276d22468c0fa46ed0d5efd2ca0a5232", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325317, "uuid": "6fe40688-123d-4199-803f-cc2081de477a", "value": "T19554BFD0B281C5B2C751017E58D2C7FCD9ADBC6C9FA066B72F8496DE6E35193A623203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325317, "uuid": "c8680421-6778-4586-8c8b-345a2e7e6b02", "value": "80a508c8657a344b6b8e2e6999ecb92a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325317, "uuid": "4e0f253e-3143-44f8-89d4-3f33bc40c062", "value": "6144:xhkcIyT1sRKJnTQIJilk9f+cPI1NZuSYG5RG:01RKpTQIJiC7I1oG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633325317, "uuid": "2591410b-9978-4fc1-a255-545320ba9b69", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633325317, "uuid": "b309d589-5525-4a7a-9379-85b3f5c7df8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633325317, "uuid": "dffb1126-3ef3-4bfb-b720-8ea075a2c3da", "value": "a5eedb55a05ec10c0be575560a0782f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cab0f33-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633347919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347919, "uuid": "4d57c591-9b21-499f-ad76-904c26197923", "comment": "Malware payload (RedLineStealer)", "value": "d4f2a89e1cebeebe2bf856d413fb7e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347919, "uuid": "01bf54d6-d3b2-4f21-921a-2bc353f268b4", "comment": "Malware payload (RedLineStealer)", "value": "aba852eff9b53848b266228241991403993f7769587712794eb5f406ce4c9a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347919, "uuid": "a175aa62-69e2-4a32-afe1-7e3ac8026ed3", "comment": "Malware payload (RedLineStealer)", "value": "4279457fccd405df392cf21e0036496e411e4532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347919, "uuid": "f1dff3d5-aa80-4269-88c5-99047bbc8390", "comment": "Malware payload (RedLineStealer)", "value": "5c88a4d500883fe485f2b54738c54305a400b0da006d8237dc7633e5574a9a931ac22241ee9db83963b4641c9c1267e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347919, "uuid": "69d7a21d-86e6-4e81-b659-531daa4db569", "value": "T1D194E000A3DCDE9FE3196A7858156E1182A2C3ED20A2DE0AED5D55B13DE625CFB10FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347919, "uuid": "e2ca3224-f7c5-4d73-beb9-3d7a30aa8229", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347919, "uuid": "7824e3eb-1f51-451a-a4c9-1257121a9cc4", "value": "6144:yoQoefGHfcG+P8g4WO4Y0mLs3o+GdW/vlj2sQ9H5z82aPLcpd7gQvJNDQDXq9F6f:fCGEG+ERWbm43o+3Hl/Qt5aKgkJNUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347919, "uuid": "f6fdde9b-c8e1-4bcf-83ac-535250d6f6c4", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347919, "uuid": "c5e567d8-2ace-45a2-9d59-9fe48e3d7fa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347919, "uuid": "a1fd6dce-c518-4f95-956d-4f2dc400f595", "value": "DOCS-0094-LPO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf99391-24c4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633318900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633318900, "uuid": "2b8dd3c6-506a-4536-8b5e-85a1549d319f", "comment": "Malware payload (AgentTesla)", "value": "22b0b4475227b17fd03c05cadd0643fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633318900, "uuid": "28fd3898-290e-4765-b548-de2679f413a1", "comment": "Malware payload (AgentTesla)", "value": "acb631e0a0d57e6469fbf28e7183ca73ad169047a836accb025cd7b847e6c31b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633318900, "uuid": "8c99d300-eba3-4861-ae85-3bc6f4f9c77f", "comment": "Malware payload (AgentTesla)", "value": "59e8f5802346c960beaa86c72a13411904eba7e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633318900, "uuid": "81f86a98-47f1-483a-8806-1005c0128951", "comment": "Malware payload (AgentTesla)", "value": "02621cdcee1f3d88b90ec64d02eb570dc27c31ca835646d79578844ccb6330f5c212490cd1b56ff413a086e4e00603db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633318900, "uuid": "d6fa3574-f13b-4904-b5cf-2375ccb582e4", "value": "T13ED4F19D23AB9600FEBF47F8787490904BB1B8165416C33C5E8068ED1D737E88AE5B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633318900, "uuid": "4df925ee-6d7e-476b-8cd1-69efb355ad0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633318900, "uuid": "35f5b92c-0e30-442f-9e3c-6a7b0e012b3f", "value": "12288:EkloBmW+ZMJ+M98y/gYNATUfDgMRac2RyJT6YashlM0JT6YashlM:HcSOZNAof8MUs9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633318900, "uuid": "49195862-6c37-4c5f-a6c1-f061bc9dfeb0", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633318900, "uuid": "208edae4-0920-45aa-9849-eea27e604eb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633318900, "uuid": "b7448858-a814-4d6e-955a-6b66259b1a76", "value": "IM0065676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d209acba-251a-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633355766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355766, "uuid": "67ec1575-d479-447f-8c4e-a04f8edf23f7", "comment": "Malware payload (NanoCore)", "value": "9fd5f4958cff8071f2b45ccf12ce6a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355766, "uuid": "58692083-f6e1-4ad4-ad7b-357ccad0cbab", "comment": "Malware payload (NanoCore)", "value": "accd4d735dc38b3b17c33b003a59e9c65b0c9cc81b926b945fda6a3b66552ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355766, "uuid": "0631271d-198d-4c1b-af39-b1f5a184d449", "comment": "Malware payload (NanoCore)", "value": "0f9ec9b923eddcf62a2175ab005018a380b039d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355766, "uuid": "b9714b9a-9bbb-480d-8cfc-3d3551bcf77c", "comment": "Malware payload (NanoCore)", "value": "8116fbb6ede65571e2ee2c95abc9dc40f9d2c8cad1b3a3c3bbee5a95110091fa9a55520127375088037a50de550f6ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355766, "uuid": "c91e7828-42ff-4f3f-acf0-aa7f2e6f6995", "value": "T1EF132A243BC54136F87E6B354FD32481A7F9B587BD32D91FADC101DC0D626678BA122A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355766, "uuid": "43d84649-0559-4229-ae22-2943a45f6eca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355766, "uuid": "34fb9969-a481-4bb9-8deb-0c276220ab22", "value": "768:IXLmblMCFJVxwkuqHJf+s8J79IIOTv/hylF8+l71L6ftsssm:iLAlM0JH5np4+Djco+l5L6F5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633355766, "uuid": "813367bf-492a-4b17-987c-f22741221ac9", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633355766, "uuid": "3da42b72-28b5-4db9-ad57-e0da28a58c9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355766, "uuid": "b367cabc-8bb5-4128-ba48-14109c5e603b", "value": "D7X5Z4A30M3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b946a288-252a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633362596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362596, "uuid": "c4ed241a-2cd4-47cc-8a1e-f1d2dbe89ed3", "comment": "Malware payload (AgentTesla)", "value": "982fb534072a34e42a52f18e857318a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362596, "uuid": "d6ac1778-80a8-4fda-ad72-3bf1e913ee35", "comment": "Malware payload (AgentTesla)", "value": "ad2a3a7c4b74b600bc39280f5098f011957992b7ce6125e1c2bb9a5f8f2e3652", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362596, "uuid": "1ec2136b-1897-4dda-acb1-f8e02b116e0a", "comment": "Malware payload (AgentTesla)", "value": "fa2e1b778e4d228e256fad17488de74be08fe8dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362596, "uuid": "3d179929-f65d-4d22-a0b7-ba7f692af5c7", "comment": "Malware payload (AgentTesla)", "value": "1eb8e7461947635fcf25b8ddb3d8def4972f23bc0bbdf2c0e3b79be06963b5a45f75d6cd490c5cef2c27d8ab980cdb94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362596, "uuid": "194b0c9e-261b-4697-ac7f-b1521b42ca08", "value": "T1CE64220FBD608F33D1AB6AF9C476159885A0FD13BB91E0847111352DB57CFA88B56339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362596, "uuid": "7d40388e-a6b6-4d00-b5bf-b32418b8885d", "value": "6144:8Mzm3CvE4ACxyJ2c1TOSWnd1sBYT4imLVDz/IreUFONs8XM0Dd6poE:8MSSvf9xDnd1CS3uDzgrdFONs8co6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633362596, "uuid": "2b807313-f851-4cfa-b6da-2b3c90a12ae8", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633362596, "uuid": "090519b7-8aa0-412b-a278-1a0476b064d1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362596, "uuid": "788b2961-da87-4fd4-9d1c-fe519df11d1e", "value": "04OCT2021-USD-178,750.00.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e8c1df-24ef-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633337276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337276, "uuid": "65e461c8-bf7b-457e-8094-eda85dbf3f5e", "comment": "Malware payload", "value": "8dba9cbbee5b04de72cf9695ff99fa54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337276, "uuid": "fa7a482a-6c4b-457e-8329-34aaedf0fdcb", "comment": "Malware payload", "value": "ad6a04c65eb699a3a8d8f266a1d5ba3c9ebe474a43eb33c6ced049d9842f0dcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337276, "uuid": "78cc62e2-73f2-4a36-853c-999f5ddbcf7d", "comment": "Malware payload", "value": "c21472c019f114a27b490219dff34b800310065e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633337276, "uuid": "22371b46-e1b2-4697-b5ee-7f00567be923", "comment": "Malware payload", "value": "0dd7279249608290f411784d2e132f9f86b4ea243d7f5d28af2939fe3e04c0e796ef06829911080cea85500460801558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337276, "uuid": "f7cc42ae-7714-4322-8f48-fcd57bc407f7", "value": "T154927DD7D5D1C1B9C06C0ABAC526491AE9770E33181A38E5A7FE6C3D9C94F9021CD91F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337276, "uuid": "19bf3447-229d-4d8b-b574-7ff6c75bfe0e", "value": "384:L9MRrgjf4TKA/ij7m+1Ii9Jb4bX1NzwTtYQmNny0DprLX7FtaHQZ759:LYIaKA/ija+1Iawl1wxYvyIFtaHQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633337276, "uuid": "fcd167b5-f37f-4834-8da0-5ef02555e870", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633337276, "uuid": "0db26dcb-ceaf-455f-b76f-6191e3511922", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633337276, "uuid": "fceae2f8-9d05-4b6f-81b2-7686c0880e45", "value": "DHL SHIPPING_119040-DOKUMENTY DOSTAWA,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4371d6c2-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633343071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343071, "uuid": "8f9cc4d2-443d-42d1-b52d-f35650e5fb2a", "comment": "Malware payload (RaccoonStealer)", "value": "65d2290d705e9ab5da1907a806f45790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343071, "uuid": "b4be041e-6419-48a1-b808-ec6bad3cc7a7", "comment": "Malware payload (RaccoonStealer)", "value": "ad7a43d349196fcd55f26cafda2ed1907288aff6200e0348718cdc94373d84b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343071, "uuid": "b7dcbed0-ed6a-4d6b-8f1e-4fe1db893c1c", "comment": "Malware payload (RaccoonStealer)", "value": "822aad5f4299e21099b90f8d6dc12d2ebdc57f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343071, "uuid": "9c91692a-4714-422a-8562-ec5be654e978", "comment": "Malware payload (RaccoonStealer)", "value": "b4eb83f6438bcc9bfa3e184a86a3a6c509b5ef73e0d11fa20980627fabdfc1ec8676fa691217a358a61eb393514a870a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343071, "uuid": "4d42d370-7c1d-4628-a8ec-85b7a49859e8", "value": "T128C4F10431A1D7F2E1B15770A766C7F1496DB86D68E99E8F3B98230E6E3C3D18722253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343071, "uuid": "7bb46ec8-05d3-4d57-a153-f3badfad8b71", "value": "ea6e9add4feec4142f4eaf80b256f47a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343071, "uuid": "51a4d4b5-b1a8-489f-b54b-6f57f76b1b8a", "value": "12288:yRETCTh7FPj0AF1C8DVkOuEzo4rMbDDrU1n1Pzxp6L:yxN7JJF1dVkOtdruw11r36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343071, "uuid": "b963e91e-7732-46a3-9353-04571ab29789", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343071, "uuid": "7bc5addf-f6e4-4b56-9d73-05aef7ab060f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343071, "uuid": "fcaf1bd1-6644-42b7-8a71-db3ad07fa5a2", "value": "65d2290d705e9ab5da1907a806f45790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff42286-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633335281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335281, "uuid": "2c18bc3b-3fd1-45e1-8b25-919068b1777c", "comment": "Malware payload (SnakeKeylogger)", "value": "af755f01838345e7a618537710d886a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335281, "uuid": "69d82afc-adf1-4285-a3eb-952bf1dc19f2", "comment": "Malware payload (SnakeKeylogger)", "value": "adf0bf2f5d0597baa563da5b5c9fb642de2c4eab7caae06a931f5f03d964861d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335281, "uuid": "341afd52-ca43-4132-be99-fd0afa01f02d", "comment": "Malware payload (SnakeKeylogger)", "value": "65303f0db3259eedf4398f298a557be8a0051002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335281, "uuid": "8cc43a16-7f34-443b-9bcb-032359327b3c", "comment": "Malware payload (SnakeKeylogger)", "value": "e71e4ddc4cd4fae8fc04c08cb3d46bb492776305e572da9bcfc3743ef0de69b83d4b5d0c6293add8b67587e316269115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335281, "uuid": "37ea069f-92cd-468b-b3a2-14b96879868c", "value": "T1DD05F99053CB9EC4F03B2734B0111CE7A6FE660DE379CB15699A3AD78DB6B40461DB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335281, "uuid": "6ef93ed6-7a21-442f-a4c5-7b616359af27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335281, "uuid": "5f356aaf-38d7-4594-b7f6-1189132e51e2", "value": "12288:D3lK8FluRs7Z8z4asvs1drdyImcHFebpvqgxym2K046Mnq0UnsO5lJkKzUvoPUup:ls3OBxjiSkSOQAsKctcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335281, "uuid": "09ad53de-c72c-4da5-8ca3-3a40d66addab", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335281, "uuid": "7e597328-21f4-4586-89e5-1b8ef72a7152", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335281, "uuid": "470b4dbf-fd38-4e43-97cc-5adc73fb96ca", "value": "SHIPMENT ARRIVAL NOTICE - ORIGINAL DOCUMENTS__txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec8e62b-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633360941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360941, "uuid": "969aa6c6-ebf5-47be-9033-3775bc6856ec", "comment": "Malware payload (Mirai)", "value": "bc3280c3f70b8c725d47617709e388a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360941, "uuid": "805ccc7c-99cb-4f98-8d84-60c3a0c92baa", "comment": "Malware payload (Mirai)", "value": "ae3481f2a2f0358f94a28d895e945efe7f12c9a7b0963d4da25bf84b71ebc5ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360941, "uuid": "9dfbd5c6-d292-44fa-9c57-8d7b65c5ea91", "comment": "Malware payload (Mirai)", "value": "9a2210878368c9271c04ef7d69ade785db0ab27c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360941, "uuid": "645c9809-2837-4322-b99c-35f9dfaaf1a3", "comment": "Malware payload (Mirai)", "value": "b668c19f73c29e14c3b495bcb7c9341ea0f3fed38a11c02d4e9cf5cf999cdacc3b2f96029f99c3d8ba0ac9684cef5d65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360941, "uuid": "60ec02ac-4a58-4c99-b9fd-33e2e40361a1", "value": "T187C34C46EB408A03C4D51775BADF424A3323E755E3DB33069918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360941, "uuid": "eca77702-eebe-4877-b2b5-01bef90d46b2", "value": "3072:zL2SkDxxTeFcVTScCliQFIkV+emsxVf+z:zL4DTTeqVTScClvFt+emsxV2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360941, "uuid": "1d054ac9-7448-412c-889b-b91d7fac09a7", "value": 125770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360941, "uuid": "f123ce80-92e6-436d-9e5e-27156438cb60", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360941, "uuid": "d36ea4c2-70ba-4554-b366-1c9ed7baaffb", "value": "bc3280c3f70b8c725d47617709e388a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93088ef-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633339081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339081, "uuid": "74d4dcbd-3d89-4bea-b73e-11441f2aa0fc", "comment": "Malware payload (Formbook)", "value": "f81447e76faf60daded8ca5b776450d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339081, "uuid": "067131df-111a-4cf0-be71-de726654e312", "comment": "Malware payload (Formbook)", "value": "aea2232a122d01c07c5d7e6a10ceef2d2ffa58c10812f95f965f17aa78e82efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339081, "uuid": "6ebf3965-3da1-4cf5-88d0-e8ebf17f87b5", "comment": "Malware payload (Formbook)", "value": "8b6186b24a5d90e3a99ccd622f95f04721e655ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339081, "uuid": "6cc4dff9-693a-472a-b972-5cebcc42a86a", "comment": "Malware payload (Formbook)", "value": "8a28caac913782dd4e73e0dd9863041cb7083708ba392d57846b77a01e8993d13ed908ec4dd4f828d1b08619ee45a02e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339081, "uuid": "b2755584-a10b-41c9-99bb-b2feef557e16", "value": "T1B7F49DD92EB493EBF71E01B8F5743B6813BA9824E597F2C6CA49F0F34036B544A10D96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339081, "uuid": "db5d3306-4a93-44d2-adea-c891d1671850", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339081, "uuid": "9075a947-9e50-40e1-9f52-4c5d825f1124", "value": "12288:VzfUzfNi+hBr7IUADTIjRzS7I5nqYeZJkrIZXylqzKB1YDcGB:VTeNi+hBr8UAX4e7I5nF8tDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339081, "uuid": "463d9157-a17a-49b9-92f6-e9707b1af418", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339081, "uuid": "277d161c-4b06-47fa-a6d9-8909041f243a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339081, "uuid": "294022fe-8ae9-45ba-a3b0-8262aa594325", "value": "IkDHN40T3PO2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7fb1b7-252a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633362578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362578, "uuid": "17c16aa6-b439-4b8a-9a45-3587b9a61874", "comment": "Malware payload (SnakeKeylogger)", "value": "32f440df61153b0acccb3f2ab08546db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362578, "uuid": "e8378f9a-f335-4b31-81e7-abb1dbdbaaee", "comment": "Malware payload (SnakeKeylogger)", "value": "aec363c84c173fbb55cc8f6c2d36e0007574dab98246139112b88f68b2748941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362578, "uuid": "50301272-56d7-4e70-bf5b-cbf1dabc9360", "comment": "Malware payload (SnakeKeylogger)", "value": "b3584587f3e0cb5ce839de742c623c11cb7d4085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362578, "uuid": "d9d9b32f-6be8-48bc-9500-387b524031bc", "comment": "Malware payload (SnakeKeylogger)", "value": "76a5f34b38dabe9b3b01a7bbcf71e7c68c25bdc89bdb51503018e19b90eff351d560926b3d071ce7929359c804eeffe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362578, "uuid": "740e5fc5-b26e-4a11-ba60-2eecfde88c7e", "value": "T12DC1D70197E8873AE6B34B799CF7C34162B8FF11D923874D25D0121A6D227548EA3F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362578, "uuid": "f2faa20d-0d7d-4bc7-8d31-51f8e4894eef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362578, "uuid": "8739b28c-2d21-46ce-883f-4d863d11d250", "value": "48:696kpF/PWRNCAb1iuJtFPgZ8bM7hAQEhX9zDHIkGq1WfoSMyWMRqVThMXSVEnSfG:aptWRnNPgZ8bMEhX9AkPN5V1JVnzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633362578, "uuid": "740158b2-38b0-4af4-90a9-130797be3504", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633362578, "uuid": "881e865f-be38-4f4b-adb2-32b4005fff59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362578, "uuid": "5298579f-d9b5-4843-9728-025de9a71954", "value": "crcrcr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9dd3589-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633342035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342035, "uuid": "a3b0d285-3951-448a-934e-0c81772173eb", "comment": "Malware payload (Mirai)", "value": "24fbc8f03c3e49e635f2e8c1945815b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342035, "uuid": "5b5595f6-f58f-4ee0-af15-b887431c5b7b", "comment": "Malware payload (Mirai)", "value": "af3efc13c294f1ce5889fc58b905dc81e945fa216131a4b3c67c2e448c6a636a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342035, "uuid": "876a62a8-02f4-4f0f-91ea-a2f6cbecc740", "comment": "Malware payload (Mirai)", "value": "b1739f7ae36764d51ac41414dd89974a40651236", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342035, "uuid": "441f5040-dd76-48ae-8c11-cb2fbd482dd9", "comment": "Malware payload (Mirai)", "value": "2d5e727c88453f7b1d58e781dff6dfc0fcf344f1ce2291e688899ac7ed2f9c059e4cef822a419157a674eaf7fb59c492", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342035, "uuid": "a6d8ee99-4db5-42fb-b43b-4dc3c84b6398", "value": "T143634B11A97D1E13C0E4E47A12F7971AB2E5264E25B48B0E7D620F8FFF225805E435F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342035, "uuid": "75a87c90-5ff4-4655-b705-039a50315358", "value": "768:87p8321M7mo9q9sdGN9tviYzCwhXERMKl8Xeg7Vi1DZ3aljO+zk6VzwqHalZ:kp83aMSsSsdGN9tviYzV5OMZ7Vi1ZyXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342035, "uuid": "4b7513a0-7983-4699-ab27-f944d92a07f2", "value": 67872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342035, "uuid": "3580a112-1a85-4f60-ac35-ee45e5439f95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342035, "uuid": "5857b5bb-d435-4864-9fc4-20f8bdb01f49", "value": "24fbc8f03c3e49e635f2e8c1945815b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d069b35-24fe-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633343410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343410, "uuid": "5ac3720a-0f59-4f68-887d-f5cae7196428", "comment": "Malware payload (DanaBot)", "value": "6bc8466e6df854ba5b8cee8c1731f145", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343410, "uuid": "114c109b-ba64-4c12-b0ff-5a8b765fd7dd", "comment": "Malware payload (DanaBot)", "value": "af756a44f94d5084891d9fc3ee12c3d428e5337370c7ab7f07c7721d27738fd7", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343410, "uuid": "75d7e54c-4ed5-4dd1-9324-0c0055ca505b", "comment": "Malware payload (DanaBot)", "value": "e4a5e419e2f1c05a9531e1af6fac85b53eb8deeb", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343410, "uuid": "d226fe82-e77b-4aa1-abae-079559b047e3", "comment": "Malware payload (DanaBot)", "value": "99e8bd71e0bb44ec1eecc9582fb30a5eb5beb09c21bde6b1edc88d5f289f6b11159d4d1e9453f1ca0e17f2ae2adfa5e4", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343410, "uuid": "868b1223-dd5e-4f13-8243-3fdc1e27fa81", "value": "T1614523087181EBB2D6B241346B87C3F9453DB89C1D0A868FA7E9174F6D3E391F939249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343410, "uuid": "660423de-da74-4015-be2c-d0b4ba36ca8b", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343410, "uuid": "2af10be4-58e6-4ac2-b733-0e7951b0d369", "value": "24576:0nZ+3tXsYjptSPJ1ABLRLEgX3bBRPSMS9ij4JWb+B36L:0nZ05setSR1qtLESR6MOiD+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343410, "uuid": "c095f169-5e10-4bd1-bfb4-862354336e47", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343410, "uuid": "efe5c2bb-9813-4623-ab78-a69103e41597", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343410, "uuid": "211f3329-afda-4151-9e20-8278fa0af915", "value": "6bc8466e6df854ba5b8cee8c1731f145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383f48d2-2513-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633352501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352501, "uuid": "2b4cd759-35b3-4165-a51d-17bd4ae1a5a4", "comment": "Malware payload (RemcosRAT)", "value": "acbee350b83dd21753787b9b1588e0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352501, "uuid": "8a6a8699-f45a-4a4c-a31c-9015d7069495", "comment": "Malware payload (RemcosRAT)", "value": "b01e1958972ec443b2761f85f6aec66acfb99d239d4b402d5a345272c72738e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352501, "uuid": "f19e031e-84fb-4c21-8865-eb0ddb0fbb53", "comment": "Malware payload (RemcosRAT)", "value": "7f3c2ddc8ee02369273d0e4cce57ee8608d761a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352501, "uuid": "7466e107-31da-43ab-82a9-226fa70aa030", "comment": "Malware payload (RemcosRAT)", "value": "f5c6b6d19d01b12cf502f3e6590da41de9c59d18c09b2064a25c6eba9a219ae5493ca4a81c3bff3e32f673eb0ad32281", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352501, "uuid": "7a9460d1-15fa-421a-b91a-3f5014d0eea4", "value": "T154841886EA804184DC3D6B70247E8D24661FBEFAA8B4B54E6F8D763537F31E3153604A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352501, "uuid": "a26c8296-ffa4-42dd-9107-0fb7bbb9739d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352501, "uuid": "66a84c4a-956a-45a1-b9b9-6cbd4c1c3d4e", "value": "6144:A8LxB60+uhQMjtesLf0s7BFy/eP5Qky1NtbS/R9asZa2YL9dpl:t+uhQMjtebozOXHSDasZar1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352501, "uuid": "0d0e46c7-dfbf-4758-8a51-dadb9e6ea347", "value": 400347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352501, "uuid": "fc42d6a1-b9fb-4660-a4da-25ff2f48b71b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352501, "uuid": "f3372fb1-8fce-4018-a024-3d0ee0b4d06b", "value": "New Order #86-55113,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26949227-24bb-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633314676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314676, "uuid": "a27cebad-8ac4-46c2-bd9c-b38717e7e387", "comment": "Malware payload (Gafgyt)", "value": "83a29bf294e96a55638ae558600732ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314676, "uuid": "6219ff3f-e502-44cc-8e94-73256a4d0f0d", "comment": "Malware payload (Gafgyt)", "value": "b026ced67ec62cdd703d167919b4eb186325229a7ab55e09c8cd0116571e519e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314676, "uuid": "fa5c56ed-26f0-4411-b225-11a14e121ea4", "comment": "Malware payload (Gafgyt)", "value": "f8ee25c19e11da892c1144ef6434b20caed48fd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314676, "uuid": "2f911c56-b2ed-4680-907f-af436da29332", "comment": "Malware payload (Gafgyt)", "value": "875183a5af207ab45f9aedde97bbbe25a134848997b5cea694331b1a8ea66ee9d5e2b08ee0079d5220e80b22ee18c114", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314676, "uuid": "a4eeaaf2-4eef-48ac-b3a6-f452c87dff8d", "value": "T159B31807B70D0B93C4CB56B03DAB2FF15B68BAE113937181692AEBD017739B52512F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314676, "uuid": "3a8e0cf1-83ba-4357-bf06-e5a122a4f833", "value": "3072:xrH0jQEEA4cn73xSBFhqpxEmKYVVDkEMNfR+e:xrH0jkA4cn7hcFhqpxEmKYVVDTMNfR+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633314676, "uuid": "b3173291-fa6a-4d2d-9c98-3c4f5eeaa67c", "value": 114079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633314676, "uuid": "7e8c9941-7727-49a4-b7fb-3141bcebc807", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314676, "uuid": "cb2e40f3-c8a8-44f7-b805-ebfa1143dc21", "value": "83a29bf294e96a55638ae558600732ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd9f660-24f6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633340267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340267, "uuid": "d13192ba-d4af-41f1-90a0-67d39ac93cb4", "comment": "Malware payload (AgentTesla)", "value": "21401a802f9f8e99809f43fc149ef5af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340267, "uuid": "11111c8c-5691-4c74-a205-26101609bcdd", "comment": "Malware payload (AgentTesla)", "value": "b0f1177e33f69f0f6027cea30afd8b094efe3fe6b26e2ea3d927d4447b11626e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340267, "uuid": "d7d5052c-d75a-4690-940c-a633e4ed7374", "comment": "Malware payload (AgentTesla)", "value": "0ec95019dd88f12ecb11d143cc34049b04e69b8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340267, "uuid": "59d9425a-70cb-4f54-be04-24cd074f8932", "comment": "Malware payload (AgentTesla)", "value": "2ac9248836cb8b977de59b94fe47c35cde68c282969e64af4f9762a069171025222da67824e270e42355a440f03018fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340267, "uuid": "d89a6a1e-c90d-4416-8518-3e285ef931b4", "value": "T19ED4DFB2A3531659ED3887F5683A9D660A73BD7A3AB5D13C1A6CB4B52B333E100D0D03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340267, "uuid": "c955a311-3d61-4968-b7ae-5cb138298658", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340267, "uuid": "dc824425-151a-487f-ba44-cb454f29c46c", "value": "6144:7RtFgERQ+3HwOzyUHKSJxJwSPhvw1MFHSxcmmmaNLO0PXmY2jnOusTqGPnds43wi:72ESo2sJ95cMkmNBOSWVOjqSs43V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633340267, "uuid": "29c6a8b9-079e-4425-9195-fd077cd90310", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633340267, "uuid": "79da630e-7b2d-4dde-ad73-280efbfc84e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340267, "uuid": "b9c203bf-3635-416c-9556-a37a8c71e6f4", "value": "sale order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfde1807-253e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633371251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371251, "uuid": "63ac4f16-a5d3-41d7-876e-0b00aa9c8bb4", "comment": "Malware payload (Mirai)", "value": "6b9a1638690b1e9a42df1113b20c0e28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371251, "uuid": "f01896f1-6951-4ac4-9973-dfc1a071068f", "comment": "Malware payload (Mirai)", "value": "b0f2ca671a9b68bad7267a0f7659580ce79660003a400be455661e648934e117", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371251, "uuid": "4564c298-096a-40ea-89c8-5517bc4977f6", "comment": "Malware payload (Mirai)", "value": "a3a57b43c22b54aeccf51e7b029c70b12ee3e448", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371251, "uuid": "4fc053b1-5f6e-477f-a212-7a38b450b4de", "comment": "Malware payload (Mirai)", "value": "327c7b7c5934aab403935b47e819af7cdeb937e0e0126c499fa4349d5d05deef25adad9de10b1febf4b6182b9fe57f84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371251, "uuid": "336fe92f-2e1b-44b7-9fbf-6fc381c60d43", "value": "T1BC23F1667E064DFCF87A81FE69C893C12E610E74BC21E9316A45CDD14E102A538EEEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371251, "uuid": "1e642a3b-1e33-4806-b613-f6616261189e", "value": "768:p/eICjGw6X9+rC7q+IcZJzU9wVvZDmGyvbJ8CoBh+W6+sqkn6duumoqC7AT0JgG5:kxZydq+xZXAbOCvW6ylnkTsVJui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633371251, "uuid": "a8539e2a-d057-4e36-a3d6-184b8f29c647", "value": 48732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633371251, "uuid": "f64f5c20-b35f-4a82-a504-4c0765a9510d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371251, "uuid": "9a3a15dc-2ded-4c06-88aa-f7de66f3ded9", "value": "6b9a1638690b1e9a42df1113b20c0e28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c853dd-24ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633308264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308264, "uuid": "6215543f-000c-4fb3-b115-e4a15e2e2474", "comment": "Malware payload (Gafgyt)", "value": "da2783e507eba366aeb62d3c126d5fb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308264, "uuid": "5c9fb088-6fac-4bbc-adfc-2ef13a24a1c1", "comment": "Malware payload (Gafgyt)", "value": "b0fe1c900d4f3757fe7c60a794aae4cf560f558e43e9094591ce2b88cbe7b0f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308264, "uuid": "5137b239-9bbd-45b1-9dea-f31a1479d9ff", "comment": "Malware payload (Gafgyt)", "value": "3bc6f66b32c0ef2e0e43b34875672ccc7f368333", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308264, "uuid": "644fee4e-41fd-4a15-98d8-3aca21687143", "comment": "Malware payload (Gafgyt)", "value": "cd77cd6ba432278d125c3b7d8b6e7f890675fee2823f2ab5785f07311c942a986d6dc0f20854f810ae6dbd705dde0ca5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308264, "uuid": "021f5a9f-2a37-4b61-a57a-db4112c1963e", "value": "T11EA3F872E643CAB2C4430AF201A7DA6B0D21BE7B0A7A5A85F31C7CB09F334C57655B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308264, "uuid": "f1082a1c-a029-48b6-8bc0-f800adbd5c3c", "value": "3072:wW8Famgujld6Mkxm6PJ+4fJYmmFVcqq0GP7ZT:wJFB4Lm6PJ+4fJYmmFVcqq0GP7ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308264, "uuid": "6137713e-6f23-4d93-9aa4-49da3b0e81f8", "value": 104137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308264, "uuid": "ae8db179-db66-474b-9aa0-fb1c07d94262", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308264, "uuid": "e889148b-bca3-4aac-8527-05a02814f9b2", "value": "da2783e507eba366aeb62d3c126d5fb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae69a524-24e3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633332084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633332084, "uuid": "ab7a5201-8616-434a-bca1-25800f1d9d25", "comment": "Malware payload (AgentTesla)", "value": "d0e2112790995d909ce7fd9abea65b07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633332084, "uuid": "a169680a-d3a6-4cfd-8e08-5936322429dc", "comment": "Malware payload (AgentTesla)", "value": "b1af5a3a684f0596d404534607a2ae8c8cb79996fbbf7081ce6b854e861168f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633332084, "uuid": "41e3ceea-8845-48c2-b005-2fb0deab5518", "comment": "Malware payload (AgentTesla)", "value": "477baf5e685c80485d04955e2c0eb2e71a538afd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633332084, "uuid": "8726a1de-2c35-458d-bc8c-f472b8188ddc", "comment": "Malware payload (AgentTesla)", "value": "e8f9a98a648289d6e74fda3b17f1cbbf49df51380187670479cf8b21e8a783ab1f057e84e4af9c3c74a4cbf86dec9e58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633332084, "uuid": "16ecaa73-5aab-49cd-a86e-3ee947d08766", "value": "T110A4236316E3C992ED4CB6ACED1E64F624BDC3347CF859814C5D489E02E7306AA37B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633332084, "uuid": "2bd7aafb-4d13-471c-9188-cb5da73cb541", "value": "12288:SN0RXA9HbPRE/YELhRebQsCJ1jx5bCrV9cbNic:yMA97U3ReMsCLzmVSN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633332084, "uuid": "38c0e0f0-f612-4fcf-8575-855eb0c3c142", "value": 464871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633332084, "uuid": "a0fbc2e2-7c75-499c-8fdb-441ed34f7061", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633332084, "uuid": "3b9ee954-f2ae-4562-a669-d14d369e5cea", "value": "Swift Copy.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390cc91d-2507-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633347349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347349, "uuid": "44f54d48-dc60-41ab-b546-e86e31836bbb", "comment": "Malware payload (RemcosRAT)", "value": "c60ee7cf0819758c3a1f40eeacd29f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347349, "uuid": "f6ae9bb3-0f62-4aae-be16-a401a86aeb56", "comment": "Malware payload (RemcosRAT)", "value": "b2106124b76cfc9fbe8b77152ea4e9c56700909e57a0a2dc0e053bc2fb9b4a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347349, "uuid": "2993c482-a110-4730-8ed4-856746bcc649", "comment": "Malware payload (RemcosRAT)", "value": "4b8d8a4fbb4402b5466e0e18bef00e66134d7e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347349, "uuid": "02a103fb-97ab-4a11-beef-5f5eef0f99c0", "comment": "Malware payload (RemcosRAT)", "value": "7bfb4f3be462fbf66ca793d7dd6d53760999e94291e92acdc79f874e781e498642ed61cb301617ba71722e00a754c754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347349, "uuid": "bb7180f3-cc45-44d4-87a1-efe2b817c2e4", "value": "T123056DA9A2A0C9B1F0220638E955A7C4051D7EE93C49CC0B6B98FF5B7EF0BD528F5057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347349, "uuid": "94c244fb-341d-4137-8e9c-765296d4bec5", "value": "4ff77f39ae1ec37d413fa1e15e4c4ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347349, "uuid": "8d1512d6-baac-4ea3-92c9-3378ad23b9b7", "value": "12288:Kz9igLiYnwThUprpw7/+mxgL5xUpWFvGwEcY8jAbfzuD:KEAiZUprpw73KSMV//ifK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347349, "uuid": "37d41114-3243-4814-a687-3abb7a61f077", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347349, "uuid": "d7adcd7a-e4df-4879-b097-8681dfa432cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347349, "uuid": "0c27c320-15f6-419c-80f1-0f351ae6b7aa", "value": "Urgente RFQ_AP65425652_03242,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559659b3-2515-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633353410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353410, "uuid": "3073e4a6-9abc-4043-86a2-d7bd52a15674", "comment": "Malware payload (Formbook)", "value": "3e730659320a4ed6b437558f585313ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353410, "uuid": "99a6d8fc-739e-43f2-8756-401738094d5b", "comment": "Malware payload (Formbook)", "value": "b241d39387ebd04a46935432e7abb733d850aa1bbbd4ca686539821f41772e05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353410, "uuid": "332b8495-0a0c-4432-930e-fde2248f19bb", "comment": "Malware payload (Formbook)", "value": "d4daac30adcf04725cdb8477ec26241f8150c1ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353410, "uuid": "a0e07281-b04a-4b04-9eb9-3f69eec2ae89", "comment": "Malware payload (Formbook)", "value": "f8023d1b17c2cdf21eb1818897da391907b11876720c40f31bac35b69daf3ae86c6a78ceeef7ad2b6012202b904ec8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353410, "uuid": "92a4134c-ff03-4378-8a7e-fc7f8d300522", "value": "T1A505C0202364822AE1F7F77CD42294718B7EFA96A03AD65A5DC3C8DA0D25341C51BF6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353410, "uuid": "6704a036-8a52-4c86-b7d9-34e923aa036a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353410, "uuid": "4060d07d-1fb4-455a-a3cb-651768f31beb", "value": "12288:pBGiY6H3FuFp8K3hdHHMUT5FZ6huvYBoU//0dmVmtiK5oxEy:pA6XFur8edHHhT5YuvYBoi0dE+Foxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353410, "uuid": "cd46205d-82db-4db8-8dde-7ccb5592accc", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353410, "uuid": "87d06a31-fcf9-4392-b873-b5208df79344", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353410, "uuid": "d14b8537-3c04-45e1-baea-1e2b4c5ad496", "value": "NEW ORDER INQUIRY_Q091421.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f435987f-24dd-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633329624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329624, "uuid": "3c1ec572-65e1-4010-9f24-00816f363d9b", "comment": "Malware payload (Formbook)", "value": "71855311af9db1549bd4f9a580196a57", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329624, "uuid": "a30d65e7-3960-4b5b-b441-32eb06a44792", "comment": "Malware payload (Formbook)", "value": "b26d7f1c78311fe2e149042bbfeb9b14781de9e7dfd3bcb1e78ec540fe316ad6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329624, "uuid": "420255fa-5ac8-4eac-b30a-aff014b06d1e", "comment": "Malware payload (Formbook)", "value": "b0f2f9c5a5d463118e27751acba702d16850f8c5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329624, "uuid": "bfed0035-957d-4052-97e0-f80865c5fd37", "comment": "Malware payload (Formbook)", "value": "d96e7fe3fb53f1f57602b9c71cc3afa2e98ffb5dbc295e5d49ee22b53c99e2ca9c76a22f77979ccf918f1d0c3157b33a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329624, "uuid": "7271c018-686a-457e-8863-23562c7e3b58", "value": "T1994512A677AF432DDCA983F5101026B2437AA5452125D67C3E9D70EC3F233B81EB069B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329624, "uuid": "f0ae38b3-2768-401d-9de2-86a8a50d9383", "value": "6144:vbhdbMroO/lGquzY2ZmmjrmQGnHpnP6aupTzqfU0IgDKTTVz6TRvdqs0QC+VkTfW:zbMrQHzY2ZDgR6aKiIgDQVyYAkTfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633329624, "uuid": "74015544-5870-4d1f-8b0a-320371fab7ac", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633329624, "uuid": "47dd50e2-0db1-4c3a-a2c2-1ad461731358", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329624, "uuid": "0dfbd7f7-e706-4532-9ec0-c9a616f2378d", "value": "PO#A91641-MSKU9953077.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5441be7b-2503-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633345677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345677, "uuid": "6ae5eced-a5ad-4e35-8edd-fbc913aa9773", "comment": "Malware payload (AgentTesla)", "value": "51d05e86870a2e622fa7034eeab4d4da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345677, "uuid": "526b2cdf-f02a-4d75-bc95-e09818c06a21", "comment": "Malware payload (AgentTesla)", "value": "b2d827b5beb2e7dcbf1972c6c1a9aee36e477dab3e8ba45c035c9348d2d7800b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345677, "uuid": "66f1ef20-75e0-416e-a4fa-fc656db9590d", "comment": "Malware payload (AgentTesla)", "value": "f084471e1d45485127010976e1eec6765a48e68b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345677, "uuid": "62f98b16-b924-4c9d-8ca9-32ad474f652d", "comment": "Malware payload (AgentTesla)", "value": "aa4e18977686f4bd3ed7fbe47fa7b2b4a12fa63eb207191251d1eba709ce99c7a9124dd485f95c51ed5061c047795b2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345677, "uuid": "ef5dc90c-9407-479e-930a-d66602004d0e", "value": "T158D4BF326A949E61C2E05F7444F79E4891BEEE1A4787C30B2EADBC203176358165FBCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345677, "uuid": "99b5b170-9cd9-4ca0-8d72-e981dc9d4510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345677, "uuid": "9233ceeb-7d27-4449-ac34-f7c4345269fa", "value": "12288:O6zzDdvir3GBksU1QtAJG1AvOBP71SdgLgVqB:Owz43kksWQtAJG6WBP74dMEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345677, "uuid": "b4a6cfd2-798c-45a8-9b02-4c8ba39b87ca", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345677, "uuid": "e0b5908b-65a5-440a-b8da-d6561e4a1e61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345677, "uuid": "c16b8eb5-2ae5-4fee-8b45-6f1abd5c6e3c", "value": "swift_copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcac028-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633360591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360591, "uuid": "e4ed430c-67fe-4323-bd08-90b7dadf8a47", "comment": "Malware payload (NanoCore)", "value": "6be6691dbec8ef8261ed65b2ccc3e84e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360591, "uuid": "c79252dc-3420-4c76-8230-0835091d0dcf", "comment": "Malware payload (NanoCore)", "value": "b34c340b11daa880854878e6ed0c49989354ef516029f824f83ecfb3d07a5516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360591, "uuid": "b67b38af-f8a4-4e9d-b1f5-5efb0547b166", "comment": "Malware payload (NanoCore)", "value": "66ecf4a0f5c532dd0904b05aa438dab6146ea150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360591, "uuid": "d617921b-ee94-4093-b986-8ccb7ef7cf90", "comment": "Malware payload (NanoCore)", "value": "5dd09f04dc2413898e5b7e50c00a5a12016a0bcb6bec3e2ff9ce2a1798c333f007604ca8d4d70b2087fd670ac21eb474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360591, "uuid": "b0724327-261e-421c-ad4e-009637ec61b5", "value": "T10FC3D40A5956C518D4AA4A73F562E1F2B8232C6BD57509132AEDBC2BBB3F051CC3CF49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360591, "uuid": "7d463ba9-ca50-4156-aa74-d58d862c6af4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360591, "uuid": "1cb51801-e3fa-4cd1-b4b6-5525684b0065", "value": "1536:djjX3pjoS3Zu9jeFJiQ+xQnQR8RVQJv2kiqXeSqQjUy8J:9XhoS37GQneIoOQqQF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360591, "uuid": "4cfb7b6a-5b8e-4510-9ba0-e9876c08c8dc", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360591, "uuid": "83a04e13-f90a-45b4-8708-7a4f4b40e6e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360591, "uuid": "ee813bbf-350e-4804-a5e5-7e8f95ccf01a", "value": "J5K18S6C5V43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb3dfab-2516-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633353876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353876, "uuid": "c0c6e7f7-8461-4ff3-9fce-dc5ce264e767", "comment": "Malware payload (RedLineStealer)", "value": "2177743409ec5fd02a58e371ad413429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353876, "uuid": "3436866e-977b-418e-944f-55aef6f9d201", "comment": "Malware payload (RedLineStealer)", "value": "b3830ac26206a05fa89bb58269aab31ec7edb2cd1c77c9bea6332e53363eb83e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353876, "uuid": "15a9cf85-02d1-42c0-be49-c329a7885e30", "comment": "Malware payload (RedLineStealer)", "value": "b739d4ee9fe36a1ac527e588ce3f05f8fc73c322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353876, "uuid": "ff5e8dc0-a659-458a-a177-d0e6728d0a06", "comment": "Malware payload (RedLineStealer)", "value": "549333f09120a89f0a390ff1742bbdbb6036b52c68a51d262854c4fdfec8b8cb8ca9b2f8bcc520c980c9bf69d3ad2655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353876, "uuid": "955ca744-9aee-4a08-ba16-37d8329dc663", "value": "T148659E1232C59D58E03E4770507D849063F5BE4BB725CB1E398FB3598EB274B632BA1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353876, "uuid": "1bace9ef-573c-4142-8dde-fc6249a7d902", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353876, "uuid": "8ee1cb6e-722a-4f2a-aa37-3c8046b9a7ac", "value": "24576:m6lQhZAb3hAdWX3rlZU/0b4vS4C6dF2jSn:mxQrlZnb156Dw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353876, "uuid": "d921b5a3-2447-4ecd-99bf-ce673a45cc0c", "value": 1418240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353876, "uuid": "936f6b3c-6190-453e-aa41-29c6778d81d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353876, "uuid": "41cfbf31-9859-4e3e-b79a-5bca39a979a2", "value": "BETT AWB8876E73_SEPT1721,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02990639-2542-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633372598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372598, "uuid": "50592be4-dbf5-428e-96ad-21a67aa8bb6f", "comment": "Malware payload (Loki)", "value": "5f0c47ef87ccbe34bb6f84448efb3a35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372598, "uuid": "0771f3eb-4bca-4abe-a460-9f7b01ecd789", "comment": "Malware payload (Loki)", "value": "b3e414f2ca80ddc1a7ccc59dda87f0b141f0dafd3b1879b1ea1e3c97c6829ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372598, "uuid": "83d067d7-ca2e-41d0-84c2-9faf8fdbb60b", "comment": "Malware payload (Loki)", "value": "6924efcc70aef057a3b460aff90bdb6949e65477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372598, "uuid": "1730c22b-5d1e-4cc0-b368-88ad543cf4b3", "comment": "Malware payload (Loki)", "value": "da7d7949b246e0e143ed18d2faeb2f2524099ece23f176f40383122015e88fc5a2dc90537a5ab63586217710342cd023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372598, "uuid": "3bde6cc4-55d9-4796-b8fe-7680fef61f38", "value": "T128F407B4BD2FC259FC0E07B07625EFC51F9A0C58182DE42B6DB974D12C79CA582E11BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372598, "uuid": "04babc13-c1c9-4956-ada5-5e983f72679c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372598, "uuid": "6fac0b4b-d108-4dbe-bff6-dcfadc9e5208", "value": "24576:OD4VHfQe6ZyWshg+qbZxTZZWunAWvlCaO5difB8HntoRKRBJPD:SFtidQGHCKRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633372598, "uuid": "9ddd5ab0-6115-4553-9a1d-10889fdf5657", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633372598, "uuid": "4b81a4fd-8dcd-4f2f-86c5-fda6dd11dfa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372598, "uuid": "3a663d53-1ce9-46cf-9c2c-8feefa8e2ac4", "value": "5f0c47ef87ccbe34bb6f84448efb3a35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b8ce94-2517-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633354234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354234, "uuid": "4e0081d0-73d3-427d-a9e0-9c3f8aad5a26", "comment": "Malware payload (RedLineStealer)", "value": "6e31fdddbb864b58c5e86db3d982623f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354234, "uuid": "78d6a458-2a07-459f-b981-e0577790f7da", "comment": "Malware payload (RedLineStealer)", "value": "b4128301d454d31457b417444aabd1cebcf98bacf53caff844f47946c2b02b3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354234, "uuid": "f56aa50d-4e5d-46f6-af13-e3995bac0f81", "comment": "Malware payload (RedLineStealer)", "value": "0b65c01b9c53cdc878d5a83a71a88d516a738a55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354234, "uuid": "eb75fd63-2431-408e-9c06-ddf38f2816a5", "comment": "Malware payload (RedLineStealer)", "value": "a526a7b682508e0af9654158fa94eed620d1252524b4408b81e1d4eaf6a96e87ab819fc1f7a1a9eff26da332d6db0c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354234, "uuid": "13952845-4f2d-4be2-928e-0c2badef98e6", "value": "T13A35380077E88615F6EF1731D477478512B7EC8A6E2AD38DD8C4BDAA3DB2B4188117E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354234, "uuid": "dde877f8-a568-40bb-bf1a-f7d87e610078", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354234, "uuid": "cf1de2b4-e8c9-4e6a-81f8-3dea1cdc78a5", "value": "12288:OuEEUpOPynywjUQTQCG4GpVV/gecNU2zqX6lUB2Ake2:OuLoBnn8BCDNgWUB2Ake2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354234, "uuid": "46f5269e-a779-4b9b-8e91-25c8d05b8abc", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354234, "uuid": "fd169c6b-4f4c-473e-ad95-85d179ee6524", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354234, "uuid": "057bb199-69f2-4676-bdfd-4c8dd28bd157", "value": "new order 2400 kgs Rab01.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe46248-2525-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1633360353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360353, "uuid": "2fbc3045-22e5-437c-810f-4403f6ccc4f4", "comment": "Malware payload (DCRat)", "value": "88a6eefe1d2e90a1f1fa9abed3bfc6c2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360353, "uuid": "84974333-cdee-4562-97e6-628132981ca6", "comment": "Malware payload (DCRat)", "value": "b418cade9d96b482edca9d7dfea84608255890eb87327720279f9c822b6ffe38", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360353, "uuid": "4a7141a6-b1ed-46c4-8f97-9e621bbf4757", "comment": "Malware payload (DCRat)", "value": "0e024bbcc20bc0030e22fc803fef334c702defbd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360353, "uuid": "20bdeefd-9670-4937-97cf-ea6c3557bcbf", "comment": "Malware payload (DCRat)", "value": "274f07035cd9b2a649235a9495732fd17edea8051903268613ba456fad9db18073b2431cb3c26bd1888ba3529af1d5a7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360353, "uuid": "645bc2a6-455d-421f-88b3-392299b32d0e", "value": "T1723549127A48CD02E16D163BC5EF445447BCAD427A62CB1A7EAF33DDA1113A72E0E5CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360353, "uuid": "a67c5d92-e72a-412a-919d-12364117cfab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360353, "uuid": "d0463cd5-3212-4fab-b55e-549e37d06ee1", "value": "24576:s5zrnSCKWCVpC7v4ncKA/p727NiRKW+4:sNSXg3pKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360353, "uuid": "098de7cb-4908-4a8f-9e8e-3e73ae50120b", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360353, "uuid": "c7685526-3ac4-458b-9c3e-6098735b0a4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360353, "uuid": "8da0b77c-bdd0-41de-9b6a-b3b9bcbff3a9", "value": "b418cade9d96b482edca9d7dfea84608255890eb87327720279f9c822b6ffe38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1897a47a-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633335269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335269, "uuid": "9352e6f1-88f0-4a81-82a1-c19c849828a3", "comment": "Malware payload (SnakeKeylogger)", "value": "690ae5c03fceac7cdba707246d297304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335269, "uuid": "e3b0f78e-2a8d-45bf-80c0-8201ccf71a0e", "comment": "Malware payload (SnakeKeylogger)", "value": "b490a33c54dffbff9e9f0f01387a98876fb235df39bd91030680c619fd1ff336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335269, "uuid": "97f8a689-a3cb-4d3c-b4ba-58234d8da360", "comment": "Malware payload (SnakeKeylogger)", "value": "959a4b417cd0e1d4d0b60ba9f9340321d7764307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335269, "uuid": "7a735424-ded0-4bd5-bb64-397030835d91", "comment": "Malware payload (SnakeKeylogger)", "value": "1191d7da9ab85a5e16e518ce5b47d4356c2260d031b6bdbbda9984164aacfefd609048ee2f424c33402c3655616d0d72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335269, "uuid": "1114d951-7c18-4bd9-9a5e-e8eefc6c179b", "value": "T184B4D09134A8C1C3E5BE4DB26D6EE13130E5399DE2DA504F369AB72A60F2392405F37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335269, "uuid": "3354fe64-8993-4c8b-8c99-c5df0dd5ac8b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335269, "uuid": "d9dd608f-6374-44dd-b913-08dad3719510", "value": "12288:AGlaKpNOTJ9uK/pm88AGgLRC/1R83M0sQj1:JlppNOfMZT/1d0/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335269, "uuid": "af5659b7-0cc8-4644-bbad-e93840ad2d3c", "value": 517419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335269, "uuid": "de0479f8-4b7b-4922-a31a-a0bc4d5457a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335269, "uuid": "8f836368-4c91-4b5b-aa99-70c77f966560", "value": "New order_WJO-001, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4aa30f5-2525-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1633360549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360549, "uuid": "3fb4000b-5d65-4576-bea1-48aefedab279", "comment": "Malware payload (Dridex)", "value": "b3513e24471feef7d01f4e74fbfaea76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360549, "uuid": "eefbc10b-1040-42bd-a88b-5771fb191a85", "comment": "Malware payload (Dridex)", "value": "b4d5d8727bd02cd0506998202159e38b61e0351e989a717dc30e63f3d66f0e50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360549, "uuid": "ac28dfa7-4b89-47e2-8d9f-f0861efec71e", "comment": "Malware payload (Dridex)", "value": "d3e5d3d9cf5854e217f40d2ea329d99b270aa77c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360549, "uuid": "6ad0edc0-c0ed-49dc-bad7-366b43c7fbe8", "comment": "Malware payload (Dridex)", "value": "34deb3b160d27d9ff0cfb4c7057a9d151bf0649a85dacc97bcdccc34c7fdd4084627db14b41ffe564ed1b547c7ecdbf1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360549, "uuid": "b2bb207f-6de0-4530-bf78-92ff613a2e63", "value": "T183E3E03A62A24C0EE7EF4C3B73DEAEBD8E7963200951573643F960063F5737A6552881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360549, "uuid": "73969247-9516-4b04-898a-ff60d52e1f8f", "value": "3072:wun43Yu7BIXBwsW18Be8Ps2TpGUv+6aW0ru4+sENH:p43YuFIXCsWyD910xm3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360549, "uuid": "7bc73ad6-c811-4ae5-912a-b78c5c2212ba", "value": 155676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360549, "uuid": "5eeee176-0ee9-4cc4-a96d-3c00ed17288a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360549, "uuid": "e22612d1-8e1e-49a4-b930-9a40619b5019", "value": "Invoice-79512_20211004.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3748142a-251f-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633357654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357654, "uuid": "35e87aa8-903c-4151-837d-81023ac589a4", "comment": "Malware payload (GuLoader)", "value": "986c2bdc3c7fe164e42aed46839f7322", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357654, "uuid": "482fca2b-7d07-48a4-a8b4-73c4a53ade9c", "comment": "Malware payload (GuLoader)", "value": "b561c4a77bc25a1ec8b30467169651c6f8006e7707e1ce130ae37daad25a3db1", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357654, "uuid": "d7f60567-61ff-457f-b738-d79091a6efc5", "comment": "Malware payload (GuLoader)", "value": "3c0673487d3c0529dbf9e5366971540e56dc5eaf", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357654, "uuid": "2e4469f0-d1b7-44ae-9fd5-31ae2dc273c8", "comment": "Malware payload (GuLoader)", "value": "8d9e51d01ae7a39089f82fd0d3569e0bc23725b63941ceca4d7e669827a586f7a563efdb411fc20ab30a407adf558034", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357654, "uuid": "027d2cb9-00e9-47ea-bcf3-030256b41247", "value": "T19EC37D23DBC14D20D59DDD7336676DD113066C0AE4100B2E2499FBAD6DB27AEAC9838F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357654, "uuid": "4f851172-2408-40b0-93b1-16c2cc2bba32", "value": "a661671ef02a6d0e6a34eab52e2e0015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357654, "uuid": "3ec5cfaf-c421-4940-96e4-b29d61a713a7", "value": "1536:/Z2CjH+uXbffrobhrMnCThWtfe8KTvecsitt0pIMG127:xj1rsdMnCThgfJKTzd70pIVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633357654, "uuid": "ca00dd2f-636f-4e93-88af-a910d9a1ff47", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633357654, "uuid": "270c940a-f937-4f82-9e25-dcba9fdb832e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357654, "uuid": "944f3db1-5119-420b-a614-40ef6d26ba9c", "value": "justificante de la transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c87e470-24e8-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633334201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334201, "uuid": "f52b659a-7406-47df-bbcc-778712f25898", "comment": "Malware payload (NanoCore)", "value": "0fac3790b807090b1a3e15d09591ff9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334201, "uuid": "ee6a7269-6362-4946-9dfa-254d2c852663", "comment": "Malware payload (NanoCore)", "value": "b60944be145708e5fbe0bf5f038a6dda5bb8bb2ef535520744b89b8f2e82b07c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334201, "uuid": "e4bc0543-ebf1-4ab8-bb86-a8b091a78d04", "comment": "Malware payload (NanoCore)", "value": "005c209528c1f54e4b124ac2a9cc422cfd71bfee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633334201, "uuid": "dba93cdf-36e6-42e4-a9db-43daf2014f41", "comment": "Malware payload (NanoCore)", "value": "0e360f604758a0fbc44ca4bc120a076348ee214dff9640da4ae47676303192d1adcc068c2aeef21b65ee920c2b761cd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334201, "uuid": "db526e70-8527-49f4-bc69-9f007fbc09b5", "value": "T1954502127794C8F1D5622931CA35F6F51E393C20DE24991BB3E43D9F7B36190622ABA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334201, "uuid": "fa805a81-600b-4224-9a41-4c1f0cde5389", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334201, "uuid": "6f31126d-030c-4fd5-b1f0-9fbbee9c1ea7", "value": "24576:bAOcZXGN8TpRbQBUB1AEqI1/csX5pO0i0buNTwMxW:9SKUB2IhcC3O3mMxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633334201, "uuid": "197e6bc6-80df-4bc2-9829-9aeabad48095", "value": 1238428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633334201, "uuid": "6a4f2c7a-26cd-467d-a23f-a5fe79e413ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633334201, "uuid": "393fe523-17b5-481a-8fa3-c9a79e90ca9d", "value": "New PO#44273-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd56638e-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633353181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353181, "uuid": "878a93b2-d6a1-42f2-b2ce-9d27225575df", "comment": "Malware payload (AgentTesla)", "value": "44fb31b265ae3031f7da3ea5a97ff61d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353181, "uuid": "8f9054d7-e447-4e9c-aa70-f64e0dd8d173", "comment": "Malware payload (AgentTesla)", "value": "b791fd17d5f35d5a84c5dae58e75dc083e5f27301a86e3192c096ee8d35efd15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353181, "uuid": "acf43d03-2cb0-4504-b14c-7194d2d1c86b", "comment": "Malware payload (AgentTesla)", "value": "d86a1426fb8f5a271ae29aad68e40760494bdf90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353181, "uuid": "366265c2-e756-454e-ae1b-15982012a39c", "comment": "Malware payload (AgentTesla)", "value": "93e2a595d8b4390ff3b7e93da900e9694db91063c95b010c02ad6f79f7b39d4d900073a8b8e1041038f5ac0f7bd275e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353181, "uuid": "f4110bbd-850a-4386-8c9b-368f604691cb", "value": "T1CB35CD294D2682F7C7EEC62CD09C0FCEEB62A4837B918F1ED89187D6065770BE58845D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353181, "uuid": "81ec6b5a-d2d0-4a7b-a3ea-0b3bec3a208d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353181, "uuid": "9db15d1c-86c5-4c53-9875-64003b6dddcc", "value": "12288:UpYu9wBNV+wscQ3inwmc5ntSFS9jGP9nN9aZ9xfI:UpYuCBP+wxwmc5EFS9jINc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353181, "uuid": "a7d39644-1c45-4496-9c3d-300bf0c6c3ea", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353181, "uuid": "f353686a-097a-4e2b-b9e4-c79715382894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353181, "uuid": "0f098b46-615f-419d-a0f4-9d01453eb28d", "value": "437_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5beadb-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633360915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360915, "uuid": "a8f33b00-9bb7-4a96-9695-dbc2b6eb79a7", "comment": "Malware payload (Mirai)", "value": "875a04a6409ddac414f3dc906d710af2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360915, "uuid": "9be1197c-1d4c-4df6-87b5-c26289a742af", "comment": "Malware payload (Mirai)", "value": "b8a062e4287dcd900ad441e41a925a042e754642a23c08faae49d8505595f902", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360915, "uuid": "6d3e3c17-ce55-4653-aa56-413751d1f258", "comment": "Malware payload (Mirai)", "value": "a4b9b377a5364950a59c377ad298e8795b0572df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360915, "uuid": "76b029bc-fe46-42c6-9dae-c2e2010a23b9", "comment": "Malware payload (Mirai)", "value": "8aa8090beb979a31c3a0e5718af0d5bf79aaa40ec180fc1cff19ab0a232d6802007e3cfe6e67ff13b2395fd95e987b0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360915, "uuid": "faea5d63-704e-4292-b4a5-6d875e8c2ca2", "value": "T1F86382197F650FF7ECABDD374AE9174620CC641A21A87B397A34D818B20B64F05E3879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360915, "uuid": "f331494f-6b53-406b-9ae2-ffa1568b3b49", "value": "1536:0SbdZCypJdq8NPx+GJ0sggN8G2jTJa7Zb+Kc:D5ZCypJddx+PTJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360915, "uuid": "8270b854-c540-4516-8d9b-e96ca60898d7", "value": 69132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360915, "uuid": "716efadf-52a2-4c14-97d5-8159db1bec54", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360915, "uuid": "8bd6f6b9-1e21-420f-9713-b93b1ea6ed69", "value": "875a04a6409ddac414f3dc906d710af2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cb8967-24d0-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633324038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324038, "uuid": "10b8540a-81a2-4f63-83f6-52ba1d2bb9e3", "comment": "Malware payload (SnakeKeylogger)", "value": "04bd01c5343cef0a9eb0f9809c38a6d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324038, "uuid": "d90a61fb-eba9-4923-a968-e15cecb3674e", "comment": "Malware payload (SnakeKeylogger)", "value": "b8fa22ad08fdaffe595e3a99a93332682853a3f20c16c2432ece2298b54a4c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324038, "uuid": "e01f1865-b3ba-4b28-b1c3-871bebccd998", "comment": "Malware payload (SnakeKeylogger)", "value": "b328b14774af852bda4f2b920c0edd51fbde628c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324038, "uuid": "1f9dc4ba-e2cf-4ebd-97b2-583ba8026eb7", "comment": "Malware payload (SnakeKeylogger)", "value": "64aecb74e45af0971657ae233e06bfbffaa61bfd5a447633aaadf5959a62a9fbe1137b8f24433bed65404abeaa2da853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324038, "uuid": "0d658dc6-0bc0-4ed6-b368-5309a9d651b5", "value": "T1AEB4CF9C7654B18FC41B8D72C9541C64AAA0AC77570BE307A85332EE9A3E2DBCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324038, "uuid": "d3af2f2a-5489-45da-a91c-1fe3e6530597", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324038, "uuid": "48eb2701-9edc-46a6-96f8-f14dbe3c5be4", "value": "12288:jvaeRgxSr1xU+foFkTvDXZqoO4Mr1FyNEukjDw60cI1ocq5fAVL:jXTr3UbWDDXhO4M5F2kjkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633324038, "uuid": "785d0bdc-8815-46b3-b334-48cd1691495f", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633324038, "uuid": "dfb7bf85-963d-4cda-965e-6a7b2d7b0a4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324038, "uuid": "231f32b8-78d5-4e77-987c-570ca860bc7e", "value": "04bd01c5343cef0a9eb0f9809c38a6d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b0880f-251f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633357631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357631, "uuid": "0dd23ba6-eee0-486d-a6cb-8facf80b7e92", "comment": "Malware payload (AgentTesla)", "value": "582c2e132b995d5f52bd801b6f371f6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357631, "uuid": "bc86f05c-a0ad-4f42-8baf-1934efde06ff", "comment": "Malware payload (AgentTesla)", "value": "b9ed697a35e1732eb2edec5429c4293eec9ff17acad9ba9f208c19a862899960", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357631, "uuid": "f2f6b2b8-3147-4bbe-9ff5-39d2953bc38b", "comment": "Malware payload (AgentTesla)", "value": "531c73521bcfa5bd4770ac93d95255fd0b5c46cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357631, "uuid": "2ba5b28c-18b5-4983-b7d5-a1f7da822d15", "comment": "Malware payload (AgentTesla)", "value": "08067182b35c9b76ff5c7d370c2abf80f9a5227805829b14e9afcd2a88387bbcdb081664475b21bfd0a587bfa235bd3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357631, "uuid": "b7e20878-2039-4afd-9431-bc1306d9e594", "value": "T19094027873F75310CE748BF52824A2614BB6752A205DC37C5E98E0ED3E62B782AF0597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357631, "uuid": "816d2d37-c292-423f-a5c7-0aad89e23899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357631, "uuid": "b29d9c77-b8e4-43c4-8a3e-78fa6ff42948", "value": "12288:3JESou00yBg7gyXYekW3TlcWDTS7jKG+1fp:5ES2XBMbbTlx4w5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633357631, "uuid": "22aff448-3325-4bfc-b992-569ee21b2a40", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633357631, "uuid": "8394a646-d6c9-48a9-9280-838cfb229174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357631, "uuid": "e6a67786-36ef-49bd-ae60-3bb030cd1803", "value": "informaci\u00f3n bancaria__________.pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a682592f-253b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633369866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633369866, "uuid": "6329f91f-4481-48ab-a6b7-002c7ea28d88", "comment": "Malware payload (AgentTesla)", "value": "151b5c080f8acfe6812183bad57dde3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633369866, "uuid": "03716b20-f81b-4ebc-b042-c280a621d86b", "comment": "Malware payload (AgentTesla)", "value": "ba664eb6a629d2e9be7550fb969645718f1382c3e8dcb80afdfade7bf0c362cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633369866, "uuid": "87d55def-2e1f-432f-a921-d2fca62bf497", "comment": "Malware payload (AgentTesla)", "value": "715f5db01e8d8f122448cbeaba4f3f8bc5fed69c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633369866, "uuid": "7a5d4132-0686-4c35-9c59-1e841b78285d", "comment": "Malware payload (AgentTesla)", "value": "af622e35deb1f745395d636cc223b5b4b25a75cf2c4ead775a2979fe8b271c72a4d8675142de8a14bc8118bb0c091b42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633369866, "uuid": "6efea69a-5b0e-447f-bc74-82f798361a33", "value": "T133251A9013CB9EC0F47B6734B0112CE7A6FE660DE379CB1569963AC78DB6B40461DB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633369866, "uuid": "8357b586-5710-471f-8a76-dbb01f73f34a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633369866, "uuid": "22fe3982-14e2-4d63-8e30-89fd82825aa1", "value": "12288:s3lK8FluRs7Z8z4asvs1drdyImcHFebpvqgXVC2K046Mnq0UnsO5lJkKzUvoPUuW:usXkkIsH9jawmYM3Nzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633369866, "uuid": "577e983f-9bff-4182-8970-7b62d8196ab4", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633369866, "uuid": "d149fa57-d458-44a5-a8ac-0c623c382dfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633369866, "uuid": "a0ed9846-8fdd-4089-a020-d3d2cc3293c4", "value": "DHL TAX INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591a7b42-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633354704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354704, "uuid": "e765baaa-070b-48ff-baf3-24f90b803921", "comment": "Malware payload (RedLineStealer)", "value": "2f2dfc3fd51ed226e92c23e178aaf460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354704, "uuid": "ec5b7b6f-0374-48f1-98f2-bc4f2f2bab51", "comment": "Malware payload (RedLineStealer)", "value": "bac0c8185e0acaa0442d5f62270158f620bfa0260c641aa4b25e86ef6687841a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354704, "uuid": "4e22f304-71eb-4d12-bb53-d8b63624c89a", "comment": "Malware payload (RedLineStealer)", "value": "93213d2574a1f540c570cc8ef945ed9e3d8a9a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354704, "uuid": "23729d77-525f-4475-8071-4df5dfdd9fa8", "comment": "Malware payload (RedLineStealer)", "value": "9bc546173b65290da248455384e81923a16a938858fdf70d5f5a60c7bb0dd445f6d61b85bd3584eaf4d3d7241a6563e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354704, "uuid": "87e47e65-b11e-490c-9e83-2fb84439fa75", "value": "T153B23C3ED9E78CD7DB921AF6767093400ED794126F371B9A3096F089983E7102B0D9E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354704, "uuid": "21d4a693-89c1-43c9-b5d3-b7e7f51858ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354704, "uuid": "34d1ea0a-6f34-43dc-85d6-94a54368e9c4", "value": "192:Gl0Fa438PX+G2oxPQgtOgGvj9CCYTMH1joEcxfwEiKCjxfw5NNJ/P7uM:C43S72opvtOvt6Y4BwEapWNJ/P7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354704, "uuid": "32f6f498-d56c-4c9b-8e29-65f8bed60561", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354704, "uuid": "b4bae20b-338f-4c3d-a1ea-e34bbda4dcd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354704, "uuid": "797a1aa2-0372-4e2a-be54-8185ac6f5fac", "value": "^951105805^ICNIR00112339^20210630^^^ACC^^^^^KR^^IBS^^BIV_FRI_ICN_CO_JAS_20210630_125959_PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30df3266-24f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633340893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340893, "uuid": "33334eab-0d72-4125-bfe9-650a4b59b03c", "comment": "Malware payload (Formbook)", "value": "d021c22ba09ae67c07936cc698af2bff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340893, "uuid": "4007267f-0463-46dc-bd53-68f6c1a14f86", "comment": "Malware payload (Formbook)", "value": "bb55c88ca46b3d34d58e0fd9eacedc2a4b753f2d6e7d9d1627ba2fd914deac71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340893, "uuid": "49447a78-d09e-49f5-9a70-1e8306cadbd3", "comment": "Malware payload (Formbook)", "value": "3b6f6298e83776e44362f558df9aff9128f9bebc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633340893, "uuid": "b50e9fcb-5304-495d-8b1f-a34fc052a012", "comment": "Malware payload (Formbook)", "value": "65ed33c15af5a10686bb686f2149b3aa14751b1abcfdb3ea77ea1bc4a67637393e5b4e4e1e4c8e1a20cb769e9757b40d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340893, "uuid": "a43f810d-1d76-4fd3-b459-c002b855c975", "value": "T149549D229601C030F2A245B1B26AC7B687FFCC3C6615D3A7AFD13AD56FB0191A5253DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340893, "uuid": "9ce7eda0-c662-4169-951c-29f1a7c72643", "value": "034798d5891f6a110ab94befc4c55274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340893, "uuid": "066b9396-5a71-4b9d-93ff-9a0d58711cf1", "value": "6144:+ajB9wsfkJuoMQF9CxX/tO7JS4PIcJ1Eyo:+aNHQRMQHg/tGTPBfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633340893, "uuid": "ccd158d0-f4a5-446b-94e8-912df8a19a33", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633340893, "uuid": "5186c4d2-e991-4e53-8031-d05b217f3a4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633340893, "uuid": "95242234-2109-4abb-9768-2c81717577b6", "value": "d021c22ba09ae67c07936cc698af2bff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82aa9e2a-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633353056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353056, "uuid": "dbf4e3b2-be6d-44e0-96ea-864163f90841", "comment": "Malware payload (NanoCore)", "value": "d146d650bbb0bdeb752470be5c428037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353056, "uuid": "ba527815-aff0-4a6c-875a-b058a65cd3da", "comment": "Malware payload (NanoCore)", "value": "bb807a0566dde57d498b3549f6fbe2ccbebbd96d02796cf2be8d3dd014658933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353056, "uuid": "f8f378b6-8465-4be8-9a09-b0ac1d4bc80d", "comment": "Malware payload (NanoCore)", "value": "b52ea645e816228c76f2453b386747d2ca5724e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353056, "uuid": "d602e4ff-52d1-42e0-abd5-9c66bed58f95", "comment": "Malware payload (NanoCore)", "value": "85d6590265f1b3a77e42203237af2744591588b3a64fac31b7063dd00cad78483ddafe070236edb0a91e3403c711e136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353056, "uuid": "bd194877-1817-4e70-a006-39bbdb61a5d6", "value": "T15494F1A8A3335651DD3987F12C34A69153B69D2E2069D33C5E98F4EE3B733B416E0983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353056, "uuid": "464e9ec0-9406-42a1-a3a0-489c35875237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353056, "uuid": "9b6f1dd5-aa79-450e-ac78-21f1d998c721", "value": "6144:mKbtUTERQ+3HwOQunhiB5iErUulFKxBtucsOzxIw64E6Q4kMlZrDpgXk2p8BirFU:1qESoQsC5ijuSELYxIwk6Q4Xl7ntZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353056, "uuid": "79e2efbf-5ab7-4af4-8ba8-d455b3de9c47", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353056, "uuid": "5d7c7495-199d-450d-bcaa-970287c58354", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353056, "uuid": "cbe2fe0f-b6c9-4443-9b68-db5aab568440", "value": "payment details.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6354ac-2538-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633368376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368376, "uuid": "d8a0e230-f7d9-4622-934f-9cc39fb85dee", "comment": "Malware payload", "value": "731ba8db421ddaff4337a141afd214ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368376, "uuid": "39d1ba2e-2d63-4ce3-842e-91be8b51f0bf", "comment": "Malware payload", "value": "bbb7e921c02c44367f13533453ae6d3ab8390dc1e7a4ef27ecc655b76b3248df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368376, "uuid": "e8ab4288-2c7d-41bb-9584-1fc18fb85018", "comment": "Malware payload", "value": "c1076efa4f4dab9890cf04164366251467515a31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368376, "uuid": "bbe17402-c47a-4903-96cd-5c1b2c7140d7", "comment": "Malware payload", "value": "08635907ba9d73a1959a83ac8e168136c7da05ea3d3edfb5c17eedb46ed8c4ddcc84ed72bdf5e1f3f20ec2a71652d5fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368376, "uuid": "65b1f698-ca76-4ab8-bc2b-f27b91e918c2", "value": "T1E525001165609F3BF0B927705068F19567B4ACB2D710A3FAE1C43AAA6FF02D36568F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368376, "uuid": "ce8f8c33-33dc-40e6-a192-8636f2d11201", "value": "e51ee40ae0ed0decdf850b45dd7e4ce6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368376, "uuid": "ca383cba-d78b-4990-8f00-9f27ba619d08", "value": "24576:4QJShOWYqQnzsQNvQFe0MTMoBNE+OycrhZkI:nJShdqsQNvQF9MTMoHohZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633368376, "uuid": "f501282b-53f9-4295-9144-ddbc3f16e951", "value": 1015592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633368376, "uuid": "88ee0f22-d868-4b12-9080-b5d91ca06d1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368376, "uuid": "0fa624e1-a8a0-4b75-9bc8-cd557f3bd41e", "value": "bbb7e921c02c44367f13533453ae6d3ab8390dc1e7a4ef27ecc655b76b3248df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e117269d-251b-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633356221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356221, "uuid": "2670768f-acea-4315-a961-39217a0d8969", "comment": "Malware payload (GuLoader)", "value": "0f73289ff5a72fd093fd215e9f60b0d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356221, "uuid": "1a8508c2-eb6b-46c7-aa11-7b3180c8a820", "comment": "Malware payload (GuLoader)", "value": "bbe723629dde9645172e5d1dbf2cd5b252b6c91e589296db86990453f329cb3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356221, "uuid": "89224d9e-a32a-4d8a-a518-e37f689aa786", "comment": "Malware payload (GuLoader)", "value": "e7f02c6df482dff093157da64e92841dc783da18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356221, "uuid": "e5d63c1a-62bc-4513-bb44-7fdea51ba470", "comment": "Malware payload (GuLoader)", "value": "1559807c85787aa05a3032d9f795c66ebdf3e7e3ccb8f9886af8a9d6aae7bdadadb999f3cbdf44aa050b4b43fb46fc17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356221, "uuid": "07ddc0d9-a065-4827-a6c1-43ecb1354bc7", "value": "T1DAD308A377C8FE66C05684F1A70881A4C870BD385D562A83B1CD3E3E2BB5AF5E144BD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356221, "uuid": "baf7f20d-d1f5-4325-b3d3-2848684acc1a", "value": "84354178604622e0a5b23c227959c589", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356221, "uuid": "65d857fe-70b6-473f-b71e-775ce3fa1223", "value": "1536:Duc1rbKPbr3viCXvG7kBhn5Pr4EPRpaIaRk412ROSMJpIPRUg:VnKH3viCXOoBhnBr4VRt1WtlRUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633356221, "uuid": "fa88b7e8-d1d2-4805-9930-83882c256d1e", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633356221, "uuid": "bf47dd5d-01ac-4051-8e57-f33929d30e73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356221, "uuid": "c8795214-e75b-496d-b66c-71bb135a5e7b", "value": "0f73289ff5a72fd093fd215e9f60b0d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7905ff5-24d9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633327804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327804, "uuid": "3eb508d3-46af-4658-86f2-33f9da7594ec", "comment": "Malware payload (AgentTesla)", "value": "aba609a693cd895ebfcdbf496c118e89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327804, "uuid": "634b9158-c7b6-4eac-bf52-9f3641915f62", "comment": "Malware payload (AgentTesla)", "value": "bbeb4233e43c54abd02d91cace9dadc38ac342fc113700d80b9eec62644470c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327804, "uuid": "b02bb42d-2de8-46e3-9ca4-cba72783cb98", "comment": "Malware payload (AgentTesla)", "value": "972e78e14ee4042d0cd1ceac5fd0929f36bd6329", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327804, "uuid": "4a620d1e-260d-4f75-8220-c94faf7f775a", "comment": "Malware payload (AgentTesla)", "value": "a34a49a9de838a9c478bab57ee5be06d596dcad69ffe46b89dcfe2cbe655c2a13eb9bbf4e646c089d154ad85b00624d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327804, "uuid": "3bc6cbea-a4c9-43ec-9044-25c8b9bcbf32", "value": "T154C4231E2B1BBD122435EB7E566B576C332146B9B2709E88503B4EDC33D616871E2CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327804, "uuid": "a8369667-fdb6-4994-9b34-fb59869f051e", "value": "12288:ZuNj3ysHBbPUk0fIYmSZ0h26uFVHuHippSQe6iM4kEaRsA:ZuNj3LBbMeYj0gFV15P4kEaRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327804, "uuid": "4fe19774-34c2-4ef3-9e53-ca26b9b07be6", "value": 555388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327804, "uuid": "a4bc3aea-df7a-408d-a857-07fdf3332f4a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327804, "uuid": "7c655675-26ef-4d4a-a2cf-903dc6fd8eb3", "value": "SHIPPING ADV#GOLDEN TULIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0719798c-2504-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633345977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345977, "uuid": "5cbdd277-11d6-48bb-bed4-58f4f86790f4", "comment": "Malware payload (AgentTesla)", "value": "690108f637456923feeb43667e61a6fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345977, "uuid": "00aaf4d3-8e85-466f-bd26-9c6ab01a78ba", "comment": "Malware payload (AgentTesla)", "value": "bcd0dfbf47d031ace8308fb63b52b88365db738270b37cae3042c71a6f3875b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345977, "uuid": "ce5b23d4-ae17-490a-95ca-d5a206d2a1a6", "comment": "Malware payload (AgentTesla)", "value": "8c4e29cbe5e659d6a8ef933bc6d1681bf8c7f1d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345977, "uuid": "5676b3b7-0b07-466f-8919-865abdc71ea7", "comment": "Malware payload (AgentTesla)", "value": "47e836501f0fe4161c5394b59f3d2124530a261093c17f723858f1c0625f1a3c35e2824b4c1855481c86bfb187f01920", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345977, "uuid": "a430fbab-aeee-42a3-87c9-8ddd26b07449", "value": "T147D4F19D13AB5644FDBE87F5B87091805BB2B8272409D73C5E8028ED1C737E48AE5B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345977, "uuid": "59f5b257-82eb-4b46-a5aa-6defec72c0ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345977, "uuid": "0c7a7e07-0a9d-41ca-bbc1-a5bb77b0a48a", "value": "12288:CV3oGEXxlPGyYiYs67QQ4OTC/SLQdA8QaiPCJT6YashlM0JT6YashlM:OahVGyte//LOl9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345977, "uuid": "fed1180e-77eb-431e-a07b-29d4f336e541", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345977, "uuid": "5223b00a-985a-442b-9f85-e26344d5be86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345977, "uuid": "6f64a6b3-ceba-40e5-a923-97b170cfebf3", "value": "Machine Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f583e8-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633352929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352929, "uuid": "8481fa1c-de5d-4155-8ec6-7843f7aa2a73", "comment": "Malware payload (AgentTesla)", "value": "dba57216e799d9ea8ced123c8c2d43ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352929, "uuid": "c71c5609-a23b-4257-a51d-f7fe193437a3", "comment": "Malware payload (AgentTesla)", "value": "bd15908b692dc5e2cb04e0b732f56445ed390b09c7feeba7a367e9b10053cf22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352929, "uuid": "6328ed64-042d-4520-a35b-cfcc9d20b075", "comment": "Malware payload (AgentTesla)", "value": "4bc968661cb8a3eb77bf57300dcf15013381b7f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352929, "uuid": "8cf4dd61-37dc-4c94-a06c-bf099ac5399e", "comment": "Malware payload (AgentTesla)", "value": "ac3de953913ec48d2bb8caa6552fc96f33009bea19c66d2201fa30ecd440a71fd3c6907a5c6a43fbd118f19d515d22d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352929, "uuid": "0c2cad40-c027-4538-9a6c-d04e778546f5", "value": "T14CC1D906B7D8832BECBB0B782C7353409278BF51D963DF6D3AD8411EAE167049962B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352929, "uuid": "6e285182-9a5a-450b-a577-4779ac8a579b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352929, "uuid": "6639f26a-6055-4ab9-ad47-1796f901a979", "value": "48:6nECJZJoN+pN5i0NBl+sajduJudnjP6jZ1mXVw2b/5WgvgGKoFXJlVO692WMsKOW:k8N+z5XkvjP6jZ1+w2bZgG9F50VWzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352929, "uuid": "87799f97-ceb5-4eb7-8215-9c17de91c048", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352929, "uuid": "dc2d4ef1-7c1a-4472-8463-32f42fd884e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352929, "uuid": "ff044725-5ed5-4551-9c08-2c8ffba93b59", "value": "sat\u0131n alma sipari\u015fi #PO06708.PDF_______________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5845e74-2517-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1633354510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354510, "uuid": "d3463d3f-1671-474f-b96c-e5d4a3fbf4f0", "comment": "Malware payload (SilentBuilder)", "value": "f137403374b42d564af22cf2628f4cd1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354510, "uuid": "90f8b7e5-999b-44ff-842f-2d8baed72846", "comment": "Malware payload (SilentBuilder)", "value": "bd808e521a239ec2f341ea266942582e83537877b4035b4f2a8a68381b82cf40", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354510, "uuid": "6d17059d-2e89-4452-9bcf-967bc6ba613f", "comment": "Malware payload (SilentBuilder)", "value": "ef98a3a6c012101151313f63bc917c3a1a019426", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354510, "uuid": "21d3d3f3-56fb-4e6b-80e8-c263be06190f", "comment": "Malware payload (SilentBuilder)", "value": "a71a3224d316057d9a9bc16f694a93c965c1ab805b1e786aa2f037e8dd73a1fbd0097d16a2519b0ea09047417cdd78ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354510, "uuid": "327e37e7-5aeb-4082-9c9f-fbef6b45ea6d", "value": "T19434E14AF575C84DFE8AC73B4CCB0F9B9276DC128BAF0246B684B5515EF0DB8660214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354510, "uuid": "727abd3b-bf4d-45ed-84d1-4891baefb095", "value": "6144:bKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgq9DW/cZZRBDq1JOb7AvOsPDMlovS3OPI7l:Z9D1TDmUb7AvDDy3fLvfv1O+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354510, "uuid": "02974ae8-d2f2-48fe-8e7a-21a59db5e17a", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354510, "uuid": "8629d986-74ea-4f25-96cf-11c358b98ec8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354510, "uuid": "f3535688-2fc7-4a4b-a957-172a60942eb6", "value": "doc-164806134.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbef332-252e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633364052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364052, "uuid": "9bfdac4a-d5ae-43b9-bfbc-cfce3b746d47", "comment": "Malware payload (AgentTesla)", "value": "6b88e1f9f700c5a3730faf0755975802", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364052, "uuid": "5a732ede-3084-4b21-9373-14b42b383e2b", "comment": "Malware payload (AgentTesla)", "value": "be1028b0b899c7aaba1312bc9cfd13e83fd592d2a89691ade180e97588f24a30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364052, "uuid": "bac7081e-ca1c-4239-9d09-243bd6db3522", "comment": "Malware payload (AgentTesla)", "value": "91468cd84c969b4d763075197057247584483f91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364052, "uuid": "68f859e6-1507-4fe4-a61b-8782c7070745", "comment": "Malware payload (AgentTesla)", "value": "c2c2c78bc1a64447eaab6bf0a9d65830ddf86f45c143a561063aaab2002be03b8dd9c4c5fbd981b1be884f098e52917a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364052, "uuid": "3dc1f937-26fb-4d13-85c9-1c9f7fe23cdb", "value": "T1E1F4CF60BB47D503CE2047B029AAE270637AAE221644C31D7CD5BEAF3E73774165C9DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364052, "uuid": "6803e958-c6d1-48af-a75d-3a97b2ef3c94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364052, "uuid": "f87ff5b3-9bc4-4fe5-9c90-05666801f6cf", "value": "6144:KoJYKakWeIQ+3HwOezz/K60FzbaBUvYB6UFJpFcQsc7ixTBzElP1drFXzXAZdQJG:nJY7ao4V0JOGgB6vQKdNYdrFXzXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633364052, "uuid": "17814525-72fc-4eef-aa1b-d5e97eede055", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633364052, "uuid": "f7ab6ce4-7c99-4fae-92b8-214fb8f48c4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364052, "uuid": "8e4ed2ae-f6e4-477f-81fe-b4fa4ed77111", "value": "6b88e1f9f700c5a3730faf0755975802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74785815-24ba-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633314377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314377, "uuid": "fb3caeb7-ee4b-471e-8741-3eb395dc04ba", "comment": "Malware payload (Gafgyt)", "value": "7f4958950142fb8ffe02d05b4d9643c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314377, "uuid": "bc05eb24-2e18-4b27-9372-5544dfeefb87", "comment": "Malware payload (Gafgyt)", "value": "becd72fc45d561cc82a7e0771f3d12bba6670dbf6f0f713f8a7d4b6a0f32ed71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314377, "uuid": "366f5bc5-ba1b-401c-9e96-1e573103586a", "comment": "Malware payload (Gafgyt)", "value": "db862f13abcee82c69457d6b46c7c8e686fcbadf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633314377, "uuid": "51ae044a-ac3b-458d-962a-c8299ed6cb20", "comment": "Malware payload (Gafgyt)", "value": "cedce2d500bbfffe2fa9e4775c626b6663709bef3ce7170c9ab56f42b3f060522524c7b889b1afbb3b82f73b601ccc1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314377, "uuid": "ad307040-5582-4da2-ae11-068a39707ebc", "value": "T118C3F705F8014767C2D327B6E68E4B8D3F3557E467CB33126A385EB42BC2B992D29D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314377, "uuid": "42da9254-56fc-4981-9f72-0fcbef32f28b", "value": "3072:posaWhJgdWSCQ4T+FhSWT6iGToPTbTmVZqQ7Dk4EqXj5e:JJrgdWNvT+FhhT6itTmVZqQ7DXEqXj5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633314377, "uuid": "e73ea1b6-6d6a-43c4-a2c0-2a83dab4ebc7", "value": 118931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633314377, "uuid": "6797a27c-e863-4a29-a698-50e472629eff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633314377, "uuid": "e030ba7e-d369-42a9-90a8-2aa90927e106", "value": "7f4958950142fb8ffe02d05b4d9643c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948c09d8-2517-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633354374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354374, "uuid": "678875ab-ca84-4894-821b-0f2e38d3a47a", "comment": "Malware payload", "value": "80c504608375287415de256b9eb90622", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354374, "uuid": "fabb7f4a-55a7-434b-86b1-4be10141484a", "comment": "Malware payload", "value": "bee812d8913716073911e7321ad8045dc99262d947f632ef93660b02a3de57c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354374, "uuid": "35f78cba-e61c-4441-ad78-861ee6bf14b0", "comment": "Malware payload", "value": "2c45111528a2e953d5cae05a00f2d54c8d2b70c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354374, "uuid": "70afc1ca-9f07-4ffc-8b8b-026a82ee87b9", "comment": "Malware payload", "value": "749b18aac522152ecded6d2df04a2db2f3f9b0752596a2ce9fd68a2e6fdc53410e11b9d5b1287bb2ae986f98224aa2c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354374, "uuid": "57fa21da-74dd-4e18-9ad5-2c271d66a9b0", "value": "T1BBC2008A85138D05115A7061F6BB5BC938330363A6325BEA7BDDB789FF8C23501567BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354374, "uuid": "d695df79-53a8-4cb0-90d6-b01a925dc6ae", "value": "768:5P6EP63P6HP6UP6tP606HP6dP6tP67P6PHPQAzhP6UP67P6RP6pP6FP6sP6hP6/x:5P6EP63P6HP6UP6tP6TP6dP6tP67P6Pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354374, "uuid": "cd2e3e9c-dbf0-4a0d-bace-6ee23bfa55da", "value": 27026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354374, "uuid": "f39e391e-eb7f-4484-8c7a-7126a61b2077", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354374, "uuid": "51607c20-a694-47d5-ae03-5d84cf95190d", "value": "CITIBankXTTXCOPYX09016021.desc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e33b4d-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633348520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348520, "uuid": "936fcebc-22f5-4f0b-a8ea-39f51c62d76b", "comment": "Malware payload (Mirai)", "value": "b9708f61ee56d9c4f4b944b31c036353", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348520, "uuid": "82b2dd53-e24a-47a3-adf1-20bb0bc9a71d", "comment": "Malware payload (Mirai)", "value": "bf2a1c553042447c44c82c53625d398ee2d71b819d6b1e3f633a5328e5ce3031", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348520, "uuid": "a5c43b81-f516-4b7f-ab7e-3ef22f3fdc56", "comment": "Malware payload (Mirai)", "value": "7ba8b716ddbb022c1d3edee4da36f3eafb51ccde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348520, "uuid": "5a50bb54-6cca-4ebc-b05e-7575ae556fdc", "comment": "Malware payload (Mirai)", "value": "bf209ac580b6ac7a39ad4559d6bc21744b93893f4a6786b7589e2850ad91b9a9d0b8e45ea4e36d78dca363911353a035", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348520, "uuid": "d6428271-7a3e-4994-9b79-78bdfe471a40", "value": "T1EF438D33C45F5988C1581278A4648E7C1F93E92DD7531EF65A8A8AE2500FEF8F9093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348520, "uuid": "d4c5fd28-86b8-4bc0-896f-f3c35c7b16fc", "value": "1536:g/91KMs7a4vwt9htP45Q19XOpli1RGzCwnU:gF1ta5votP+mROli1RGzZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348520, "uuid": "7dba2e7c-1d7b-4c8a-84ee-f30403e76060", "value": 59228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348520, "uuid": "d3d320f9-e376-4f3e-8e74-50d4f86f4b92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348520, "uuid": "2ff8600a-a3d5-4f8f-9a7c-0c46fad312ef", "value": "b9708f61ee56d9c4f4b944b31c036353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7811d010-252a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1633362487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362487, "uuid": "c5643984-4f81-406f-9f95-ebe7dee75c48", "comment": "Malware payload (Dridex)", "value": "2a2c2285c01e3c1b43adb3a6423e6c6a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362487, "uuid": "6cec66e7-e02f-4d33-8e9a-d948ca0f2e60", "comment": "Malware payload (Dridex)", "value": "c01cf4c72282024ad54859adf661e4a9484e63af4ef0e7f53132afeb8b9672e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362487, "uuid": "b394e4ce-3733-4f26-bc0a-dddaff0e4f05", "comment": "Malware payload (Dridex)", "value": "9f42318f982cc1ae1f44265aabc5d221eb7991dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362487, "uuid": "8565a750-96b7-4d1b-87dd-4d46e8f6979e", "comment": "Malware payload (Dridex)", "value": "bfde53fc402b710d40ca628dd19ba57f124f36deef6214eb571126968754954f0d71c34f18535eaaa5b680219fc8b5e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362487, "uuid": "354a50a2-14eb-4b57-8eda-eb4cfcefb150", "value": "T1BB04C046F5AB0294F43E3ABA65CDF3A6267058569738F05CF337C987A036B0C3235669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362487, "uuid": "50e7053b-0583-4169-a3b6-1e0c229dad2f", "value": "c68e7650efd3d15ec218f4a10322a97e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362487, "uuid": "f9fd11be-2729-4b65-923b-982d49c52021", "value": "3072:GAOkqXpPKnXkU64fT/O7fbpvcI2yuOssp5kSmrz9V4S5:GAOkjn0GL/O7lvcITYekSSpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633362487, "uuid": "8b563cfe-cde6-46bc-978e-ed969acc13a2", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633362487, "uuid": "92adf826-9b78-4ae8-ab25-ecea27fa11c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362487, "uuid": "0619a32b-f6d1-4890-9d11-002ae3251e12", "value": "2a2c2285c01e3c1b43adb3a6423e6c6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0aded82-24d8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633327417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327417, "uuid": "64142e9a-2b8f-49c3-ab41-3d2087701c25", "comment": "Malware payload (Formbook)", "value": "7b4fc68118dd4f343598987595c32a0b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327417, "uuid": "860b8586-5bf7-499b-9a57-9000ffd76ea2", "comment": "Malware payload (Formbook)", "value": "c04016dfa9b5eb5735d31672b9313c29f3d8661bdf42b609b7552e428742f9a8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327417, "uuid": "29766bef-7567-4d03-bd04-698dea253751", "comment": "Malware payload (Formbook)", "value": "3e08e797bbd3894fe52608a7214448d94421a672", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327417, "uuid": "da3a6da6-b62e-47f9-998b-4e78c4ba3507", "comment": "Malware payload (Formbook)", "value": "a324ad4f334e1de1691a5c77d9d6dd232c2d66196c8656d4846611636fe2ac92571878e692c0f4ae154fa7e85c550f4a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327417, "uuid": "a4972776-78e7-4677-b3e9-6ba05ef9fc78", "value": "T171A5E006B4657AD3D32B14F012AB7A4E811C788691C91C89881AC7DE6CF5CFED34AE5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327417, "uuid": "7cd33599-3fbc-4658-8af5-e713695de71e", "value": "1536:qi/ZfvkkTi3T3f3m3+3I3h3f3i3k3W3C3y3I3G3y3n353U333i3k3W3C3y3I3G35:vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327417, "uuid": "4b64b857-79ec-46c3-a638-f273cab81719", "value": 2241287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327417, "uuid": "dbc24df5-55df-4ecb-9a67-92ee888bd389", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327417, "uuid": "ec039f4e-33cf-4382-ad05-bb1e5905f025", "value": "RFQ-PST00-2890.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3f3713-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633339224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339224, "uuid": "5dce2539-d560-4bd1-a11b-564eb8b7f868", "comment": "Malware payload (RedLineStealer)", "value": "a4ed242cae44c8b0bf982ba536e7f4a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339224, "uuid": "338ccf7e-2a96-4eb0-986c-687c49e8ae10", "comment": "Malware payload (RedLineStealer)", "value": "c05dcc1cf5041eb12034132df4ae105c6abccae45e18a11b102f6d8340f68e6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339224, "uuid": "da58abbc-66a3-4aca-b696-1c7ccb8b6764", "comment": "Malware payload (RedLineStealer)", "value": "1468ccf6396f93cdae03b81aed87ea2211b9a4fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339224, "uuid": "2461bd2f-7c2b-47a1-9f6a-92c259d87a99", "comment": "Malware payload (RedLineStealer)", "value": "a4d3ffa82e7ddaf3c497b76769dfe2184b056ae094e60bc139b306e54f8299f870701f0ee468038305576f7ea5a93603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339224, "uuid": "d5c006d1-8c9a-491b-830e-0cdeb5f1b6f7", "value": "T136263326B270503DE9A4CC79A8E94FBD6BF8942552FF871B03256A05913D3C29A703F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339224, "uuid": "48a128d0-8988-4341-9d42-ef731792270e", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339224, "uuid": "43d0d16a-94ad-4ef0-aafb-85eb22cbd986", "value": "98304:J1Dvlv8ATz3d3v0UF7MT22iN9BwU1fzu74IalBu7gurBW:JP0ATLdzK22iN9Rte41U7ggW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339224, "uuid": "1d6e1422-0b3f-4e16-8883-c2e79be62cac", "value": 4471343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339224, "uuid": "9626ad6e-10d1-4711-89bf-f8eac2269303", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339224, "uuid": "bf07b1b8-32a2-4e73-8d38-95a787bd3510", "value": "a4ed242cae44c8b0bf982ba536e7f4a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4dce25-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633363518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363518, "uuid": "47e2ade6-6c66-491d-b56f-77b1f21bc69b", "comment": "Malware payload (RedLineStealer)", "value": "ab65b26d42f98dbc6933d96c45b01774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363518, "uuid": "55aa3451-fe60-40e4-b376-9d2ea01d6607", "comment": "Malware payload (RedLineStealer)", "value": "c0fe41fb6c2ff9e04d8c071514f542f493003b34f4da462866402a42d02f459f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363518, "uuid": "198b0fa1-9dda-4ab9-8e5d-5b0172a7ac44", "comment": "Malware payload (RedLineStealer)", "value": "a2e460dac818ddee85445471e01215b585bce688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363518, "uuid": "0abd13f0-9746-410a-84f8-95b6ca92320a", "comment": "Malware payload (RedLineStealer)", "value": "dbb72a9e15b426283cc599ab1aa2749224690905883f9e31516f643ab55e40de0a993a6d27affce19adb7f88b2c81793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363518, "uuid": "eccb39b0-2337-4d12-89f0-7914adfe0b26", "value": "T15D84E0093191D7F2D7B20531AB66C3F44A6DBC6D5D2A164F3B89272E6E393F29631302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363518, "uuid": "90fabf62-5f2f-4123-9ed5-9b39f663345f", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363518, "uuid": "48f373c8-e8fe-404f-869b-1ee530202c0c", "value": "6144:yufXEnYR4tz5xxVMj1Lj7fMZ5tfjwOuhiPORROhxxpeTr/ekI:r/EtlxwjZ+5JjhXPOGzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363518, "uuid": "ef64fdd9-7491-47a3-bfb1-9c2cdc247028", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363518, "uuid": "f4437597-f4e7-4ddc-8238-b9cacf6fa764", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363518, "uuid": "b4b1f36f-1f02-4d91-bbd4-3b042486a0f9", "value": "ab65b26d42f98dbc6933d96c45b01774.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d35b06-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633348525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348525, "uuid": "67766462-ed56-4a46-a1ed-85b83211a447", "comment": "Malware payload (Mirai)", "value": "2b5deea6efa8525c13790a0bb518b3a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348525, "uuid": "c324d2a2-a503-4993-8074-571441c3cd35", "comment": "Malware payload (Mirai)", "value": "c10366cb2e0e2a7482ed4d12b6705c8937613c4439f931b460017e5410a9d510", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348525, "uuid": "6743203a-2f25-4574-b3d8-693a3c61a097", "comment": "Malware payload (Mirai)", "value": "bc4595e0e96aa7bfae26635213415bc72a652411", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348525, "uuid": "9e1d98f3-bcc7-433a-a3cd-38c8523ba64a", "comment": "Malware payload (Mirai)", "value": "04b3059e2e47b8424f9c04461fe44251de0849bacad018a380e24d8bf1422adae6eeb5c63b7b34230114747d5142bc1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348525, "uuid": "d7595006-02b3-4c6b-b290-d51f6f0810c7", "value": "T1FAC2E1AF60FC0054C045963BEF38586EB8FE55006DEEB3839398994C5126632F6766D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348525, "uuid": "1db8b60c-bb1f-4b9c-a0fd-81aeb644811f", "value": "768:yQkGSpow6JvLQfh319oHVRNMqS+2cFnIo5RnOlBgg2c:rw6J8RDo1RNMdcFIW1OlC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348525, "uuid": "20ce7824-0613-46ed-818c-6cc9d91d1c9d", "value": 26276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348525, "uuid": "0b86da90-dc09-4e0f-acde-c72753e2d533", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348525, "uuid": "778683a0-0034-4efc-a8a4-648426b75065", "value": "2b5deea6efa8525c13790a0bb518b3a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b64e40f-2525-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633360318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360318, "uuid": "3da06eff-82df-4303-82cc-112c2943da29", "comment": "Malware payload (SnakeKeylogger)", "value": "894ae8c0a9c22f6ba19b2d105e32a187", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360318, "uuid": "924fa6fb-1020-487a-9bfb-3214ed82139c", "comment": "Malware payload (SnakeKeylogger)", "value": "c131b82eb12752bf9d006ce97ac134459ab564d34eea84bc25f471ab197c1bc0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360318, "uuid": "e181d480-69db-4451-8b69-12b2de0e617e", "comment": "Malware payload (SnakeKeylogger)", "value": "3235cd3831b097c044a8855ca3e787ab9e0e1060", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360318, "uuid": "b2dec834-51f9-4d4d-a257-370f64aa6f99", "comment": "Malware payload (SnakeKeylogger)", "value": "f5d5022049ce4d179fca42724bdf80e018fb034eb0d165f86973374b53ffbe3141ac2c42fc1aed39e1899b6c34e0ee5c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360318, "uuid": "b942b4bd-ce9b-4637-aeac-ac2f4126cf65", "value": "T13DF2FD7DF1874A988F8697B8130B2F82154CF51CF38895B236B8DB3865D1D7B962293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360318, "uuid": "b0f86d72-09e8-49a3-8918-cdad69a018e2", "value": "768:2O80Ske+1k1hUJh3S0PtX8VpQpn4XqthsEBg0EJPlkd:2P0HB1k1hUJh3S0PtX8VpQpn4XqthsEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360318, "uuid": "4ebb99dc-13ff-4905-81a8-4e3939667aa2", "value": 36682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360318, "uuid": "179bb9f8-93fe-4378-8c8d-319d2a9e3c21", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360318, "uuid": "f8f1eb2d-446d-4cb4-8d73-a27ddb511bc0", "value": "RFQ - No. 81954-1014530.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad4fb92-24fb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633342359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342359, "uuid": "2e6f3d2c-f9f2-4d95-80fc-1665b4147243", "comment": "Malware payload (Mirai)", "value": "532bafbeab4cdd799401f00c8cba4a07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342359, "uuid": "5c5762b2-ecb2-42e9-b9ef-c426656a51bd", "comment": "Malware payload (Mirai)", "value": "c13bb8d9904236eff604a5b1accbe022a93f89ffe40abaef9bdf757946b24fb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342359, "uuid": "6bb0a30f-90d8-4d12-b743-37e894aaa27b", "comment": "Malware payload (Mirai)", "value": "ee80e793515614bfb057a07002abf2a86fd5f549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342359, "uuid": "37711946-460b-4112-ba8c-d1331606340b", "comment": "Malware payload (Mirai)", "value": "74d16b72513393885657a61fa1bee28169ee6988e7ab4f20500f7cdf1178ec18e9cd96ac7e9cb9ec8987db26344c5cc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342359, "uuid": "b3d056e9-843c-4f5f-b497-05f7c34f2fae", "value": "T16B03E18486472E61DF3150BFC4398717B2CDA26CEAB93371211317CAC7D548BA13A8A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342359, "uuid": "8ed384f8-6b5d-467d-95c9-2d42e97248f1", "value": "768:brjXWOZC5Ru5M359shM3sd28dN7QoY74XvaNeD4en+UQwwbq3UISY:bHXzZC5395sdW74XS/FUPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342359, "uuid": "ed6c57ae-8799-4eb1-b09e-a13bd01df087", "value": 39652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342359, "uuid": "75b61104-36db-4c1f-b266-a13dfd27650e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342359, "uuid": "3ec15955-9707-419a-9119-a69cebb2cda0", "value": "532bafbeab4cdd799401f00c8cba4a07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5799e7de-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633339240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339240, "uuid": "92759b97-ccad-4f41-a337-ec8d250cad4c", "comment": "Malware payload (AsyncRAT)", "value": "2aa28052162a3bba50da1318e1eef636", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339240, "uuid": "ea859ac9-c397-49fa-a3c4-2b86241dfbe1", "comment": "Malware payload (AsyncRAT)", "value": "c22d5b3cf6867e76b4dfcb70693ebb36359465cbed348c26059cb8a52c60b849", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339240, "uuid": "772a39da-8d1c-4c64-bcd6-a7dc9115e56c", "comment": "Malware payload (AsyncRAT)", "value": "bad492dbcd0b88d29af74df0d0721d267dacf13a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339240, "uuid": "6b82d23a-e3e3-4c1a-a007-9e3e1c049756", "comment": "Malware payload (AsyncRAT)", "value": "2a009e3935b81463e82c18cdb4cd3da4562dff6c0d5940815d6c8ce2126b8dc462bf76da8146839ccf8dde6f55dceadc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339240, "uuid": "571a1196-e13f-488e-9e24-bf232a7d2650", "value": "T104017872D85200C729A5FA381BEA41F4407AF3F2B6DCD8D279A480DF2CFD022142E596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339240, "uuid": "9a1f3e54-5a5d-4cef-819e-0b9cb6406ef8", "value": "24:8TTTTTTTTTjihK1L9NUr9Mw8LTTTTTTTTTjihK1L9NUr9Mwgb:8TTTTTTTTTjihmUr9MwaTTTTTTTTTjiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339240, "uuid": "73f177b3-1b4e-42d9-8e69-5677263a1b2a", "value": 815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339240, "uuid": "46a38811-91c0-4500-9d39-165aabaf0fb9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339240, "uuid": "bf64b735-2031-4249-a80b-5fc97fad495b", "value": "State-ment(10.03.2021)SKIF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74dee25-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633342031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342031, "uuid": "0f714759-5781-41cf-ac66-5e60b7d34ce7", "comment": "Malware payload (Mirai)", "value": "d5bf40df8efa8373157be53a37bf4ec6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342031, "uuid": "29f31d56-100b-404d-9381-db3d5ad45ac0", "comment": "Malware payload (Mirai)", "value": "c28eaa6dc0095ef8bc374765f6997b41d975cc95eaf606340b1a550393c7447d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342031, "uuid": "7002509d-2390-4941-b2ce-fdac34c648c4", "comment": "Malware payload (Mirai)", "value": "764861a098ff802002aa98254c730111bc723dfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342031, "uuid": "62810094-f1eb-4282-956f-1656b8454bd7", "comment": "Malware payload (Mirai)", "value": "bcb38fd03db4c912a3727ebac4a416842d1b64ead78cdcdfb164bae57604f734d5e5fa1f59a8c1af3fb4869026daf19d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342031, "uuid": "7f57aade-8a73-4ae8-a190-54768b9f82ba", "value": "T183F2E179521AA5B0C6D01C76E39C8D8E4A4357F8A0C776F42034D23C772B891FFB995A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342031, "uuid": "944bfa35-76b7-438e-8b42-8f6a388c41e9", "value": "768:5YR85oLVTRHAZNsEADjexOrA+/AkKWmpIBOQwlmxbD0cX3U1I:G8aVTlAXEZ9+RQhbD0/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342031, "uuid": "0798c3cb-0907-45b1-b559-70a6cc0339bb", "value": 35224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342031, "uuid": "893f6bce-9f3e-4c4e-9ddd-24d1bb4c04c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342031, "uuid": "c07d58b1-269c-493b-bc61-600162466afe", "value": "d5bf40df8efa8373157be53a37bf4ec6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfb4005-2504-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633345988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345988, "uuid": "061ca041-2cbe-4b2b-abba-53536a2190b0", "comment": "Malware payload (NanoCore)", "value": "defbde5e6d8981cdc5c15764fd77e911", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345988, "uuid": "beda6e25-f065-40eb-b40b-3bc1dacbfbfc", "comment": "Malware payload (NanoCore)", "value": "c342a7cb93e23cde27bfe4bcf9358f4cb9d49c0198abf112be372245ef96d678", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345988, "uuid": "4e4909a6-7c28-44b0-b855-22550fab11f2", "comment": "Malware payload (NanoCore)", "value": "66987e65620e79659bd4e17b1e0c8dfe0e6cb2f2", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345988, "uuid": "7ca7f546-5556-4b0f-bdac-ea5d77c14f3f", "comment": "Malware payload (NanoCore)", "value": "05d8a6d9fd8ebb9d462c9c90eb8389826b7ecbd1558e2dd922ebe22d049e9fb5f45061ee8c6819b4e6f7b51bc2f98330", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345988, "uuid": "8b708d7c-7623-4931-a1c5-c0bd056f8828", "value": "T1A7A42302EF2CD389C8464A7C3ADD7175349BBF9BD14BA0AC58139D09AA2D714F223ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345988, "uuid": "2fc52c41-acb6-4d67-adc6-057e0fc78612", "value": "12288:hsMX0LqeuVin1ySUIrWUPr0lezJ0FsErfTW5:hsMXmqeIWrbrWUPwEzJSRfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345988, "uuid": "6e684555-a138-458d-b123-945dc0653819", "value": 490950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345988, "uuid": "a4fc3500-18fa-487b-9e73-6836549ba3f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345988, "uuid": "110938d3-56f4-4f16-9200-f030b4fe3f39", "value": "defbde5e6d8981cdc5c15764fd77e911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5e9a74-2519-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633355169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355169, "uuid": "451d2ca0-3f3e-4b6c-8741-167ed2a00480", "comment": "Malware payload (AgentTesla)", "value": "00c331e20a610ffc893b1abe81de9e91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355169, "uuid": "a8599125-3c9b-489e-b0bb-596f897ef990", "comment": "Malware payload (AgentTesla)", "value": "c43c2da1b76a00ededad59219092f4d0ef46e541ed1c62d8ab3a52c3b3f609f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355169, "uuid": "6be7451f-23e7-4628-9975-dc849f3d8eb4", "comment": "Malware payload (AgentTesla)", "value": "6c9abc50bf94873a6fab795dc839d44d53b72d98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355169, "uuid": "2c05b83b-6156-4cd6-b4e2-b1827816cd0a", "comment": "Malware payload (AgentTesla)", "value": "209d23b71edb289b28764f7ed1e421538a7bad2e47da66aeeb6ee432af63f84251f57a6a06dd77262527a3c5f7f66713", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355169, "uuid": "537cb31d-c47a-4e6b-9be3-0b5308a284d9", "value": "T1FC156C1222C86B59E03E937AA1386545DFF2F497D311CA4A7CEE01EF9F71E824A53B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355169, "uuid": "40c508ad-c553-4f99-a70a-30ae63ada8db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355169, "uuid": "30116a7b-2e33-43fc-a9ac-22f808304ac2", "value": "24576:3WgKvzJ9zJqzJE4TZEy8loWmvamLBjn55n:PKgK7mvDjfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633355169, "uuid": "c7499d7d-cbaf-4035-a5e7-6b7ed051c1de", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633355169, "uuid": "252139f3-d3a1-46d9-aec1-09bacf6dac94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355169, "uuid": "df014a73-c9ef-4e4d-a408-d600900517fe", "value": "00c331e20a610ffc893b1abe81de9e91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403bdfb4-24f5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633339630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339630, "uuid": "a2f078e2-7492-4dcc-a00a-24114bb313bc", "comment": "Malware payload (AgentTesla)", "value": "984e1d7967952ab37287e74cb9b527ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339630, "uuid": "a607b3bf-9346-4900-af40-476a752fbb35", "comment": "Malware payload (AgentTesla)", "value": "c46279e663fc5dbea46759c2c1e77a7453514e7d0636553cb1fbd0d71229de21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339630, "uuid": "b5fa6cea-5810-4b58-baf6-105c5eec1dd9", "comment": "Malware payload (AgentTesla)", "value": "68ba6c544e34d9513e2cdbe68117d5ac0be3b80e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339630, "uuid": "6335f78a-ff89-4c67-8076-b7d9822e7173", "comment": "Malware payload (AgentTesla)", "value": "400670ea34bf4c0df7fbb51cecc15e1ff658f5789391c41a490ba678f9e888df195e6143e8111143dbde1a60f2f2db93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339630, "uuid": "8dffa4bf-ff27-4fbc-82c3-fc42307c7d02", "value": "T1509402B912B3A314DD39C3F63D28A6521778652A241DC3782F99A0FD7F23BB459E0853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339630, "uuid": "c108921a-7d93-4e98-b6f4-651109b72318", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339630, "uuid": "29ebd5d8-0d3c-4b93-9acb-4555181b85b1", "value": "6144:ZthjERQ+3HwOhrdhXfSZx0GEBnx2L42w8wDUDAgx4OyJSwjQWcrn325zBeHJMZMI:hESofB6ZxhEa3p1B4XJSXxrIBe/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339630, "uuid": "75d46535-7de2-47a9-b5d8-40d154d0891a", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339630, "uuid": "c3921719-e26b-4e2b-a831-d4f133058258", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339630, "uuid": "514c511f-4820-46f2-9d59-fd53d8a17121", "value": "Original DHL Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cc642c-2546-11ec-843c-42010a9c0014", "comment": "Malware payload (ZLoader)", "timestamp": 1633374382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633374382, "uuid": "3335d96e-e5da-48ca-b950-3ad35913b79c", "comment": "Malware payload (ZLoader)", "value": "54a3bcca6b1eb92adb299a46df941826", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633374382, "uuid": "d9b96f75-fbc2-4e0a-9813-9b80742a3c2c", "comment": "Malware payload (ZLoader)", "value": "c4ab81d7b7d44dd6dfc4f2b69dbe3f22fbf23c1ae49ab8edac2d26f85ae4514d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633374382, "uuid": "06344a1a-dbfe-4043-8787-d4d7ff989e9c", "comment": "Malware payload (ZLoader)", "value": "6988e010056d88985b8e8f8de06706327779d3ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633374382, "uuid": "e01c06ee-3af6-48fc-ac80-3329c02003a4", "comment": "Malware payload (ZLoader)", "value": "52bcb9be5fe4553600de662d31797553d9019b2b92b27341c30100bf0d44aef7e2dc71c7dd9249d5447be7f77f4c6ddc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633374382, "uuid": "03ef1d3f-f44f-4c30-8c40-66459addae56", "value": "T104451F543A54F411EAA96972CF2AC5FD07057D49EFF1B49B78E03E0F2AAE8A3D511302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633374382, "uuid": "992418ed-e3fe-4cba-8aea-e1d184ad496b", "value": "5804f371706c84b01e4fa0ae1261fd98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633374382, "uuid": "659db35e-d336-468b-9429-0d276b511688", "value": "24576:I+Z6pjqiycCc0Ic7dYnG8896mYdB3g17yp/Xx3xShc1ZcQGcoCKVXUGGotVjYmM+:fY+ICc0t7iG88Rp7AfxBShc1ZcQGZlVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633374382, "uuid": "ea3414fa-247f-4cc9-870a-0761f5875a7e", "value": 1189888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633374382, "uuid": "b0d2a57a-7a13-4740-86ba-ab911cfef798", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633374382, "uuid": "fce397dd-0776-41ab-b0dc-a5d657d0e409", "value": "logs.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112568d7-2517-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354154, "uuid": "38206910-b4d3-47e9-8e82-7cfe4247ba71", "comment": "Malware payload (AgentTesla)", "value": "1a6bea0288ee3addce0016d07cfeaf76", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354154, "uuid": "4b637faf-bf11-44bd-9a26-7fbc28ff1982", "comment": "Malware payload (AgentTesla)", "value": "c4d19e3e693624d4a0f4cabf749014f6c754533f71ab583b8e51edf3ac0cf02f", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354154, "uuid": "6b3f0528-b498-44b6-b888-c0a94bf6dd30", "comment": "Malware payload (AgentTesla)", "value": "0178188f807e521598567dd3df28e6575480e4dc", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354154, "uuid": "d84ab69c-9e24-4910-9ac1-0f624cbc393c", "comment": "Malware payload (AgentTesla)", "value": "7fbfdb021034d28b6fc5bf5192a4a2965651b519c24626b952ff4cd12caafc7721c2e52a7fd92867bf95c5097bab2d5c", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354154, "uuid": "a2c973ab-547f-4d06-811d-d5bc3a3fd73f", "value": "T1E5A42314E28C75F0E51F6B1843B9209E86567B8A23B91C557323887B9BDB33B7DC10B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354154, "uuid": "28bd2854-59b2-45b9-a00c-495bf330ceb2", "value": "12288:UmwE/FtzQWfXqby2qI2PaNYdWAW8VELLYgf481QPJa4x:UmZoW3M4aN6WAFTgD4a4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354154, "uuid": "cc1fbc4c-f0e9-44a5-91ec-136c9f5bce9b", "value": 486213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354154, "uuid": "31fe1baa-dd0e-4fe6-b96d-2b1cd967525d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354154, "uuid": "4caff0e9-2e2e-4fed-9876-6f149c721ff6", "value": "New Order.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ae36fb-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633353026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353026, "uuid": "adf20b80-19ee-454f-adac-57295b6e1a14", "comment": "Malware payload (RedLineStealer)", "value": "e32a2434c79b0bc4cdc1e0e8ed178eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353026, "uuid": "0511aec9-23e1-45e4-b1e2-bcd65a32fd45", "comment": "Malware payload (RedLineStealer)", "value": "c85e251a85dc892e704e6187f45633842c230d2e08b723cdf0ce03ac6bca00ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353026, "uuid": "2259e29e-c477-4cbf-ba30-582b23683ab0", "comment": "Malware payload (RedLineStealer)", "value": "74a554dfd5273495672b745e8bed72b5181032a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353026, "uuid": "f5cbaebb-3110-4732-811f-e041c5b7f29d", "comment": "Malware payload (RedLineStealer)", "value": "fa9d550e0c346aae8ae82d4b33d9a6bd6405338e8aa524c4b8406cbc13071dd8e5efa0bebf13af1990af00e82d5adabe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353026, "uuid": "4353f250-faee-4432-848b-9e7655a07e54", "value": "T16625BE201254C159EDBBEB3C943196208B3EBDF7643DD54E5CC2B89B2E7334284EAA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353026, "uuid": "e67526e1-4e2e-415d-8c58-0de0a8504311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353026, "uuid": "8f472a79-1c88-457d-8604-bb4a163b23ac", "value": "24576:pA6dFuSHKUshwhnpDDSqafHR4z+FoUMKt:TdFuSqUisDOlPR06oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353026, "uuid": "30859de3-1bf0-4275-bddc-8329e578665b", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353026, "uuid": "d61f5c1e-22ae-4d52-a242-75d49a3b08cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353026, "uuid": "0a885d07-9816-4167-bd41-efd5f3c4048b", "value": "L0gEDp8CctBvARJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f155f11f-24d0-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633324036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324036, "uuid": "15c73246-cae9-4ed6-a9d6-4ca039e350ea", "comment": "Malware payload (SnakeKeylogger)", "value": "966300dab034c8afd6aea86462587b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324036, "uuid": "ffed413a-c747-4b95-8b6c-7fde4655d4a8", "comment": "Malware payload (SnakeKeylogger)", "value": "ca131901976444e20c94e9dc78c814aff81e7af84ad3014cced5e060dc380ebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324036, "uuid": "3153fd45-b3a2-41a1-8ee1-15234cad3a1d", "comment": "Malware payload (SnakeKeylogger)", "value": "5bc08183b1e1db75794cda9a253bffe90ccbeb50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324036, "uuid": "ba2c647d-5c40-43ca-9091-3f801c815b83", "comment": "Malware payload (SnakeKeylogger)", "value": "87b0f8a075e859c35dfa07d941aff319723cb2fb3f205ae49c2af103fdc5fba4b0a1167ef94547d09726193503ba4d5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324036, "uuid": "b5541901-2831-4fb5-9291-e5ec0b9ed00b", "value": "T185C42350F58106A7E125083205A3FF75E3325345D51EED0387BA6DC99EBABC04BAACDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324036, "uuid": "0abc70b5-eec7-4eb4-9ef4-f765e9437d7e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324036, "uuid": "14112f65-f32f-41a4-b880-d8c0d89704cc", "value": "12288:npL1+1BSPlo7RyczPXh2PAtH2uxPiH0PqPQQkb5XcxfxKShHLbZvNUFBFa:npDPlo7RycLXZ2ux4xQQucxHHHZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633324036, "uuid": "f7ccb7ab-84d2-4609-b06a-1ab0c3bca1b2", "value": 589852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633324036, "uuid": "0d8eb728-c281-4488-a63a-56849780f11e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324036, "uuid": "f275715a-ca2e-41bd-96b7-0182493213fb", "value": "966300dab034c8afd6aea86462587b1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bf9cde-2525-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1633360329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360329, "uuid": "5bdf2f6c-d987-47f0-aa06-8c5bc19a193f", "comment": "Malware payload (BitRAT)", "value": "77d3884c884845f559f13cd7bbc4583f", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360329, "uuid": "89aac0e5-d39b-47c2-985e-ae45c812fe54", "comment": "Malware payload (BitRAT)", "value": "ca5fc2d073e94bd171cd01ba1f0fc48384b0821162c1acf88e8094318e781338", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360329, "uuid": "43d58707-d381-4949-afe4-5f2ac7a65764", "comment": "Malware payload (BitRAT)", "value": "c278951a1383d762debc074f8afed159cf8a8259", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360329, "uuid": "87283f59-3967-4653-b8b4-32bacf9e94ce", "comment": "Malware payload (BitRAT)", "value": "bda6260faa2400f21ebda88e259e4a978714164ce33efab837a34b1d4c4d58f0b5b545bcbe6ae92362db772df319bd06", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360329, "uuid": "644ad16b-001c-4fd4-b396-6bdde696120b", "value": "T19591E83D22B86D57DE43D170D976FD6201D2F26AADC70A507B7CF4A00F6A32A6E62001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360329, "uuid": "17d2d40d-9539-4ba7-a67c-4cc73fa2ea27", "value": "96:vhf8hCFM1LMds8PVxLg6fu+e36yR1CFlGwvEjBH:vhfvzxLleqgwGwv2BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360329, "uuid": "e88bd1e7-76b2-4e80-9926-4c22d4ea8b8f", "value": 4488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360329, "uuid": "5394924f-1136-4ba3-9f9c-15778fffc39b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360329, "uuid": "fb7a8c49-8b0a-4710-91fe-2ea96f1fb5d1", "value": "Inquiry 001752021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8dc022c-24da-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633328209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328209, "uuid": "3a61a820-9017-4f67-935e-cf712c672ba8", "comment": "Malware payload", "value": "09964d645c84e93e052230f287b33bae", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328209, "uuid": "6e081c49-b9d5-4814-bb8a-ff61108ad33b", "comment": "Malware payload", "value": "ca80f8ac9b6661169df31a094a1aad534c8a1ecf4248bd969c88076aff2990f3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328209, "uuid": "bfe94651-b1ce-4ec1-8933-1e7da7426883", "comment": "Malware payload", "value": "87529d8e0c91efb684356157d46ff066ce8eea33", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328209, "uuid": "e9f584f6-0376-4b26-9040-1856154fb2a3", "comment": "Malware payload", "value": "e6c6080fed9f1f413aa860a1d2302180cfa23f95fd7fdd0d53b9d72524a3611d18ab282363deaa471b0c3429a1a55f08", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328209, "uuid": "3381183f-a53a-4509-9a2e-f02adc5cd0d9", "value": "T12FF4235AF12E2AAE9DCB1DF313B3416592E073D76BDE60627C50E25498F8BC0336918C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328209, "uuid": "2d224c1f-0752-41c8-a23e-5fbbba0e1c84", "value": "12288:6KsijWlMtmaWJkhcNIGb0+29OLQF5vdJHqRfeys2TLOElOlEOHvr8CaJqlI7vy1v:pKMI6cNIGb52UyzHqRGpl5z8HslYCYyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328209, "uuid": "105fe084-8da2-4abb-9dc3-d56447a2e9d5", "value": 778429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328209, "uuid": "af6e016e-77b9-405b-8818-01c27938c4ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328209, "uuid": "2d22b19c-80ee-4285-ac5f-63c950d95421", "value": "invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4786bdf7-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633338783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338783, "uuid": "338d0b37-6053-4514-b51e-4747b4616ca3", "comment": "Malware payload (RedLineStealer)", "value": "7a5d1ec6328ed2f129fbca24b699dd4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338783, "uuid": "3b9c10f2-5e27-43b2-a62f-f511bbf527ba", "comment": "Malware payload (RedLineStealer)", "value": "cb561adaa259b8c5d98818edf0a1ae6979b8ecadded2f47687772e7933c9ce37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338783, "uuid": "908526fc-2e79-4f45-a88f-0aad572527e6", "comment": "Malware payload (RedLineStealer)", "value": "1bc978c90021c371b496a505973fc5138b8db792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338783, "uuid": "576bff5a-2fa4-435b-94b7-12b9d170d7af", "comment": "Malware payload (RedLineStealer)", "value": "633adfe1cf50389eb8ceed939e7d8882736404ab4e91329c57c5b3fc74a2be34396c386d0d27887de3b40d35ffad1a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338783, "uuid": "ea7b5b6a-57aa-412e-9eff-6592d536afde", "value": "T122E47BCB2CDCA3DAF71D00B8EE79775C116A982898AB7DD2DE42F023113251559B3CAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338783, "uuid": "db4b4030-9092-42e8-8c5d-f551ecd8d3db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338783, "uuid": "363d7f2d-33f8-4c70-a217-9eadae7e199f", "value": "12288:+N3Ni+hBr7IUALndXQLP80ecvx0CRjowp05MP+rtOAE2:i3Ni+hBr8UALndQ780NvxdRjoI05MP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338783, "uuid": "9e2e6eb3-e760-47b2-be4b-c4b21326fb10", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338783, "uuid": "505cbc74-e20f-4e59-b423-df5f41c1eb7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338783, "uuid": "eddf88eb-a948-4a52-be5a-d3abb3e590f0", "value": "Order confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100683bc-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633352864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352864, "uuid": "bc76bc0a-99c9-46f7-9d37-55182fccab37", "comment": "Malware payload (AgentTesla)", "value": "b097653e2d4b2065f719c1467c781485", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352864, "uuid": "58a4ab94-9cd1-47d7-a93c-866895686d4e", "comment": "Malware payload (AgentTesla)", "value": "cb8dfda422d5a692649e55c9760a97cccaf6d0817fe5880378a234cece656f3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352864, "uuid": "f401d6a9-675d-4491-9c30-c77cdb67e66b", "comment": "Malware payload (AgentTesla)", "value": "242629486a90a1b58e4f863df82dbe2ee715bd71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352864, "uuid": "6b5f6c0e-0bfa-4432-af9f-62985c184261", "comment": "Malware payload (AgentTesla)", "value": "23d20a421df953083ce30f61db79b10fd6d89bc5b6845bf0746f97fc2f8529d4d9c8640fadb604c6e7729f76b02fa61f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352864, "uuid": "9ccf3e4a-e67f-4906-ad27-2c82203753b3", "value": "T16994F16D23B79344DD7887F53D20F69217B5A12A001DC23C6ED8E4EC3AA67B85AE0953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352864, "uuid": "c9e75b2c-5822-4e2e-ae81-11bf8bbac376", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352864, "uuid": "ba728325-8449-4a65-a5b8-f2cce3f5d005", "value": "12288:9ESosh02LeJu5RNuedUQWTQp0TBXS0BTR6oqlD:9ESP6cfNEQcQpha92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352864, "uuid": "8a2a6b79-2cc4-4661-8f5c-d184430a3107", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352864, "uuid": "75c554d0-8e29-41fd-be86-95e320d79a1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352864, "uuid": "d31aa2b5-6e4a-4178-b096-300ce6db612f", "value": "0THUNRq5k4hDfSp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03ef977-2502-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633345401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345401, "uuid": "0142c648-4ac9-403e-a52f-cfe00334b1d7", "comment": "Malware payload (Formbook)", "value": "c9ccade124b44534d0ff46033c9262f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345401, "uuid": "052324de-1d36-4f82-a6ad-b6beb239af88", "comment": "Malware payload (Formbook)", "value": "cbd43bdcb7e75cff1e937fe47faa7770647da504aa28fbf3f1b7415ac282456e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345401, "uuid": "f20411e4-0ef7-4fec-a511-29ddf5177958", "comment": "Malware payload (Formbook)", "value": "a89aeca95a6b30060f5efcbefb215d0648065f61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345401, "uuid": "5e439c0b-d111-4cf4-98f4-623c24e869a7", "comment": "Malware payload (Formbook)", "value": "78ae0f22a3b4eb3f74c88a5bcb6fd796fd48982c39958ccb5943a945918d3c435411a3d9ed9c4ddcf5cbb13f1779d074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345401, "uuid": "42137754-3502-45de-880f-5d796b74bd5e", "value": "T1A244125726C189B7DDA29132A5BEFB7BF27B81000151AED3C7F8CE3F75520838649296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345401, "uuid": "7712e95b-1338-4f7e-a494-a5d93bdafa93", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345401, "uuid": "0e4a051b-67d1-4f02-98a9-c9e203c48d34", "value": "3072:FJ2S2L6KbqDCwcrM1ROZL009C9wIi/xRui+PXBjdyWSFCSKVbLGt83NRF3qujHvV:F8LxBs1ROJ0HVi/xNCRjdkFuOt8dTal+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345401, "uuid": "6c16e599-c3dd-4040-9a38-f9ace9e4d173", "value": 262942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345401, "uuid": "3b4ceaa5-c9ce-49be-b888-02d94f9c1438", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345401, "uuid": "38a42826-b5d4-46a9-8617-48882c00de47", "value": "202110 SABINA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6d665a-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633363246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363246, "uuid": "f06f42e9-83e7-4184-b24e-6beb7589e3d8", "comment": "Malware payload (AgentTesla)", "value": "505ce88a771d4e5a65dac0d3f1a83757", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363246, "uuid": "e4e9b633-267a-4923-8331-c7aa2ce77ca3", "comment": "Malware payload (AgentTesla)", "value": "cbe93877a50508ddbcf85a86ca27f0ac37953b0b4b6533fce756c2f4c10b65e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363246, "uuid": "bca00357-c7bd-49bc-b87f-68882bd4cc32", "comment": "Malware payload (AgentTesla)", "value": "c365b9f51de127e0940252e4382489ee9c6a95e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363246, "uuid": "2da66975-d0f5-4e28-9424-bfccea0e1e5e", "comment": "Malware payload (AgentTesla)", "value": "9aa2e6153b1315f76699989e12034b87d5aac5674c0062a6e461be9f07c02c2215b4770391bf342c0db14fb5163aaec5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363246, "uuid": "c81ec9a5-98d7-4054-bf06-f98fb45ef178", "value": "T103156C2222D82B55F03ED37AA2386145DFF2F597D311C9AA7CDE02EB4F71E814A53A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363246, "uuid": "15d77350-d2e8-4c1a-8979-98ddca8131e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363246, "uuid": "f2c44ff3-700e-4b87-bc9c-58fb4c7fcc02", "value": "12288:zeeu3UO+T7prlCVl0G3DJUs3DJU9F3DJUeK4TFuQxkMeNEB8lU/Wj5cQaUTa1MAc:AkFZKvzJ9zJqzJy4TZEy8loWNvakAr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363246, "uuid": "3fab381f-46e9-45b2-bafd-27de26fa0be4", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363246, "uuid": "cf4b7f0a-d7a3-4a85-8e07-543ec6f1de1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363246, "uuid": "e2787c11-f31a-4157-bf57-93b4323f7e8a", "value": "505ce88a771d4e5a65dac0d3f1a83757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16909719-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633341708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341708, "uuid": "b0f75b3c-07fa-47ea-a659-8c0a2ad02b03", "comment": "Malware payload (Mirai)", "value": "8dccf973413c96a7880ac97e5a90785e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341708, "uuid": "b3304cbb-f450-43db-a745-9d201c4ab656", "comment": "Malware payload (Mirai)", "value": "ccfc10e72ebc9ce47698b4e50a392f72d1f7052f76aa30146ea27eac7121b48e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341708, "uuid": "20874d3c-4fe6-4321-8ef5-7dfec13b3c13", "comment": "Malware payload (Mirai)", "value": "51de1971cbc9f574534e41565d7203645828af62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341708, "uuid": "73964e67-e4ac-4480-99d0-294fb375494b", "comment": "Malware payload (Mirai)", "value": "58fac416a8903e2efe82066fdbeb404e849085d41874a3360f2e032ddafdf6c36318086914f78c743fcbd6d5cde78492", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341708, "uuid": "e0d95a57-a6c3-47e0-9ca3-b8c791f10537", "value": "T10AD2E0B280B7D8A3CB5129BEB7F04FCA1A154FF2D0456023BD8C05A47D514A79F79615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341708, "uuid": "8a0b3d58-c976-4dae-8cb2-8a0ddab5758b", "value": "768:MrXirNJScKUr1GC67w6JyOWEyBaHa1xatAyGG9q3UELQo:MrXbc71GCJOxycSxEmLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341708, "uuid": "1eea23e1-7b6f-4a2a-b769-93d50838e1ee", "value": 31112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341708, "uuid": "568e99b1-94e5-4eab-a77d-094857f9a862", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341708, "uuid": "4f6edaea-485d-41e0-ac8e-f4777552bf8e", "value": "8dccf973413c96a7880ac97e5a90785e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11e6a9b-24df-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633330344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330344, "uuid": "f11d25ed-e973-4c5a-89f7-8597fdee7ff9", "comment": "Malware payload (AgentTesla)", "value": "c2f23eb831596ec54c6db923805ab890", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330344, "uuid": "0e23d2d2-23fd-416d-a616-b06868cbadca", "comment": "Malware payload (AgentTesla)", "value": "cd081096bb014161849ae4607951099bf1e2c63d0b22aa09a8688deecc67b44d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330344, "uuid": "3e34504a-22f0-4a09-8c1a-92093025bc23", "comment": "Malware payload (AgentTesla)", "value": "7ab618cda597328ff509beb45ab7b548a8ae5f7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330344, "uuid": "128b9dcc-9251-4a95-863d-7e45a8438b99", "comment": "Malware payload (AgentTesla)", "value": "58b0af1af4e9ecc14d012fe60a5d7e9c8cdb6dc0d23e9828b7148d540eeabbb0f165b0a539634aba4cfeb6b6bfff2233", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330344, "uuid": "ccad7626-dec4-4a45-95b9-5ab136bc951c", "value": "T1FDA42350AA123C05B8D5FF83E50896D36BA5224FF7290088BA0DBF4DE9B5DCDD6D2D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330344, "uuid": "29f76cee-2af5-4977-be23-14c9755afa20", "value": "6144:KtulYL0QkHPK0L0Ti79Bm2+p4dzxEZu/I5U9GcHDmpyrWh0J41UEy:KtcQ4P0TMXmTpwtguAgRjmpy6hk41UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633330344, "uuid": "2a2370ea-fa40-4894-9a34-e26d99757009", "value": 466668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633330344, "uuid": "4817a0ef-4db9-4345-818e-86b0475ca509", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330344, "uuid": "056b0146-a8ac-4431-af6d-c1cc84c77087", "value": "OFFER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ef7792-24ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633308253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308253, "uuid": "14f14b28-d7ac-4bfe-843f-9d65ac11de71", "comment": "Malware payload (Gafgyt)", "value": "b764c3c076c097ce88f00c1867a7f80b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308253, "uuid": "13c061c9-f517-4d66-83c8-8589710039c7", "comment": "Malware payload (Gafgyt)", "value": "cd0954445c2776ef688e4216ab9bb257479189f7d533b8f5d574db39bd3f1359", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308253, "uuid": "8a1ed7dc-cad3-49a0-bf87-b0ecb7790a88", "comment": "Malware payload (Gafgyt)", "value": "c3eb25bda2f604f986a9024ea1abcff57d2802c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308253, "uuid": "2a28d68c-54df-4472-b2d0-93e6bf63eb43", "comment": "Malware payload (Gafgyt)", "value": "44524c8b374971bfe813ae4e4aa5788f73015fc1fb65c743cd1be756b88caff68de8578a6e58607e26fd400cf4cf418e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308253, "uuid": "552e3a8a-a079-44b6-ae78-030777623b06", "value": "T142E37436B7619E77D80ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308253, "uuid": "dbf514f2-6ca6-4b16-92fe-daa177ae4ebe", "value": "3072:dcgcpp13lnL42PiXYqyC/cV4MVGuocmrThPaLEnn7rNb:dEXlnL42PiIqyqcV7DocmrThPaLEnn75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308253, "uuid": "10f3863c-6d5a-4f65-b67d-1c2f0bac488f", "value": 155475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308253, "uuid": "a8d8f864-2035-4155-a5d6-314ca43aaf46", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308253, "uuid": "da610028-40b1-42a6-963e-f88f4681dfea", "value": "b764c3c076c097ce88f00c1867a7f80b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac5d616-2530-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633365015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365015, "uuid": "d25c044a-0b46-4e5d-abd4-ef4d7b98f9d0", "comment": "Malware payload (Gafgyt)", "value": "db4e7f4c9437f9cf2f46becae6c7f92f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365015, "uuid": "6da8ffb4-05d0-4725-828f-3a584ced7361", "comment": "Malware payload (Gafgyt)", "value": "cd3c85bc861db67dbfc985812350d37a85826f15f5f72d6e7cbf54be237a84d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365015, "uuid": "e7f3fe00-d952-4368-afbb-3e2ce929146e", "comment": "Malware payload (Gafgyt)", "value": "8cbadbc900caa2b4aa70f73a5663ece4a4616b1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365015, "uuid": "678cfc67-ab9c-4a10-9dc4-7fcae8ae21db", "comment": "Malware payload (Gafgyt)", "value": "2768157a31552d0c099328e6d57f4c4b15bc17948f60448eb537e66e849339343647fdad053b713a00c61a4cee3a790a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365015, "uuid": "b1b11da8-cae6-4e7d-b12a-76910153851e", "value": "T138734A43AB81CAB3D0431AB516EB9B210232F87E5E1BAE51F31C7DF49B150C87267769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365015, "uuid": "eab8591f-d3da-44b8-8ccc-714057eddf9c", "value": "1536:gcI/g99UjUWdxkLOzf/q1oajmzDKasExTe8mEgPa9ZwmLItVOCjXZRshS:dIY9UjUWgyzfyyajUDpsWXgmwmUtVOCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633365015, "uuid": "df0cb7dd-d033-4add-be86-e958504efda4", "value": 76786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633365015, "uuid": "666ee05d-330e-43b8-afae-e5dc60d33ad0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365015, "uuid": "90912b3f-4201-4123-b304-ce51526a6803", "value": "db4e7f4c9437f9cf2f46becae6c7f92f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362e6462-24ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633309119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309119, "uuid": "37c1d6a7-b206-482f-9d96-c1c5676f37d7", "comment": "Malware payload (Gafgyt)", "value": "dbcc3c1d0b64c0b992e9f2095aa51ecf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309119, "uuid": "43e25f08-f184-41a2-85f0-acdecc58b816", "comment": "Malware payload (Gafgyt)", "value": "ce2fa5187534f216eed4f2225402ef0a1829e7560f80dfff6f840060ca105f5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309119, "uuid": "6820308a-0045-4bc9-af6c-c844fe17eaef", "comment": "Malware payload (Gafgyt)", "value": "b42533e25234ec0034b224ac71ffc93dcacee51b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309119, "uuid": "fe20f16c-320b-46f7-bd83-106a030422d1", "comment": "Malware payload (Gafgyt)", "value": "710cd45ab65e403e80c8b324a4a569afd9b286898661c7fb88505dbadd0403c1f29d5860a0935411583276b3a463b964", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309119, "uuid": "2b880d2c-8536-46e9-aa44-f302c9de1f67", "value": "T175A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309119, "uuid": "5cdac40d-272d-4c8c-aff5-e2060ef52ea5", "value": "3072:VSx+i6mqaObhNqnPNKV+qKmZuqQ4DPwXXtse:y6mRObnqnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633309119, "uuid": "1dd80c0e-3115-490b-a726-be87f0a32ace", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633309119, "uuid": "792152fd-1d73-46a4-adbc-1255db91aa19", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309119, "uuid": "155f44eb-538c-4e92-abe3-23ac61c71bdc", "value": "dbcc3c1d0b64c0b992e9f2095aa51ecf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f069a0-252f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633364515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364515, "uuid": "56d8d3df-bbc9-4902-a55d-6e37b6194c6a", "comment": "Malware payload", "value": "aa024a17f7f6f2d8862e2376f52aed09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364515, "uuid": "cd983ec0-9cd5-4b8e-93e4-d6684ff5f111", "comment": "Malware payload", "value": "cf073967491dc400543fc944218b03eb85c982c6daf7a5852b9b68d6d25510a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364515, "uuid": "f8b18765-d6b8-4ed3-a821-6264d593c5c5", "comment": "Malware payload", "value": "d1c0de05b3a4c9443723ec5455a4a5644740a46e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364515, "uuid": "50aa1063-5ef8-4e5d-9b7a-16735facc4a9", "comment": "Malware payload", "value": "31f89c6f4bb54b243df670073e541b13ecb607e6fe6cfd0ba6ee46d48b906b4730d19193e42ce8918116b68f859bbab0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364515, "uuid": "fd6dc3e4-a244-4011-b026-b63cc71a6521", "value": "T16D77232B1AD2C4F6CC924AB11DBB7BB4F3B7880C9213260753719F6149B74B1A91E753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364515, "uuid": "a52c314a-8d3a-4be1-8c29-5e42b4aeca36", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364515, "uuid": "a28f4175-6f02-42eb-9c4a-2379fe6e7b2d", "value": "6144:F8LxBsMcCEF8e3sEVtvW3iG2ub7B/4P2YdS+N0ndTj0bh1:/MlE3sN3iTc7NgdzNKTja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633364515, "uuid": "f9a9afb9-179a-4960-8a41-e7df5fc32e66", "value": 33554432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633364515, "uuid": "ee9bebdf-3600-445a-84ef-ea9cbbd76bba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364515, "uuid": "72990b24-5f4b-48d6-b911-7c809578efe7", "value": "comprobante.pdf__________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2796223b-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354621, "uuid": "c14598c2-475b-42b8-8ad6-eae154b27ff8", "comment": "Malware payload (AgentTesla)", "value": "a28e83cfdf0425e7640cbe0a121d416c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354621, "uuid": "671af653-cdc7-419a-8f49-a6505d576bf4", "comment": "Malware payload (AgentTesla)", "value": "cf27c7dc548b6147c823dc6d5590d8f5cb2af0c9e59e8dd69af46109e63e2071", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354621, "uuid": "8afd0943-554d-4e9e-b418-00b2caf670cb", "comment": "Malware payload (AgentTesla)", "value": "f8c7239fe419a1be14a38fb4efe4c759fa188671", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354621, "uuid": "46948048-0507-4156-98bb-06720a1d922a", "comment": "Malware payload (AgentTesla)", "value": "1e220c2ea2b6145b1efde9a90854e4ccc9ce3a8854e869bb7b57402d1044009be2c58ad796184b989fa2d80ee898410a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354621, "uuid": "268e2919-1837-4172-92d6-ae2b880815c8", "value": "T128A4C0393EEAC015F173BF798FE5B5959B7EBB632603E8192085038A0613B81DD8157E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354621, "uuid": "de04e153-a377-49d0-80fa-52bba6a1625e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354621, "uuid": "85cc81e9-d156-455b-a463-3f76ac0ce84c", "value": "12288:kqWHCM2K4CduZ0YsUGltp8LC12yrO840f:J3CAXs5Cuur0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354621, "uuid": "910f9c88-0e7e-4621-9b81-dc6584d8fac6", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354621, "uuid": "408242e5-d87f-40b9-949f-d45cc2702176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354621, "uuid": "1ab690bf-d496-4050-8c04-f1a6458b2b0a", "value": "TEKL\u0130F TALEP VE \u00dcR\u00dcN \u00d6ZELL\u0130KLER\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8710ed-250f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633351059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351059, "uuid": "d090772a-2ecb-41e3-be89-b25812994b25", "comment": "Malware payload (AgentTesla)", "value": "0839e95c0ced1ac73cd61617bf32dcae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351059, "uuid": "c5f6cc35-3fca-4a35-9a1d-c2c38a243c78", "comment": "Malware payload (AgentTesla)", "value": "cf555797a5639992a7c068712007937cd78925a3367928f6824e3fc71248717c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351059, "uuid": "6604c2cb-9810-4ea5-ac6a-bdd791ecb284", "comment": "Malware payload (AgentTesla)", "value": "3364ea13004dd2ce872af09deea0030a228eff54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351059, "uuid": "bc348567-c26b-438f-b856-34350d3b3bb8", "comment": "Malware payload (AgentTesla)", "value": "c38f762a991cdaaf72f3f3040a509ea5211a8ce827af06fd1a02ada1a98113373293f754c2156e892ab962a477d1eeb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351059, "uuid": "9435bc0b-4583-4715-a368-f490d9e08aff", "value": "T1CD64236A93C164D7C0A713B21FB9F1B4E37F675861242E8767C22D2B4D0A1CB871D197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351059, "uuid": "361806c2-b27d-4bc8-8e73-fc503cc5cee0", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351059, "uuid": "15bebd98-455d-4ca4-be5d-e264755cf5b2", "value": "6144:F8LxBs+ptcrR7/govE2yBl7Wum7zOm+TnkoG3fFqZSxaEHq:/otg8IyBRnoOmOnkoedlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633351059, "uuid": "1a6ada1e-2c6d-4ec6-b198-12438d104948", "value": 311134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633351059, "uuid": "a4cb7406-51a8-46cb-8ad9-4a9d34bc7b94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351059, "uuid": "f28d46ab-c3f5-44c5-a0a3-eec5a37ae3a9", "value": "0839e95c0ced1ac73cd61617bf32dcae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b74b5c-24d2-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633324605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324605, "uuid": "f1130ed4-328b-4def-8f82-45520ac491c0", "comment": "Malware payload (AveMariaRAT)", "value": "744d8cfe9741f30e34fd8c8d702bf641", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324605, "uuid": "abfea430-8dbf-454d-af91-3e33265c4f32", "comment": "Malware payload (AveMariaRAT)", "value": "cf7121280fc47f569af78084d7eced02fc6e2967964d09f4b6dc83f5829be15c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324605, "uuid": "a7c55251-8e27-42a9-8745-5acd2fb97bc8", "comment": "Malware payload (AveMariaRAT)", "value": "2f152b054393fdaaa05de6335ba12c3cb642a502", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324605, "uuid": "19974975-fbec-401b-a83d-eb1f2e7ad2c3", "comment": "Malware payload (AveMariaRAT)", "value": "b0201c28b39ffd42d52ccbf2dfb66ddd34bac51e23668b9bdfb978f98aa0ac1504c14d13bf1709f76be66af47ff3b056", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324605, "uuid": "e6f9eb9e-5deb-4679-b3da-fc9c0353fd75", "value": "T12FB4E09C23AB9A04FDBE83F9787490904BF1B4261956C33C9F5064ED1D727E4CAA5B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324605, "uuid": "55e4c446-54b5-47e7-a82a-e7999e3d1226", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324605, "uuid": "019ff03b-7234-4152-9189-60fb45f23663", "value": "12288:bu8oWYfFElSO7wZG8ICgbrgf31JT6YashlM0JT6YashlM:/afqzwVUrgf3n9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633324605, "uuid": "079e66ad-89a6-4463-bafd-0f61cb4b7256", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633324605, "uuid": "e7ee5ae7-5db4-4893-9d11-b57904dc1795", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324605, "uuid": "fa0c7a5c-56f6-4105-8180-e0312c26d4e0", "value": "DHL_EXPRES_INFORMATION-0100032021-0241429142009616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4c8650-2502-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633345371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345371, "uuid": "65dd64d1-56a7-4f7c-af7e-3059d6952205", "comment": "Malware payload (Formbook)", "value": "bc0b0f3cb84bd1b8bcf48f88548cdd15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345371, "uuid": "1392d043-5be6-4ba2-9a2f-86f9c4e877de", "comment": "Malware payload (Formbook)", "value": "cf94779788ca9bacb3595afa47e34f6b368e60cf31e118035fa60638359f34ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345371, "uuid": "5bdd885d-d959-4961-9387-365f3c8553aa", "comment": "Malware payload (Formbook)", "value": "46ea0fae254b3c5759acd80fb955bf76e796eb8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345371, "uuid": "4d76c026-f2d8-4ba9-a856-c2006e7ee94b", "comment": "Malware payload (Formbook)", "value": "e2695e30dd046c2b87223808d8afdec33a779e4f16f7ab84a601ae6ad8529192d02cb266230bb4b1ef6481bbd983e104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345371, "uuid": "6cebcd1d-b97f-42db-8b0d-4136ad5de36b", "value": "T19A257C22B782C572F0721635ACD66BC4552EFC352705A98BB7F89D740FB13A03E69293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345371, "uuid": "f30efdc4-f50e-4057-bb10-fbc76d8c8c0a", "value": "a26b1a7507806e34103fbdcb48506693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345371, "uuid": "133c14e7-0de2-4035-b5a9-d986c426554e", "value": "12288:xu7LEMGEoW8XZyHKh6BoeTr49xTrQTf6ly9TuvwPC7Rj8q45AM0wtMKqVUwL:x87n8XZ/oSe34fQSlyMvKC183FMKqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345371, "uuid": "ddaef5b4-015f-47c0-b61f-8a9fa8819a78", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345371, "uuid": "6c5e63f7-d935-49bc-9cc7-a24b99e2eeeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345371, "uuid": "1832e15a-bc30-400a-a652-d5f293294fa9", "value": "Purchase Order-83502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6475bf3-24c3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633318326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633318326, "uuid": "06834d24-cf10-4c65-9853-defca40c8dd2", "comment": "Malware payload (AgentTesla)", "value": "289033f6b4511d9ac5a9c42efb419d91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633318326, "uuid": "41e03439-877a-4d42-b1e6-f98562b8785f", "comment": "Malware payload (AgentTesla)", "value": "cfb24eeee1fb9753433c3eeaf857ddc8f33512866a40ff22daf6c203adeee62d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633318326, "uuid": "49bb4feb-d6a7-4e25-a6b4-0c306d66139e", "comment": "Malware payload (AgentTesla)", "value": "a4c46767fc98dfde82edbef43100d692a29cafc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633318326, "uuid": "f201f62c-ba33-4b99-99dc-239aabd317f1", "comment": "Malware payload (AgentTesla)", "value": "dda734e5989ee892c3009d6cd3ac6cf4c338d6518c96748b2755b0b02e79803342d133d699d1c55f1d4acba3b09d1646", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633318326, "uuid": "2b575d6c-a0cd-44dd-a407-ffee5d346dae", "value": "T1FA15099013CB9EC4F07B6334B0111CE7A6FE660DE379CB15699A3AD78DB6B40461DB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633318326, "uuid": "a0cb9551-4d79-4566-9dd1-10e833d15408", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633318326, "uuid": "b02f6b4e-cdbf-4e67-82e3-f209a9e42a93", "value": "12288:+3lK8FluRs7Z8z4asvs1drdyImcHFebpvqg3jkj2K046Mnq0UnsO5lJkKzUvoPUh:04GDseiAtRlPh74u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633318326, "uuid": "4d9639f2-d64f-45ad-9964-4f9f78e1fd7c", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633318326, "uuid": "23b0d09b-c4bf-43af-a2c4-7a4722250d5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633318326, "uuid": "1966f813-7a5b-4110-81ab-32eaf75c3f13", "value": "36090001666577.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a921e8e3-24db-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633328639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328639, "uuid": "5f4907be-cf89-4dea-95ee-f30eea965fc2", "comment": "Malware payload (RedLineStealer)", "value": "18de44e311429975460a272939f97ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328639, "uuid": "df2b0c41-8f80-4323-9332-21e8dec67db1", "comment": "Malware payload (RedLineStealer)", "value": "cfc69df3b5f41ee92180b939f1619afdda4d7986e740fd2fa581d09442e453c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328639, "uuid": "f557e781-75e4-4f3f-a0e3-5220ecca3d2e", "comment": "Malware payload (RedLineStealer)", "value": "86c3e40ec91cf39bceb6b34eb034e325f31c5745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328639, "uuid": "416c4bb0-6cd9-453c-98da-0d420f3c64c7", "comment": "Malware payload (RedLineStealer)", "value": "b0631364cff0dc36962ff6c9c2b17d4294a22a5d8a58e411a4112f1fdd4bb6e35313de36a244404c231c76b45e24b05d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328639, "uuid": "89f2fbb3-aa20-45cb-973a-de5972365ae4", "value": "T1E6E48C54F21CD2B9FE0922B1253DFCC825F82EA8147DF91BB9D7B1A224B9E3154B0197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328639, "uuid": "fe7ec52c-4305-41ce-a552-bb622e8a97c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328639, "uuid": "24282dbf-4115-4db7-84c5-eac99f218f53", "value": "12288:1075iMbQ+X8+UiDLbRHah/UugRVZjBwRn+KoMJqmIY+H48JKvjfNoT:a5iMbQ+X8+UiDLbRHah/UugRVZlwUKov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328639, "uuid": "51dc54a8-80e4-46a1-9644-a4525005c0de", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328639, "uuid": "ae400fce-3631-4324-9204-05e285004b67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328639, "uuid": "06f0bdcd-c071-4988-8f1a-95ade3e8b1f7", "value": "MACHINE SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578dfdcd-254d-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1633377465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633377465, "uuid": "3c002691-72ed-4764-b47c-3e5f97a9d348", "comment": "Malware payload (Dridex)", "value": "07d7d77033a62a22394399083da2d67d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633377465, "uuid": "8ec13df4-7bb7-4191-888d-25a73f4a10e3", "comment": "Malware payload (Dridex)", "value": "d063a25fa2ccda0c87178079726a800fc0b3d1abe304c3400621bad4e0482289", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633377465, "uuid": "ad752065-6703-4066-94dc-dbfbf54e0de9", "comment": "Malware payload (Dridex)", "value": "9610fbf0c6a626382eb4c1c005590e282ee6cda4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633377465, "uuid": "2c8aa48b-e8bb-48c7-a6f5-df1be8b35304", "comment": "Malware payload (Dridex)", "value": "aaa1fc5b6a05b31d5e61e505399a3b0f058f94ad068c64d38a3e137721dc64baf65288f0e64462d84f09aa4f13a3aed6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633377465, "uuid": "91240f4f-128a-4ab1-93af-f1b3324dac36", "value": "T17504C046F5AB0294F43E3ABA65CDF3A6267058569738F05CF327C987A036B0D3235768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633377465, "uuid": "c2c327a2-4e8e-4c40-89ce-a39a72b68b30", "value": "c68e7650efd3d15ec218f4a10322a97e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633377465, "uuid": "41e80134-6bc4-4750-acb9-43807dd5e2f1", "value": "3072:mA3kqXpPKnXkU64fT/O7fbpvcI2yuOssp5kSmrzWV4S5:mA3kjn0GL/O7lvcITYekSSiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633377465, "uuid": "afaa65a3-8afa-4eb0-a480-3834142b5ab1", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633377465, "uuid": "0a2107a5-a663-4221-a858-c8d1f22e4be0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633377465, "uuid": "48b65cc7-50e0-43c4-8be5-4fb8f09d8d6f", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.29431.24127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966e5dd7-24fb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633342352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342352, "uuid": "289028d1-658b-49a6-ab9e-2ac56c078e8a", "comment": "Malware payload (Mirai)", "value": "ebb26d40b30b9eba5386c85e73625f75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342352, "uuid": "121fd20a-624e-46b5-92dd-14c4bcf178d1", "comment": "Malware payload (Mirai)", "value": "d07d571ce72dfcc16922f5fcde7f26e0fce8d46be40548b0be1910238bcb2ae1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342352, "uuid": "e3fb63e0-253d-4051-8943-d2a996315272", "comment": "Malware payload (Mirai)", "value": "454e399cf69e34747a3ef2eef20149cf2e4ace9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342352, "uuid": "d708d445-0803-4de3-b98d-8a66662a30fc", "comment": "Malware payload (Mirai)", "value": "c11ed0aa8cf526b911bada01a052560ce6c6571efb2de223bea5fe209bc09df495c29eb1ed7706ff1bc3def3b7729671", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342352, "uuid": "68949d59-eb6c-41b9-b1a6-6d8d69128dd1", "value": "T191E2E1B09670F4B2C3D044BCDDF75B8431D796B4A811B4B268C8126DBE984D70EBDAE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342352, "uuid": "7de95f56-1899-49d6-af63-1be5309318ff", "value": "768:Ho6OMIZ2KRv2PqC5kz7jORLvzfN9cLAGfa0C3Uon:HfaZ2KRzC6HjOdncL5yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342352, "uuid": "6ea5a988-12f1-4966-b62e-19d47d93f88b", "value": 31300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342352, "uuid": "5b09b891-4fe9-49b4-b48b-6ac67bffaa40", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342352, "uuid": "fc7c12ea-89e7-4a2f-89e0-79e83740dfe4", "value": "ebb26d40b30b9eba5386c85e73625f75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517c15c8-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633347819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347819, "uuid": "f06448b7-78f8-4c63-8dcc-b0b6bd7e8ec5", "comment": "Malware payload (SnakeKeylogger)", "value": "0876ca498a685cef7a18e10ce2507770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347819, "uuid": "2fe50170-e3f2-4abd-b3ab-8bdbb25565fd", "comment": "Malware payload (SnakeKeylogger)", "value": "d10c9083a3d3d9be335be359663a84e78c71ed45d660a17a0c9106d7c0f94473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347819, "uuid": "1620cbb9-bd19-4cb3-9f25-312d91a52a8f", "comment": "Malware payload (SnakeKeylogger)", "value": "fdef9951c2efd96aac0a959ce1f7cadf0c81a81f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347819, "uuid": "5dacfa15-608a-4149-8201-cdb926b1df1d", "comment": "Malware payload (SnakeKeylogger)", "value": "637f711d1b033f227f5a4a7c00c3346ca1052adc09b6122488734a92ee28e54388759161a04dc589168d9fb51f54031e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347819, "uuid": "c2329da4-e2c0-4bfe-aec3-26999e69e0df", "value": "T179C42356C5C382EED50308F00AEFFEB9B67DB920A076D60743E1AE6E79905474D171A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347819, "uuid": "83e9e8c7-8180-4029-b182-4f8c3a1ba470", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347819, "uuid": "bf0d216e-dc5e-4562-888e-13ecd04be764", "value": "12288:ysKR0tv4eYbw9cEtu/s8xcPWcw2dXaYcrajdzniZFQEobFj8E7EI+dR:PKRU1KwDLWz2Xo2VclmPF+dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347819, "uuid": "e2b60da2-62e5-492e-afe2-5ac5393e4ae0", "value": 594746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347819, "uuid": "040e012a-25e8-44f9-a55b-2cf134c2c170", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347819, "uuid": "09124c81-3db7-4632-8abf-edc372efc5ab", "value": "764345678098456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f95259-24fb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633342274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342274, "uuid": "08c0a3d0-d552-400b-b703-b5f05b94d303", "comment": "Malware payload (Formbook)", "value": "183a8b19a056c944237876bea31a697c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342274, "uuid": "4a4c5f15-e54b-48ce-9020-c3d5d20130e1", "comment": "Malware payload (Formbook)", "value": "d153e8b542963a9c9ae3fa96421f2ec2c5779759d0a086f3545b7e9c91074476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342274, "uuid": "4a90e4ef-41e8-4823-bec3-7c02e39703f0", "comment": "Malware payload (Formbook)", "value": "c11f5484af3e4d8e34c35a7b7363078b0f23e079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342274, "uuid": "faab64e6-677b-4100-bc76-299ceda4b5ae", "comment": "Malware payload (Formbook)", "value": "7f1ad5171daf5d7c6b5686e537d7415521e3b3e84d98a5ba43619596588c3d713f37c49574a6f64d85d0395c2e677965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342274, "uuid": "fc0bf21d-6416-4b45-b5e2-d2b0bc1e2d9d", "value": "T1BB251A9053CB9EC0F47B6334B0111CE7A6FE660EF379CA1569963AC78DB6B40461DB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342274, "uuid": "81c00cce-e572-4ba2-ad0d-0bec841616e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342274, "uuid": "d5ee42d5-ac9c-453b-b24c-b0348d338919", "value": "12288:GO4jeQ5jsruJH+ReJqvqfLRXwK4+HNONnvsyl9vai2K046Mnq0UnsO5lJkKzUvoc:XHBQLW10ergut8+VuRHPXWMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342274, "uuid": "a4871d4f-592c-48fd-b9e2-433d26644dc5", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342274, "uuid": "ad3f3dc4-a6bd-429e-a5c9-41c70a1f9720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342274, "uuid": "832236ee-8cce-4a0f-b9cd-9bedbe5f853e", "value": "pdf.FOB Bander Abbas Basis and CIF Sheikh bilal basit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d398b57-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633360617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360617, "uuid": "863b8bb8-3578-406d-9558-75a5f9bae4dc", "comment": "Malware payload (Formbook)", "value": "81a3fbaed8ef79687f45554966985c20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360617, "uuid": "44a76df6-be02-4ba3-878c-dded5faaf008", "comment": "Malware payload (Formbook)", "value": "d16da4e6a63f26601dd3c961f31708db79be1aead7cf3834fafa47095b1a45a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360617, "uuid": "11e415d9-fd67-46a9-adc6-d1e99e4fa7ef", "comment": "Malware payload (Formbook)", "value": "256c21d905602953d3beff30aba518af5b9bef2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360617, "uuid": "785edee9-971d-4b76-bfc4-13fd5bbd2f42", "comment": "Malware payload (Formbook)", "value": "b43c9caa844ac2220d4592d1abcf9caf97b059efe3464e2fc20aeacffb0a06179d609784141ad713163a602e57d91d87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360617, "uuid": "656b06a7-0b15-4483-a0d1-67fc252e181e", "value": "T1AF4412663B81D6EBD9CA0AF12C336B35F23E9005142A6B4B8BF81D7F1E510C7875661B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360617, "uuid": "f5c53e39-0359-48ab-8af7-759f52e04857", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360617, "uuid": "42f787d0-f80a-4160-820c-f89bae04bd5e", "value": "6144:F8LxBsmDB6vHIWPnKJ0wzHOULGw9EAoobZK1vQtDzj9iJpV6G4:/mYHIWPnKJd7JoobkvQtDv9vG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360617, "uuid": "93b680ad-f568-4b15-8dec-c28d10edc3f7", "value": 264819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360617, "uuid": "a478762d-07d7-463d-bbd5-633cb4616bd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360617, "uuid": "873e5fef-f970-4f18-8f5b-98d83578f9fb", "value": "bnvver12345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43bf0f5-2521-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633358803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358803, "uuid": "85ec2899-d648-44f9-8207-2a91e1d40e56", "comment": "Malware payload (Quakbot)", "value": "aa414a03d8da2bd7723c97e6c377a836", "object_relation": "md5", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama108", "colour": "#0BD97C", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358803, "uuid": "38ddfa1c-3cd3-4eea-bdab-373556f42aea", "comment": "Malware payload (Quakbot)", "value": "d1755df7be47bc3aae7f163f3a889f577175f6623b71dca5eb8d8d8fd2ea8cdb", "object_relation": "sha256", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama108", "colour": "#0BD97C", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358803, "uuid": "4d1e2eb8-acd3-4020-a6ce-47195a3f93cb", "comment": "Malware payload (Quakbot)", "value": "65e0ff1d8412d4bf84a4fde210bc24594096831a", "object_relation": "sha1", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama108", "colour": "#0BD97C", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358803, "uuid": "a57215e0-2f67-4eee-9d6b-0a51b4aee5b9", "comment": "Malware payload (Quakbot)", "value": "18209e49f016b14b49fb3af3346e08d8d0ddff6a999329eedffe47a050533213f26d5e504f25d074cc078faec747dc41", "object_relation": "sha3-384", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama108", "colour": "#0BD97C", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358803, "uuid": "eb073cf4-8b4d-4e74-a815-2c3486d115e1", "value": "T1C4D3AD467797C94BE54903398EE3879B3B72FC21DE72470332467B0E4E796A18C16A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358803, "uuid": "2d8d5697-d9fc-4cf4-8813-60ed691b4cb4", "value": "3072:Sk3hOdsylKlgxopeiBNhZFGzE+cL2kdAxc6YehWfGdtUHKGDbpmsii/+u6ssC06+:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633358803, "uuid": "0c32c5f1-d033-4095-8b24-b480b5be38f8", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633358803, "uuid": "670f55a4-f824-46f4-9f5f-742ac5a05695", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358803, "uuid": "bb0a0baf-4733-4527-b659-3e082f5cc620", "value": "1527780409-10042021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333f2b88-24ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633309114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309114, "uuid": "87e4dcd4-7673-4038-a596-f41d0ca78304", "comment": "Malware payload (Gafgyt)", "value": "47a65783a823eaddd4b6852ea140dc55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309114, "uuid": "97a01caf-c2e1-412b-adf0-3368dde1f3ce", "comment": "Malware payload (Gafgyt)", "value": "d261952dfe90dfb6bc9411d2820fd98da6575685c66d67b3effca36c25cab1d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309114, "uuid": "cc927d5e-3830-4bd5-af57-9109722dca2e", "comment": "Malware payload (Gafgyt)", "value": "0ef50246786928f38f06d7b460eae8a2425c71ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309114, "uuid": "ea53e885-0e26-410f-8bc8-c3abd3f5b999", "comment": "Malware payload (Gafgyt)", "value": "8a7b74244436443b81cd1e30da319fbbab6f88ee0a62ae13720338c68c286afbaa0f363a3df03f7bbf0240a4c89db148", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309114, "uuid": "6f7294fe-a657-4a5d-beb5-e59d11e4312e", "value": "T193C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309114, "uuid": "daa11046-cdbf-405f-ae29-7327f766fa02", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBehEdWfRZrmW+IFj:Ted0W0MZQHVd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633309114, "uuid": "2556c1e5-f4e9-4ac2-99b0-9af701c3ee9e", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633309114, "uuid": "c459cdd0-9284-4b64-8b0e-45469a372cbf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309114, "uuid": "59ef0b07-faea-4863-acf5-bf65f2d4fa3f", "value": "47a65783a823eaddd4b6852ea140dc55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0d8ca3-251f-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633357664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357664, "uuid": "2aca01fd-1438-44b1-aa62-a34d778facd0", "comment": "Malware payload (GuLoader)", "value": "21d560c91dec6b0f0225ec225efb933f", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357664, "uuid": "effaa49b-ffe5-4c23-b413-6e1ad2d0be49", "comment": "Malware payload (GuLoader)", "value": "d2bbc35da5f1ccadd84acead0331cd4ff4b4643dbd6c4b700faf7091ad8030f3", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357664, "uuid": "f0d357f4-8dae-4829-80ae-7a08b96502fa", "comment": "Malware payload (GuLoader)", "value": "0ce029c098f42b89a68e0a2a3edf4b7d1043097a", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357664, "uuid": "fb4bbf87-cf64-4b2a-9687-7938210c0b56", "comment": "Malware payload (GuLoader)", "value": "01c758081d9f8d1f83a4f60026cfb8365583a81bff3464d7c510ddc7f2d830e0af4dbd55ab4d7377a47cfa8674d30e57", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357664, "uuid": "3905f9b6-2268-4848-b50d-592dd2888632", "value": "T16CB38D23DAC50A30EA9AEEB1317776E42352AC46D5101F0E51C8FABD29711FFA5E434B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357664, "uuid": "8a6b641b-d5c4-4982-9b76-c26b5c074f09", "value": "a661671ef02a6d0e6a34eab52e2e0015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357664, "uuid": "dd614d37-c58c-47d6-b177-76d2557c0eaa", "value": "1536:+Fpb1pc1Zc08F/K6R9PW9Cwkvh1Frsc1Ef/IMG127:SbknmsmPWzIZtaf/IVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633357664, "uuid": "292e55af-766d-4edf-a559-490c38a2cc22", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633357664, "uuid": "f9c9a82c-257b-4dc9-8fce-51167e2630b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357664, "uuid": "ee7bee80-beed-4bc6-a6f7-161736ebc2aa", "value": "justificante de la transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2406c006-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633363205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363205, "uuid": "3097b7e3-9b8f-4d60-8a63-4d96dc34795e", "comment": "Malware payload (ArkeiStealer)", "value": "29373722203339a49712d52e9f354ed2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363205, "uuid": "99f064c6-0634-442e-9818-33837a12a638", "comment": "Malware payload (ArkeiStealer)", "value": "d2f6e8331b8a820cb3dfa24f4f092ae19d3c7b9bfcc2467e5ef2fce91caf2e01", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363205, "uuid": "bdc97f3c-1637-4331-aaf4-039a25efbce2", "comment": "Malware payload (ArkeiStealer)", "value": "d4cd3d018f3cdcf4beecd3466d66fd74f01a37b9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363205, "uuid": "8a0934cf-4d2c-41a3-939f-681a76bad3dd", "comment": "Malware payload (ArkeiStealer)", "value": "5efacd65fc58ab7560632cb1b5958fad4137a98ff5b68177b4522cf478287b5a6cd238033750624e131051256508b5f5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363205, "uuid": "b960c979-8f34-44ff-a4af-b076e034a1b3", "value": "T104F4012976C0D7F2E2710571B756D3F04A2EB86D1E66528F2B98E31E1F3D3E29621342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363205, "uuid": "36be27bb-07ee-4d36-bee8-f937a0dcc36a", "value": "00e4a9909e1dd2f9b23ab751bea778c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363205, "uuid": "eef01ce2-93b9-42f7-bcdd-a1da7a20076c", "value": "12288:JALz8L2lOHDMJLqTfKL5Ywjzy8kMWsBDayWRdNhnuLT4zxp6L:Jw1wDqLqTG2wjzyKWsCNhuLo36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363205, "uuid": "1fe46bc3-99f6-429e-a9de-f2925d86d3f1", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363205, "uuid": "1d49e856-4bd4-4908-915b-2829fe27c10e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363205, "uuid": "374259b8-d786-4ccc-8794-26b840f1b2f7", "value": "29373722203339a49712d52e9f354ed2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20465a83-251f-11ec-843c-42010a9c0014", "comment": "Malware payload (WSHRAT)", "timestamp": 1633357615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357615, "uuid": "a1755d14-2c34-4eb4-aa45-090383796577", "comment": "Malware payload (WSHRAT)", "value": "9942f5e63c2e6084f444410558ce4ee1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357615, "uuid": "639f1b00-1ca3-4066-89bb-70d309dc9a35", "comment": "Malware payload (WSHRAT)", "value": "d385dde374b8858e48a85353d81ab03b988901aa49c27bdff815f116fe7742ef", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357615, "uuid": "5a38aae3-1a26-4f0b-8e04-58081aedaead", "comment": "Malware payload (WSHRAT)", "value": "1a0e7f8746755d7e155eea004f3441b34d08563b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633357615, "uuid": "c582133c-a45c-4d75-bc50-530cf0a43cc1", "comment": "Malware payload (WSHRAT)", "value": "bc28d221b28237abedbbb6e679cb0b122cf0f4c3ef4b3311aca0f79bec580ee0f4cdbd775a8afa2f2d24102c96e426c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357615, "uuid": "cf306bcd-9575-426e-8d70-4c641d289e89", "value": "T1C625B34B0D691A017321F460463DB213ADF4DEA33EB702E6E5857A8EEB72C105E7DB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357615, "uuid": "db2c75d9-19ed-453a-89b3-ced5317717c5", "value": "6144:rlHAcA28L6bjv8ap5mcfA/nvBsOYghtlclS0FiN0qyuGwcOirJ4cbIXRsh0jN8Ha:Gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633357615, "uuid": "c2751ffc-b2dd-4f09-954f-7cca6e9af4bd", "value": 1036902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633357615, "uuid": "a69011f1-17b0-4834-beff-cd092d2679da", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633357615, "uuid": "7439b3cd-7706-4d4e-b927-0352e35b5241", "value": "PO50029310.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017128a7-250c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633349403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349403, "uuid": "411ce183-6261-464a-b8ee-6c6c0a618d01", "comment": "Malware payload (AgentTesla)", "value": "9627380c5b0ae027d7198fd30aa44d9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349403, "uuid": "35027fb5-9645-4a0d-8e94-79950c49b751", "comment": "Malware payload (AgentTesla)", "value": "d3915175668accfe10124131bbc68d7fbac5c66c77ef9e6a2cac04655066f48c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349403, "uuid": "2944597a-852d-4ba3-9c26-9b3eb64e6b24", "comment": "Malware payload (AgentTesla)", "value": "7ab50bb1936f94b86c47d108660018f7a95a730a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349403, "uuid": "c4824938-7a4f-4caa-b3de-188b753a5fd2", "comment": "Malware payload (AgentTesla)", "value": "f9ea13a85f3a8d5abf911dcb63e1be68409a89563e23e98aa2abfb100bd013d7c57df6b7bdb416b5004bfcd2d6e2b05a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349403, "uuid": "922e3b3d-2c14-4aa8-adbd-5a28ce13d5a4", "value": "T1CAA423E15BB398D203493BDFD5BAA6123C24A0961F1C34191DC14CBF6B41283E69F7AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349403, "uuid": "78b5b6a4-5653-4cfd-bb22-fe9a5859c76a", "value": "12288:lzLxuJgfAnhZS8xgiyDlyZ0DsXZCM/z1w8gmbFM8fue:lztWbZS8gpypXIYiWbFMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633349403, "uuid": "81104563-701d-45f7-a37b-b19b571c3ca2", "value": 450023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633349403, "uuid": "2a0a08e7-04a8-4d68-9813-f6e0d0f894ce", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349403, "uuid": "13a3d525-0ce6-42bd-bfc9-56ad53a59bb2", "value": "Quotation.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350c6900-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633338752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338752, "uuid": "5dfb08b1-2bb2-4b82-ba79-f69752b39fa0", "comment": "Malware payload (Loki)", "value": "80c38e7a042e5418e61c8c21cb4f3f3c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338752, "uuid": "b0ebeb11-341c-4045-ad12-0d1e7fa03e21", "comment": "Malware payload (Loki)", "value": "d39993171762ba62999d06ba6425836e36189d7a991c2a8da07bb2b3a0ad75f8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338752, "uuid": "b26ba2cd-5e96-4fda-a4cf-eb0066526a06", "comment": "Malware payload (Loki)", "value": "e12e5ad0cd673fa13b41d16a172564b74a949bb6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338752, "uuid": "9f0d5aa3-da92-403f-a596-38264cce0380", "comment": "Malware payload (Loki)", "value": "f43b17a0d992a95fe2ca503c19b525376a8bf724f42c73d0e696ae43d8ea8236f98f828b2b2b9fe33e8730c7b6d68d04", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338752, "uuid": "1d217f68-ba66-4353-8b4e-93a70656c3f5", "value": "T177641229B1C0DB55D859B7343D27378EC692DE90BD24187ED109F20A6DBBE22DC9AC31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338752, "uuid": "2ad2d0c7-1d4d-4771-b050-e59ccbca9df9", "value": "6144:vYsOHHIXJO1u1MNizS+gBxxtICejb+qWfEU4Kp8A60Zz:vYsOnIA1u1qCsxvINjbB0aK56wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338752, "uuid": "090c19f9-ac4b-4d48-b512-5ba39bee9e24", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338752, "uuid": "4628fcbc-d95a-40f0-a08d-2e60bdf51106", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338752, "uuid": "9da5455b-2d45-47ea-a403-ab1ee99d2eba", "value": "Order AcknowledgementIndonesia.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f599b0-252d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633363910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363910, "uuid": "143de22b-e9e8-43e9-ae77-ce790c52c066", "comment": "Malware payload (Formbook)", "value": "7ae0efe6574d6662c0a8e4ca59facc3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363910, "uuid": "5b9181dc-d2e8-4118-8b34-82247a1a3612", "comment": "Malware payload (Formbook)", "value": "d3c68ebad6229b1da92061291639f9b48e3f76fd4c524a9850b4fbb311e180f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363910, "uuid": "b1e7ec27-ac92-4a4f-a00e-dd4a1dd22221", "comment": "Malware payload (Formbook)", "value": "8018d590037001b2eb512006a9277802dd19b3df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363910, "uuid": "7b01219e-8261-4a0c-9127-07d39f2670f6", "comment": "Malware payload (Formbook)", "value": "e36383a97b9cb0e8cb8795f63ced1e25bb7e8e3644aa40490167cb74bd1d25dc25d9e466e69d9e5780f0aa46ab46b472", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363910, "uuid": "4e2c362a-19c0-49d2-bf39-6de4bce01caa", "value": "T1A174F1786367A708ED7D87F52C28E68217766426111DC7386D8CE4ED3FA3BB44AE0943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363910, "uuid": "47c49c42-203b-4a87-88e0-6bf6b34a45c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363910, "uuid": "95b14664-00eb-4822-ad3a-3b2d12c703b8", "value": "6144:q2tv7ERQ+3HwOWOh0ShExAWsodu2cuZjGaDWqsT+FdlWmnA416AQMLY3Znwf4MGK:q0ESoWq07ezAGSS+fJ1pLffuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363910, "uuid": "e6388eeb-54e2-4c44-b38b-16ed86d242c0", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363910, "uuid": "588f8b2a-98e1-4dae-ab9e-fcdbb0363432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363910, "uuid": "d5df9215-ddbd-41dd-8e0d-82d5dc8079f1", "value": "7ae0efe6574d6662c0a8e4ca59facc3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ca592e-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633343282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343282, "uuid": "d038dc40-5963-4b21-a49f-3a6111ae80e7", "comment": "Malware payload (ArkeiStealer)", "value": "082d51b264f6525306da27655043782f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343282, "uuid": "7b3de4ee-0d1a-463c-873a-872b18db4b5c", "comment": "Malware payload (ArkeiStealer)", "value": "d47bfc683242d2e51692d7fd0acc29f2cb1818c7739249203aff61334d5a04ec", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343282, "uuid": "2d9ef7fd-0db7-457c-b123-e99dfc36b98c", "comment": "Malware payload (ArkeiStealer)", "value": "f37b2b83ed72d9aad893c4b9459d35606391d4d8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343282, "uuid": "b3168065-bee9-42fc-91da-d7a62a5978eb", "comment": "Malware payload (ArkeiStealer)", "value": "e3a5e4ac92090f729838bf919e4e3a4bddf5520b56f5c3dc3ad1692e65e4652a591757c904920fd77ff0d5ec91082f7b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343282, "uuid": "8fda918c-3f0a-40ea-bfcd-a4b8cecb8e81", "value": "T1F5F401983990D7F1E7340230BB06C3F40A2DBCED9D6A525F678C675E6E3E3D29A21245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343282, "uuid": "21b5b71c-acc4-48c0-886d-0a09eee608e0", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343282, "uuid": "11d2218f-abbd-45a5-b524-c28337e5d93b", "value": "12288:xOtsBRIVco61/ym4bViBo2NY8msk0jddw1jXByoJgi/bzF+yMUiXAzxp6L:xPw9q/n+2Rpt/vVO1MXE36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343282, "uuid": "91a982d0-db9e-4892-90c5-de08a8144cb9", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343282, "uuid": "d26116b0-37b3-4d02-a03c-284fbdb641a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343282, "uuid": "6569e285-0640-4b7f-a870-5f891fa6d015", "value": "082d51b264f6525306da27655043782f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223c091f-2557-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633381670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633381670, "uuid": "c1e3e26c-90cb-4a7c-bd85-2d383ba1a04f", "comment": "Malware payload", "value": "8c96bcfddfb59e0ff80b836fc83a9f8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633381670, "uuid": "9a4a787a-7134-4ce2-aa7f-69f60ea9efd9", "comment": "Malware payload", "value": "d51535fbb853fd16a36644696134e613fe39eb31c7d30d719926e794446bb715", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633381670, "uuid": "da3d85fc-e0eb-43d4-9c06-56fc068a0c19", "comment": "Malware payload", "value": "9dbb2cfc309eacb1689d6d85c6a7ae130dc8a1d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633381670, "uuid": "e6f6bad5-454d-4eb8-85e2-6bf377db14d5", "comment": "Malware payload", "value": "4cf7f0a36bcd83387783946a822247421cb2cd7858bb165d96e1e8bba39d23fbc3e66469e0a67fda5435e42dbf16ffb7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633381670, "uuid": "59287763-42cb-40b8-a454-876f28cbe30d", "value": "T148248D713681F432D0960479A65BC7724EB9BC731AB198C7AF984D698F322D2DB39307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633381670, "uuid": "853df546-11ac-44dd-8ce4-6afe9b19841d", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633381670, "uuid": "dd124e23-516b-43ef-a761-3a1dd3e4fa59", "value": "3072:U/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUhvu5LY:U/MEfuN0t8C5oFsoeRM3o0j8v5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633381670, "uuid": "a8235c5f-4ace-43cf-b802-2825ca82386e", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633381670, "uuid": "660bde78-9fa4-4d03-97b8-64a85e408208", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633381670, "uuid": "d2418670-c61b-402e-af2d-14008050672d", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4c60e7-252a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633362580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362580, "uuid": "b35a1cdb-fc63-43c5-bb61-4bd5ff623545", "comment": "Malware payload (SnakeKeylogger)", "value": "931992959f7ba4781636d93461172f90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362580, "uuid": "1a286650-74e4-4b5c-9c2e-8380f90a7cb3", "comment": "Malware payload (SnakeKeylogger)", "value": "d530cad41526c4ea7091448abac45261b645f509107684873989876934bb3caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362580, "uuid": "ec1de6f0-86b1-4ae6-a61d-8b9c831cfc7d", "comment": "Malware payload (SnakeKeylogger)", "value": "5c36058e15f44c5b572dad2e145b56b35334c859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362580, "uuid": "60bae6e5-393b-47e7-af7a-eb52343512f6", "comment": "Malware payload (SnakeKeylogger)", "value": "d12f8cc7b5a944d1ff08c3c56e75492bd2b8afdf8ecadeaa2083885af1ddd4d8cb51136adc69a0903f974242b3c94a2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362580, "uuid": "3636d199-b7cd-4016-9880-d427f7c1fa94", "value": "T12DE4BF64B747D51BCE354BF028ADE241533AAE111A48C32E3885BBBC2E73774169CDDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362580, "uuid": "38389562-3b57-4fba-a472-1942ea93bcbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362580, "uuid": "6c4d351a-e67b-4158-af2a-ba0d3d46404b", "value": "6144:AOaY7WeQ+3HwOExxB3+AkmZlIKl1U7ZoQQ8SF9xwcRcSVztoOZA+YbtEdqzM9fqL:bIoGPl3XQ1SFeSVztokAEt9fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633362580, "uuid": "0991b86f-d1f2-4a37-a753-447f138e12eb", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633362580, "uuid": "321494f3-6455-46c3-82b9-66d774d53589", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362580, "uuid": "e33ca237-baaa-4ad7-8b5a-9ec5febca56a", "value": "SWIFT STM_CA4363_04OCT21_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8df9987-2516-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354006, "uuid": "a1b81cf3-eb10-440b-8676-e5d3fb14905c", "comment": "Malware payload (AgentTesla)", "value": "5a11555e99c9413f26a971099399c8bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354006, "uuid": "c16f2daa-3352-48ef-86fe-c604ba83df62", "comment": "Malware payload (AgentTesla)", "value": "d54ffdc715238d638d8fce868442971619940534ec5d975448bdc27a53dea924", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354006, "uuid": "fbd7b939-3fbd-4c88-967c-a16da4bfd60e", "comment": "Malware payload (AgentTesla)", "value": "23bdba507b5c8b4a03d9df864f6634c039ff0cf5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354006, "uuid": "1b94f778-be33-44e5-852a-a6fe827bc358", "comment": "Malware payload (AgentTesla)", "value": "ca12659c1088dfa3544c746ee96f75d311b2e6f8bda634cfe9888454ad1c8caa8a9ac91161e6a0413c2c1617841e9cb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354006, "uuid": "59cdc1bf-6b5a-492d-b076-d3394a70e752", "value": "T18FD4B030179570D4E3327AB08BB3E442F5996D329F9D92D83843F68DC6B3642E973A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354006, "uuid": "9ab5ede6-3e54-4bf8-af91-9c5599684d10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354006, "uuid": "47ea9580-6368-4b65-91b6-02f2661ec73c", "value": "12288:sYxaM8KuQ3iu43p4exgb/Jf+wD6pzcAG3E89b86j6jY:CjQ3iu4ZWVfj6Mnrj6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354006, "uuid": "71b54d55-37a8-46f2-a38c-45e4e97dd8c1", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354006, "uuid": "1e7349e0-32d9-457a-9d50-be9e9747c93d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354006, "uuid": "36f9196a-9d6a-4152-b698-6c3f834e5ea9", "value": "TRANSFER_REQUEST_FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd649b62-2503-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633345907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345907, "uuid": "48c67d27-71e6-4534-af17-025cf3560099", "comment": "Malware payload (Formbook)", "value": "25492435e065d99855be0c5f3860a771", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345907, "uuid": "98e9916f-0664-4e65-9599-c3cae6b5ea8a", "comment": "Malware payload (Formbook)", "value": "d58475e9fc5aee734cdd9312ae9277de5be466768036cf5be3f928cb52b00850", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345907, "uuid": "40a1bdfb-e312-4362-a837-bb2cbc87e6e0", "comment": "Malware payload (Formbook)", "value": "4938ce0f5786d61560aeef9c9c94cf4e231ab97c", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633345907, "uuid": "206708d3-1f24-4964-9d7b-206abfa93ed7", "comment": "Malware payload (Formbook)", "value": "e70c438967960cde0dc0b94589371437955f95f648bddf3095d1d1226ae82114ab690d285ac4e9695eba325fd5071358", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345907, "uuid": "7b2c07f1-b5df-4242-8996-7e8521b480c1", "value": "T1E434136F7C87FC38566B24DD57AC2E34370285D68B29C2605E75E8F44B68C6E7E0058B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345907, "uuid": "6d188458-ed07-4a7a-8c87-ce911d37500e", "value": "6144:iBf2wR4wHP+z0xpERSFEGSv0sQsCLUHJ6kqVnCPCX:iBSVz0xpOSA0lLjTws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633345907, "uuid": "32d09d75-05ff-446e-89e1-8a75d3b32da7", "value": 249496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633345907, "uuid": "8cccf0c5-6554-47d8-a4aa-ce59f3753afe", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633345907, "uuid": "92a5fcd7-bcb8-4f70-9b4f-5397162cbf3f", "value": "PO-53718.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31de6ec0-252c-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633363228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363228, "uuid": "43cf555e-ffbc-4c38-939d-888f7b068571", "comment": "Malware payload (DanaBot)", "value": "b2d6e376b0a35492cf9cf81f89d7dccf", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363228, "uuid": "6801d388-d943-4ce9-8d8a-67ededb4a629", "comment": "Malware payload (DanaBot)", "value": "d6231724308836e66c5fa21009af32cf671caee48643514f34711551f01f3f96", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363228, "uuid": "7324830a-6930-485d-ba2b-cc449cc50846", "comment": "Malware payload (DanaBot)", "value": "41aba57098eb52c142580052be122baf11b3da6a", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363228, "uuid": "698ba00c-880a-4849-9f7d-6393cbe1e045", "comment": "Malware payload (DanaBot)", "value": "0984fd6491ea73f4e9cc3e52151a99ca632b0e761c18e0fc2b497066e0bc98bcc060fe35843c8094270599e823fc4757", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363228, "uuid": "8ea49f15-aaf7-486e-b55b-6d5862b2ced7", "value": "T13945221E3485D7F2E27A5534BB31C3F4466CB82D9CA2528BA7E5272EBE383919734305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363228, "uuid": "f3372f34-3e5c-4705-b364-db456da86a51", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363228, "uuid": "59d65118-514b-47ec-8cc2-b320b848616b", "value": "24576:m/LwxtQDWsO9jw/ly2pM2DgfbQ0/HFtZDqsd33hL36L:m/ZDAjw/lxmYgzQ0/HFtFl3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363228, "uuid": "bdade98b-021c-47fd-8572-79b0573d7800", "value": 1218048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363228, "uuid": "6862a797-94f3-43e8-be65-885c360ff681", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363228, "uuid": "2c1ff8aa-0fd6-4c6c-8bfc-b6b0221fa767", "value": "b2d6e376b0a35492cf9cf81f89d7dccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafc7e49-252d-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633363888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363888, "uuid": "f4155e5d-fccb-4144-9523-9a2080e3bfab", "comment": "Malware payload (NanoCore)", "value": "56e3b245dedd1ddf94d0362e5f343a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363888, "uuid": "894cc89f-cb8a-4a90-a03d-7b7d24e92fd4", "comment": "Malware payload (NanoCore)", "value": "d627f3774ca71311d578cab84cdabf89605f5d63ffbd0dbd6543e0986151c79d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363888, "uuid": "07ae4904-5c6e-4af4-9ea1-cb050f541943", "comment": "Malware payload (NanoCore)", "value": "5b1c32c92c3f205749da5f751a1541babcd6c122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363888, "uuid": "cd004c22-86f8-478d-9612-bf6d6636de61", "comment": "Malware payload (NanoCore)", "value": "2d9012a40276267751a731fc481fe039e9577710a462e0d8133356899c63317ab822afe8b36584f5520d7f21b4aeb5e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363888, "uuid": "6fd24ee9-9039-494d-8a74-93e0fb8eab5b", "value": "T1DA927DE577A45A65DAF50AF7FC37FA500F70D33B45228AAE148423AEAD937106B21306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363888, "uuid": "8af8558e-1445-4981-b5ee-50a658d213d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363888, "uuid": "3f1a645e-239a-4fe7-b6b7-febb45ad6225", "value": "384:5yD6dOXS6w1biDIED+6gbZOZAxx0l7m/0N64qJSnT0UUKN7Kh:5TOXfwMDIEq9bZrxxu7mchqWNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363888, "uuid": "4eeeed93-c6d6-44d9-82ba-249732b2555e", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363888, "uuid": "a815f8b5-1b33-4037-82f7-eb7b11b95575", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363888, "uuid": "168bf65e-d041-4aeb-a8f9-79fdb3e33665", "value": "56e3b245dedd1ddf94d0362e5f343a47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4c08bf-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633347814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347814, "uuid": "f825a9c4-0f91-472e-970b-71b23f4750b1", "comment": "Malware payload (SnakeKeylogger)", "value": "17c0f0568b37daf4eb22b40d7ce8c332", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347814, "uuid": "bbdfc14f-46af-466c-b24e-e05bc8767110", "comment": "Malware payload (SnakeKeylogger)", "value": "d6293a2da7e53b870b97ca497274f16b4b0b9914a85ad3164cf78e3bc8ed1d00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347814, "uuid": "77406b25-43cf-4555-a924-94b7bfdab6a0", "comment": "Malware payload (SnakeKeylogger)", "value": "6902fca8b77184af631591fbe5656501d14b3a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347814, "uuid": "38b02537-c2da-4b48-a414-f4e47e6a8787", "comment": "Malware payload (SnakeKeylogger)", "value": "1d729e1b26221ca7542488e61ffbe1b00040fc25a4b5e67d5d967e51578ce163f164f6b9300ea3f9a3c17a873b7c401e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347814, "uuid": "e88e497f-254a-4417-94b8-4e59e1e5852f", "value": "T19E74F16823675318DD78C7F03C04F66247B6A42A241DC73C6EC9E4EC3BA27B45AE0A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347814, "uuid": "e9c6a2f0-53fe-4dbc-a301-416f5fa5342f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347814, "uuid": "52a8fd09-01c0-40b7-8d97-f510215b773c", "value": "6144:ldtAlERQ+3HwOOcogjPmGUgJmK4RN0sTA1a4dRBwYYSw0NG49PEirheLhhF0:lOESoGgyGx4w1ayNV7e9hG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347814, "uuid": "734ca351-c968-49ea-9767-d8f4bdc2e7a9", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347814, "uuid": "c686d6dd-f2ae-4e77-ad68-c0a6a5365e7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347814, "uuid": "ae2787fb-c0bf-413c-861a-8adcce315153", "value": "Olimel & Periolimel PO.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d667e9c6-24db-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633328715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328715, "uuid": "2a9a97f0-2541-42a5-b82e-075729feea88", "comment": "Malware payload (Loki)", "value": "c30dc02db5a577781b541aeb1968cb78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328715, "uuid": "22bc0f1c-74cf-4bc5-8650-74c431c6d78e", "comment": "Malware payload (Loki)", "value": "d93dd7a2596af7479ef16d2b345948d6c117d64fbadafd982da2a7631a096eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328715, "uuid": "fb3b0de2-4577-407c-9a79-a49937c93b3b", "comment": "Malware payload (Loki)", "value": "3a070ee999938aff6554c59d0033b63e24fd092f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633328715, "uuid": "1de079ec-e83b-4404-9d9d-43631c5d78bd", "comment": "Malware payload (Loki)", "value": "5aff42a684ccf3ed470ba1ade90f3ec1235ccd99be30de6c5e69c55a7e03d99a1a1b03dfb1989eb4de59492770309e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328715, "uuid": "474e91e0-cfc1-4464-91c1-81d2e0e61614", "value": "T120A37C41BBC7A720C468267084EB67A903B2D78F6333D7493D4D01B65F917E98AD8BC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328715, "uuid": "4a1f3ad8-292d-4a0c-90d3-c0ce936319f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328715, "uuid": "b03a3f28-9503-432e-8a6a-15d5fc5b2be1", "value": "1536:02iKNnJ6LS7GX3EeSS0Cy74CT3TrYz6vDpMQ43+41xPNfadR:02iKNnJGn6S0h0CTXYmvFMQ4b1Lfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633328715, "uuid": "9e07683c-4f6a-4a58-a899-d44f689c1bf9", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633328715, "uuid": "609b7516-7cdd-4df8-9eb2-c95693142653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633328715, "uuid": "efdc26f3-69b3-40d2-bb74-2958670ed93f", "value": "FRIMO GmbH_P.O. Nr. P.O_529410RT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f2978c-2519-11ec-843c-42010a9c0014", "comment": "Malware payload (Squirrelwaffle)", "timestamp": 1633355205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355205, "uuid": "6e731758-6e37-463d-ae58-a515647aea5b", "comment": "Malware payload (Squirrelwaffle)", "value": "267aa0f6d02c470db4951b3d9b80d8f7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355205, "uuid": "80879622-ae2c-4cad-9402-d29e67d6ec7f", "comment": "Malware payload (Squirrelwaffle)", "value": "da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355205, "uuid": "28a29de8-5e85-42bb-aab9-4a2e37d3fea9", "comment": "Malware payload (Squirrelwaffle)", "value": "a9627760018699a0ce48499fd58b43e3d33c51c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633355205, "uuid": "7875db97-6535-45d9-b3a2-4d463abe00c8", "comment": "Malware payload (Squirrelwaffle)", "value": "d8bf7e4f87873226353ecdca9470b33d0d136430e609baeb3f55627e90337794735c73051275d8787e085baf4663fdfc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355205, "uuid": "8cb9a74c-55df-4c65-aafd-8a17498d1df3", "value": "T102A4C264E8CDD969D3243A7182E7CA6C966D5D0CFC1308DA77AF3A5C2971FCDAC09182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355205, "uuid": "bd899bd2-12da-41aa-8fc4-2ac7c50b8f91", "value": "11f1a73b190c12f534eff8a5c7e4f9b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355205, "uuid": "a70c75ba-1df7-4570-b9ea-2c27f910b30c", "value": "3072:rZnBbPe1aHYouWDfsppnwh2l4kdQXHq7pkOoAR:9JCeTfspV/l4kmXqqOoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633355205, "uuid": "78bc03b6-5d46-492e-95ac-73794d1c81ec", "value": 486676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633355205, "uuid": "6c8e0e4d-aa5b-4ad4-bdfb-0959ab3097b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633355205, "uuid": "fc72281d-6172-4f8b-8ea7-01a0f3bba024", "value": "test2.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3decfa0e-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633354659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354659, "uuid": "a150df22-abdc-4adf-aa2b-3cf99d1f9eeb", "comment": "Malware payload (RedLineStealer)", "value": "7b48d48e4ac4bd1887d8dedf21a290f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354659, "uuid": "6262c9b4-a6ad-4674-a27b-a8ca02e75bb3", "comment": "Malware payload (RedLineStealer)", "value": "db10d61aec42ea28a6d92e8183a1b7e86fb1fdd4bb6a989900449894cd1c6963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354659, "uuid": "f3b10e40-f406-475d-ba19-5e27fe8917ba", "comment": "Malware payload (RedLineStealer)", "value": "5efc252e90178e0f07f21c9a497977e1e2424324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354659, "uuid": "c912faeb-24bf-4eb8-bdf2-39f3ef179458", "comment": "Malware payload (RedLineStealer)", "value": "ce753090788ee1f9d5ba9167a90d26da473e9d713add5d7a169c1c4fe0150b5f317729d5e982d4e48f4b6aa2128434e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354659, "uuid": "f08a7d36-b77c-4ed5-b202-a6c24cffd05b", "value": "T1D7058638ED0B21B7EBAAD334E4BA150AA5F418BB33349D5EC192774D190760374DA3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354659, "uuid": "1132d690-6fec-42fe-ad4f-fc33b7235656", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354659, "uuid": "649bb40b-48c1-4225-9f2f-04a4081e017e", "value": "6144:9y87fViis7lBGhgQ54hgjCzRCaDq3xTyyT9bC1ZEO10vyaWndUWLiKzy16JUwjny:FgW4hZzRBLYG/EOjTA16JPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354659, "uuid": "2196874d-4d52-4675-a92c-636022ce977a", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354659, "uuid": "82b77d54-70ca-4d3c-b5ef-7749e421c344", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354659, "uuid": "5a984c93-0471-4bc4-8102-39f9296befc3", "value": "Swift_HSBC_0099087645PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef835463-24fd-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633343360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343360, "uuid": "3232e85e-872b-40d7-8a96-a4800d751606", "comment": "Malware payload (DanaBot)", "value": "f752e26437db762a63b829fabebb3525", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343360, "uuid": "3e4ae496-6f94-4fe5-a2a9-eba175f4df12", "comment": "Malware payload (DanaBot)", "value": "db18c9634b57f7b8385699f24968c7a851dc2ed2b464acd5c3d93e8e9a27ce7a", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343360, "uuid": "c1fd1321-75f4-4e03-8a6f-dc78cf917b83", "comment": "Malware payload (DanaBot)", "value": "a557e21363f5ba571c92e5d6c5aea160f1d209ab", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343360, "uuid": "96eb1cbc-abf7-4691-9095-bcc9f39b250c", "comment": "Malware payload (DanaBot)", "value": "0dc6bbcc4d71cc1bb80c6d14bd21d739455610bedcfecae3ebd703d4bcfb182ebe5aad2a86bf8d2db6199fa4c36c69e8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343360, "uuid": "9b1d028b-09d5-4992-a0e4-ec3aa4875567", "value": "T1D04523E87181CEBAD1761435AB42C7F4873DBCAC5D1A514EE7897B1E6E3D3C252AC208", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343360, "uuid": "dbfd36a0-931a-4e5b-91b6-1ad2e9eae6b2", "value": "d33805713bf84c5172011e6ee58dcc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343360, "uuid": "ff774443-d5f0-4ef6-a07a-12f7e193accb", "value": "24576:azzsqut9S1A1jLugbQf+tJGOgOO8aBGtPQkq5MJZ+Kqv36L:a/it9nuVfVOOBBGE5MJcXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343360, "uuid": "9a1ef825-fdd8-4268-9440-44812b936ed5", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343360, "uuid": "32e06537-a997-41e9-a77b-140ac417167a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343360, "uuid": "416614b1-2816-4764-ae41-7243e0c699c2", "value": "f752e26437db762a63b829fabebb3525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edccbe2-2509-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633348352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348352, "uuid": "c7c98307-6095-4790-9c11-d424fea078ba", "comment": "Malware payload (Formbook)", "value": "a7769d8168b5fe3fec436f954ea56b3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348352, "uuid": "ac0ed0af-edf9-4dfe-b068-e5c4e40f3336", "comment": "Malware payload (Formbook)", "value": "db4d5bd36f923fdd47daf48ace971f47e9764d27a2f88241f09c754c042efc28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348352, "uuid": "cae8504d-764a-4097-81ec-6ac31431da20", "comment": "Malware payload (Formbook)", "value": "b22a00042ac4ea0514303fb91f745e1a539c99a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348352, "uuid": "5677db70-201b-42fd-b4cf-26df4e091029", "comment": "Malware payload (Formbook)", "value": "29959308415fa73a162fcda5e40242ef3b11bd4897ae7d763db39b5fa3685524b38cab00e35996816ef78ef73c959eba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348352, "uuid": "6204988e-8197-47de-8060-b3582b715a85", "value": "T170051049F3109E76EC4E5BB6883ACC31A6277E1A5134D74D229F329A4BFB3031C66D49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348352, "uuid": "ab0973a2-5bc6-4d6f-a037-52fd43d764eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348352, "uuid": "fe2e4bea-e88e-4b44-9927-183ec210af1b", "value": "6144:XyQujhjESDrw8wSFnyHYEr5OzfPPP/JbKefQyqtYI5YNcncza+Sr2x4wj:XyaSDrwtOnqYSOzfP/JmeTJ89nxr25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348352, "uuid": "c8000905-965e-4a73-b767-3c1181723648", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348352, "uuid": "d012a24a-683d-4582-83c1-cf42f22b5101", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348352, "uuid": "800d838c-447f-4e32-8d0d-c6e39f936d26", "value": "Product_item.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c8401a-24e0-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1633330536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330536, "uuid": "6575978f-e1ee-496c-9a40-5a5e42879231", "comment": "Malware payload (NetWire)", "value": "9a6ab94484d3987d7ffc49d24b3b5783", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330536, "uuid": "c88402a6-8365-4628-a56d-44080ad4b329", "comment": "Malware payload (NetWire)", "value": "dbafada7e8406895de0d99952e4543a123b453c9181e4b9244c8938e3cbc9d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330536, "uuid": "7119cc2f-ea17-426c-8ec0-a583f452b08c", "comment": "Malware payload (NetWire)", "value": "694a52adcd917ece99e03b46459d9dbcd1d89dd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633330536, "uuid": "3cc868a8-873f-4eba-a043-d55c2b9b2b89", "comment": "Malware payload (NetWire)", "value": "809d24ddc67f3213072d85d7446f6a7847d1eba402e580a0258df9f13e04c0f79433e90e0592c32b6b7f94b15bb13495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330536, "uuid": "98fe2d66-edc6-4268-bfef-ddadfb97298a", "value": "T1840506224144A72AF11A3336E98B111417E2AD3C2E604B3AF5955B4B4F3F784EED687F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330536, "uuid": "c9bb61f4-fd9a-40a2-b3aa-e34ad549545c", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330536, "uuid": "7e531210-4a7a-4b06-a9ba-5e9372093ae9", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyNCYAycjL7YiEFXXXB:Naeq3gF1Sf+WIy9AyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633330536, "uuid": "a21c69b6-cc19-4f68-a1e9-6e74529ce959", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633330536, "uuid": "69bc6fbe-0d4e-4e12-a36d-d5f0f32ac521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633330536, "uuid": "e908ca2d-945b-429d-94d2-1c1de3313995", "value": "Kojcujmcpvqazbuwcyhwoekmlsfsochnsl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d227645f-24d1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633324413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324413, "uuid": "9aee2a0a-d201-41f4-91aa-444ce76bb251", "comment": "Malware payload (AgentTesla)", "value": "0a7c5490fb307afc349e24d7694d8fd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324413, "uuid": "a47c8478-caa3-4d04-b69c-d6938ee5bc22", "comment": "Malware payload (AgentTesla)", "value": "dc4b19b74cb686b4e52a859cc242628c77d53b0620af737f597a6ff677b1577e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324413, "uuid": "5cbd9558-af5e-43af-9467-93ceaaf10026", "comment": "Malware payload (AgentTesla)", "value": "544b94093393e63ac609cddd39772128579e0d28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324413, "uuid": "01e2032c-124c-46ba-aef8-a59a0aafeff9", "comment": "Malware payload (AgentTesla)", "value": "60d2c68d2eda30fff346fe9a60bcb223bc69f15bb9e6bdd2caabd203528b11f6c7d6367788429f3b4c55f3e3ea509ba6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324413, "uuid": "0bdb1e1d-1f34-4569-9f5b-f8e7e5e7a402", "value": "T19373D05C39954ED5E3AB09B9453AFF1C2D309D29899A42D3349D347F73F2A9C292032E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324413, "uuid": "4f93005a-21b7-46b9-a209-6fb89bffb7ad", "value": "1536:ML/soGcfq8YvWCR7e1K6r/yBGsJqAp6ghIdwVh:ML/6RHvWCh4XrEGsJqAp6GIdwVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633324413, "uuid": "d7bc0c92-5e25-4655-bb35-5fbc9bf41c55", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633324413, "uuid": "21b0c089-e38f-4933-95a9-9f7bf0a47774", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324413, "uuid": "db5201c4-f931-40ff-bd4b-22ba0f5ef31e", "value": "PO. 2100002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ef8636-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (DTLoader)", "timestamp": 1633354585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354585, "uuid": "d79e46d0-6bb1-42ad-8e9d-fd0f4852b0bb", "comment": "Malware payload (DTLoader)", "value": "22917f2541a92bd62db9f3eec2d8791a", "object_relation": "md5", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354585, "uuid": "078fcca6-69e1-43e4-8fed-86bc2aebd75f", "comment": "Malware payload (DTLoader)", "value": "dd6784ac60b0c12eea95173f2ea268230d1067e1704b58938682789673dbb08b", "object_relation": "sha256", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354585, "uuid": "7348d09d-45dd-4e7b-a120-7c1a3fc571dd", "comment": "Malware payload (DTLoader)", "value": "d789882cd93e83428968fa18ba23ae11fb4cc761", "object_relation": "sha1", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354585, "uuid": "0481e0ea-adae-47a9-93d2-611d89239c66", "comment": "Malware payload (DTLoader)", "value": "06d3ea953c734daa7edef1f1eeaf46eb8021c46bf403a701537449bb34300f30fd3dcb2c30691d00817a1094405f7691", "object_relation": "sha3-384", "Tag": [ { "name": "DTLoader", "colour": "#998D40", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354585, "uuid": "bdcaf9ac-1847-478e-a04c-06ce774a0ac5", "value": "T136A53116A1A64F84D95C517990EF1F82779CBF4A051AE38F5335E22FBEB36F89D20402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354585, "uuid": "303b9925-d1e8-4f56-8595-83e61281e681", "value": "1536:nynHns0/iCM76shY0nIcjELcUgBHPmMwFKvsgqC+Y+A9ftCA06Kz//:nA8JGuY0n9UysbC+Y+A9YAO7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354585, "uuid": "86c2186a-6f71-4119-a368-d6f5c7b31c63", "value": 2151222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354585, "uuid": "ddf37cd5-a101-4c6a-b03f-d3425b75e9f7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354585, "uuid": "a58cacda-84d4-4a43-9d7f-b13d2bcbc629", "value": "confirmation bancaire.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089793fd-24d3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633324934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324934, "uuid": "9457942d-de09-41e2-b558-dbf29caa0bd4", "comment": "Malware payload (RaccoonStealer)", "value": "fdac2e9e28dab9d46d75e1a9d0463485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324934, "uuid": "210abc98-1ca4-482c-910c-a4ba390fab79", "comment": "Malware payload (RaccoonStealer)", "value": "dd75325c7035eee20647ca9d5a101167165d2dba88f6bf54a7afc50c276aba90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324934, "uuid": "f3f6e64f-d2f7-488b-b7ec-17c22e4a770c", "comment": "Malware payload (RaccoonStealer)", "value": "7b8cadc70ee00aeaf0f808ce608d9d1f2cf488a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324934, "uuid": "664e3655-d2e2-4b36-b75c-9add5af02db5", "comment": "Malware payload (RaccoonStealer)", "value": "ab260c0bbbedb5f94dc67a33db8a7f272c3e28fc37e79434b40da89983fa49764e457e622c290ac5a328abdd1da32862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324934, "uuid": "faf74d35-5f02-4b16-a328-bdc714d0127f", "value": "T181A533FD7A91D779DDE85FF9CAF74A64308C0D8FE0C780191886617AC826AC62B47784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324934, "uuid": "ef7d1cfc-db87-41a6-8c98-b2654324b7db", "value": "94e2b0572ac9e87d08b3c525a2cff4f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324934, "uuid": "00794def-1bb3-44fc-af70-6ff861e3bdbe", "value": "49152:H7YMArGklBn1sel23vbqNsJfz1WnVcihBMVcEzx116:lKBeU23DXEjPCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633324934, "uuid": "fd2762ba-e4e7-427e-8be2-a8393b1c0888", "value": 2100224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633324934, "uuid": "70753be8-d178-433e-9786-92e0761ca318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324934, "uuid": "1d85af10-e41f-4998-bfc7-04dcf97e9e2e", "value": "fdac2e9e28dab9d46d75e1a9d0463485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b05548-2517-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354349, "uuid": "349a481c-0a1d-49bd-a099-c3f5a00900c8", "comment": "Malware payload (AgentTesla)", "value": "72e63105a479d21019d002a8b84d09b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354349, "uuid": "fc3f16ca-8da7-4410-97f7-0d72cf59bc72", "comment": "Malware payload (AgentTesla)", "value": "dedc5f3de6c39b42b0eac28ecd35cf416968445f7fd5f53c279467326a10d8c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354349, "uuid": "80e93756-8df6-404c-bc71-8837e004de2a", "comment": "Malware payload (AgentTesla)", "value": "53e554113dab25864d34c609dd0e244ac4f287e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354349, "uuid": "e25e3d09-baaa-4e7d-be84-ace8c7785b90", "comment": "Malware payload (AgentTesla)", "value": "a10c0ac16b41fa664485a59d505cf88895314868cfe070fa631552327b989a7d318722b3ce5d6c754c79785693529069", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354349, "uuid": "7887a7e0-a579-4a8b-85e3-61a88432b0ed", "value": "T158642313A9B2DFE3E3BA03F8142BF768FA734894C25B159387A42DB52C5A547500DB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354349, "uuid": "2c1bd07f-534f-4a6c-9d54-6fa3b9ea1e08", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354349, "uuid": "9f329776-04bf-4c53-95fb-f6a3f539f4e3", "value": "6144:F8LxBswaQYLMGa0N5I6kFonkjf3tWbzxvjmyeHp8ejvcUvZ+/UM:/fQY5a/MkjtWBi/J8eTcUv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354349, "uuid": "66d4694a-c3b1-470a-b90a-bec1449f973a", "value": 315547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354349, "uuid": "02b00d43-cede-4437-8363-aa103476d196", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354349, "uuid": "7d7c9dfd-eeeb-44ad-a293-f1b14c838d9f", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26477fd6-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633338727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338727, "uuid": "be9522da-7e18-4cba-bf3a-919d755f260a", "comment": "Malware payload (Formbook)", "value": "67af104b7843283b2926a746ee5ce539", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338727, "uuid": "129d0b60-45d3-4716-9032-fee6efa6bfbd", "comment": "Malware payload (Formbook)", "value": "df0d69b475b0f890a77a8497e694e6ae7ce7690cc30822ca9919bd10670ca462", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338727, "uuid": "a15f63ad-95d0-4e12-9c28-2f9e7339d10e", "comment": "Malware payload (Formbook)", "value": "380d9044d60d7435851f1657f10fb1ce6d9363da", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338727, "uuid": "fe2e8ddc-44d0-4d64-b19c-2f9b46864797", "comment": "Malware payload (Formbook)", "value": "603e9c0f93f6f4ec1a0d57740d7bf297ed749c0f306607427c818d6eccab1ad9a129ba351beca8ee2b29c1e0393b1f69", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338727, "uuid": "04281ec5-0155-43c8-87a4-f5c6b48f9a7b", "value": "T1D573D03B1164C6EDD381B238BB269403D9211E62A316C6E93133315F9AFF44CD6A969F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338727, "uuid": "2eea6ec4-0142-46bd-94a2-f8411bb723ca", "value": "1536:vdfdSpe4qT9A/kOPciQ1Z3cU+rSDxxPC6jxBjNC2pAb2k:vxdCezT46xZMU+aPC68CAik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338727, "uuid": "4a516d18-91f3-4304-a375-34cadf95df20", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338727, "uuid": "4c2efc56-becc-46b0-9ed0-8c426ce85621", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338727, "uuid": "c1445a1d-b574-470b-bb2f-9231ab92f78e", "value": "New Order PO200305-01.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19965d9c-24d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633327539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327539, "uuid": "008c2998-86d6-45f7-b1cf-7c00f44c5d22", "comment": "Malware payload (Loki)", "value": "688ad92c68bbd4d9749ffac234552025", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327539, "uuid": "b7570fb4-8ab6-4a37-97b7-cb4d59102051", "comment": "Malware payload (Loki)", "value": "df48104c58d57b4c37724ffc8d5dd9c438f9e88e894aa3b72d9ba205b10fe160", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327539, "uuid": "9787a15c-179d-479d-8cac-3552803fb761", "comment": "Malware payload (Loki)", "value": "aff2ad06483c9453f7afd07f4b1e1a41f3d69c63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327539, "uuid": "ad17a72a-deea-45b5-a6d3-5da483e888a0", "comment": "Malware payload (Loki)", "value": "e1170da477e16e108c048d8b81c3c67a713af4218a9c37b0fd8eedbece4e67c367c45d1a38043b4cfcb2e2f1726cd82a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327539, "uuid": "d3fe480b-0a3e-4527-8372-78752cc89329", "value": "T1E244121A31F0987BCAA6633416B5E6BBFA778A455353BD072BB42E3F19604134A0F1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327539, "uuid": "a70c4ce4-aee0-439b-8f7e-c2f59404130e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327539, "uuid": "35558462-2f6f-4572-8e36-d5393db1d2f5", "value": "6144:F8LxBsuL14KEHt7Psi37MMnEYrbIDJzHLOHG+Ycj8vX3lTaHd:/MKLMMn3kBraIcj89a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327539, "uuid": "9f34e9f2-31f3-4ece-ae01-d2f410663713", "value": 255864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327539, "uuid": "72fc39cb-f9ab-488b-8daa-c6b65a5c2093", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327539, "uuid": "865a264f-6b3f-49ec-afa1-5ed1b3fc4d9b", "value": "688ad92c68bbd4d9749ffac234552025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c81d26-252d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633363886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363886, "uuid": "6a912475-ee96-45e3-8333-67faf9c6f398", "comment": "Malware payload (Formbook)", "value": "31e36e24dfb51281098ece6eab10e4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363886, "uuid": "acc8aae4-99da-4c77-87d5-16cd05402cd8", "comment": "Malware payload (Formbook)", "value": "dfa194823fcaaa6f862492b53d9bf8d12e9350055bec77d02595c3f16d6128ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363886, "uuid": "661a03a4-1e05-4745-a2a9-d29bffed5294", "comment": "Malware payload (Formbook)", "value": "75541c1a30963f0e395a1d6244db8640a2c477f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363886, "uuid": "bbf2e6f6-4fd3-4089-8138-2d73114170e8", "comment": "Malware payload (Formbook)", "value": "fbbd417948f07704403b9643cb053f0a583285254fa50758fc828879eb5b53ae5e51e33690ea2dfae7ec794bcc02e258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363886, "uuid": "1968750c-72aa-43c3-96df-7d08799972e5", "value": "T15CA5F75123ED2608E07E6EB95A35509907F1FF277AB3C6CE014C675E5A61F02CE63B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363886, "uuid": "1f8a4d87-007b-4369-9270-5d6b3eda8cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363886, "uuid": "8a7a1418-d141-46bc-9a83-dc052f4b984a", "value": "24576:rJTBGz+ZCywDCRFush4kU7czcWGoqv+qID:nw+uy4kUo4rzFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363886, "uuid": "42a7f4c9-20d8-4154-91f0-1f728e9a9c18", "value": 2146816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363886, "uuid": "20907b0d-0a32-4395-8fd7-8cd033cc7259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363886, "uuid": "2c7e7135-61dc-4f61-ba4d-2e897f9fd8f9", "value": "31e36e24dfb51281098ece6eab10e4bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741eac6a-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633339288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339288, "uuid": "8d17a3ff-9018-4b36-a0ec-1597b36aec12", "comment": "Malware payload (AgentTesla)", "value": "b474787fa9150e8da9772812c6c8f374", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339288, "uuid": "9fdb754e-41f7-432a-bdee-e499bf1bc071", "comment": "Malware payload (AgentTesla)", "value": "dff879518c41d4c9e237dc0d33174676aade049feacf3ba89089f0b612d10354", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339288, "uuid": "81c56c25-a380-4c17-a842-d4636868599f", "comment": "Malware payload (AgentTesla)", "value": "630f566ea6f1d1268c55047310624d3b0d4aed78", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339288, "uuid": "3157fa4e-6a7b-4e40-9f98-a52b1e390e6d", "comment": "Malware payload (AgentTesla)", "value": "b0e9101b5ccce4c8ab6debeae47326c02ed04a55612284738cddc933e4ad9c7b2cf7a9aeecf0ad84698872c90f460443", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339288, "uuid": "cfb021ce-38a9-4f55-ad70-e8aad141ba7f", "value": "T15E6302829EBCD253B2241EE84A5E88013611223EDB744548C676CE937CDD65EBEFC36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339288, "uuid": "8ac3a854-b166-42d9-be6a-c4c6a1e00f9d", "value": "1536:IGoAX1WznBiB8KHVZy18chBVOYnb+XF7Th+UxVy0oeAKRKxh13S:IhoWzBC8t2uBVOYb+XFHhFq2Uh1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339288, "uuid": "7a1630fc-1234-4f85-baa7-6a510eab3f60", "value": 72340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339288, "uuid": "d67e8d83-8873-4ca9-bfc4-f856dd0d3c85", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339288, "uuid": "cd783bee-f3bc-4905-bf0e-27ac1f0723b0", "value": "TNT Original Invoice.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ca862e-2512-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633352331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352331, "uuid": "b83aed47-df00-4ec1-b9f1-e3f955c68825", "comment": "Malware payload (AgentTesla)", "value": "ed09e87980a5dba85b528a3f5472fbf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352331, "uuid": "e2dcf52d-73b2-40cb-9907-00e16e99c66f", "comment": "Malware payload (AgentTesla)", "value": "e16e6f37d6df72bd04dfe215d5ae485ff783423c82514d95926947050244b06b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352331, "uuid": "e434f472-dc65-4ba4-833d-3384fe98dc2e", "comment": "Malware payload (AgentTesla)", "value": "b44fa0dcd6a51ef44da601949cc0656387b9909c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352331, "uuid": "847d8592-5af0-45f5-a44b-4ed77ec67d2d", "comment": "Malware payload (AgentTesla)", "value": "e324383a70bdf69c7ad0d6913188f7640e50b181460a990572018350b4be0a71586a08c1a7482557caf3cfc61ed25a96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352331, "uuid": "7b4ceec6-c658-40ee-932e-f11c23cc9874", "value": "T1A0D4F1AC27AB8A40FDBF47F5687090904BB1B8171516D73C9B9064ED1C737E48AE4BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352331, "uuid": "b5a07bbd-f2ab-4387-910a-8ede546fa0f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352331, "uuid": "24bae7db-b831-4509-8e05-50492379d67a", "value": "12288:gvowOqwNUM7YBs/upGIVjDYis/Jkaw7JT6YashlM0JT6YashlM:GvOqwNzVWpGO/shE9ashlV9ashl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352331, "uuid": "45b9e0ea-04be-494a-bc44-4105c45c6b73", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352331, "uuid": "5fb411c0-9b9f-424b-b8b5-ad309220c4a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352331, "uuid": "54152637-f167-4263-a45b-3f69b0e35fe7", "value": "GUaZlGatbTG40dx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca93d815-24f8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633341151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341151, "uuid": "24ea72f3-8052-44bc-9519-a6666ab87609", "comment": "Malware payload (AgentTesla)", "value": "fec24a8696d4ae5ab871bbb2cacaeaaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341151, "uuid": "4c26b4d5-0f3b-4d7a-9963-8dec3171ea4d", "comment": "Malware payload (AgentTesla)", "value": "e1cb0ef94431eeabc054fda95fda916ccc564f5d05c808fdf54e573e40f043f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341151, "uuid": "729d4204-b54d-481c-8fb3-a7909c9392b3", "comment": "Malware payload (AgentTesla)", "value": "eaf997fc74dccf3cafdc32c770669fbb2251af4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341151, "uuid": "361622d8-3e02-413a-a123-706461a1ebf4", "comment": "Malware payload (AgentTesla)", "value": "c9aad876b1b8e4a3cc92a0907004eb57b7f844bc57d22c78b4468c1ae319fb8cb376d3e97baa7169818a936fe70c9fc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341151, "uuid": "0378fcb8-d65e-42ac-956d-94d7cfade835", "value": "T1AA9401BC53A79704DE7983F13C24A29157B6A025240DD73C9EC8E4ED3E63B785AE4983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341151, "uuid": "678797f8-0a12-4ac1-964d-3e9c3a9c9778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341151, "uuid": "a50ef02d-01c7-47f4-bfef-278c4640b0ec", "value": "12288:TESo+OWcUauO9apDVdetJgpniNMNw8oFCiWiNU+:TESaWcOrpJdKJOnkLFWix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341151, "uuid": "bf1cd04e-9400-45d5-875e-62dd799c7b67", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341151, "uuid": "4d1ef282-1862-4a59-b56e-cc525632da0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341151, "uuid": "e7219229-9519-4455-8dfe-c4561d52cec2", "value": "fec24a8696d4ae5ab871bbb2cacaeaaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d204d891-24f4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633339445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339445, "uuid": "b9e5a153-321b-4c3d-943e-a28d1ace4ad3", "comment": "Malware payload", "value": "0b759f3824e1c23448bf2eb1c051f554", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339445, "uuid": "3bd3367c-28d0-4efb-88e6-2026777b15be", "comment": "Malware payload", "value": "e309d3170222031a6ca43b1b0da8513a9ceda316b3a67de4574a04bed5b84cce", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339445, "uuid": "40eb747f-9c3c-4b02-8320-e2ac05f26a7c", "comment": "Malware payload", "value": "e9d647017f1f54828f1ebd8e638a8164e8cc8c35", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339445, "uuid": "f7f8abbb-78a7-4d32-a33d-b58f0fcef9e2", "comment": "Malware payload", "value": "62d009db8fa9fbe35ee48d9a56d0735bef5c1629183fdaa17b868f59b22a6ffa05a0de4310558e631cebb1c9d1708884", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339445, "uuid": "1cadf34d-afce-483a-831c-e80f044d082d", "value": "T16E5204B1811C81C786A2E0F40BE660F6817DF6F16DDDA4E2756889EF2DBC421A95F182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339445, "uuid": "ca1bc019-48d9-4496-aeb3-88e9fb1cd533", "value": "48:kTTTTTTTTTjFKAYwaTTTTTTTTTjFKAYwgb:kFK7FKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339445, "uuid": "770452e9-1b0e-4006-bdf3-225d568e8126", "value": 13947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339445, "uuid": "2cf77497-2d65-4942-9844-9c8464f2745b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339445, "uuid": "f3088272-7d7c-4965-a6ec-6f87515b2caa", "value": "State-ment(10.03.2021)XKEO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71aeac6-252d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633363962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363962, "uuid": "fddea3d9-f5de-46df-b1c9-249c14483355", "comment": "Malware payload (AgentTesla)", "value": "189b5fb512ac70ee220a527a22ab0950", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363962, "uuid": "30496b3c-7b6e-4588-83a8-20438ea1c5b8", "comment": "Malware payload (AgentTesla)", "value": "e358b0decf6299722b1f3a357e76223d3a0d85a920f08d34c5eb894bda020840", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363962, "uuid": "a0744262-0064-4e9c-ad70-19c85fc1d4dc", "comment": "Malware payload (AgentTesla)", "value": "810b578175222c911eac1ac8e3bd961667d99f20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363962, "uuid": "46b46ede-0224-4d2a-9593-250d3ea8128f", "comment": "Malware payload (AgentTesla)", "value": "bfd03b34317965cee4b2cc1feeb42e62f0c6ff4b2ddd18d633c327b23e0ef8d2c6f45d082823f04b853d03cc755a6aa0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363962, "uuid": "eb132355-866c-4cef-8de9-feec9585d72c", "value": "T17B449DD2A34C4B52C569737A0A63F00323B1F08E9260F71E6E8C7499B526BF1BB99745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363962, "uuid": "6775c461-032a-4490-b834-471908fed92a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363962, "uuid": "bc42b3c8-48c4-42bc-aeb3-71a64d904b27", "value": "6144:q45k3R3SXePVJgiCE3Y7SEN9LOC5QcCFp3:qv3JcgSiCEy3LO4CFp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363962, "uuid": "6a64a61c-8208-463b-aa05-76631e29727b", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363962, "uuid": "f97c0101-f881-402e-9cf3-41c5e697cee2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363962, "uuid": "cd0161a2-b805-41b5-9516-337b96b6582a", "value": "189b5fb512ac70ee220a527a22ab0950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817f8504-2511-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633351765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351765, "uuid": "5933b6a9-7904-45a4-bfdf-3a53859afa45", "comment": "Malware payload (Loki)", "value": "5a320540eeef00b5020c8dd42557ab2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351765, "uuid": "42c8ebe1-1dc6-4c7d-bf55-ae4a89316009", "comment": "Malware payload (Loki)", "value": "e3efaf72472faf918f7ff2a430db45cf5ffc2eb595e1b96d4dc403603b0acced", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351765, "uuid": "b5666670-bedb-4fc4-886c-af4a80e775af", "comment": "Malware payload (Loki)", "value": "6ae4ed2188a60d7722fa691129c6fefbb7e9048d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351765, "uuid": "d887852c-8b66-446f-afeb-6105fb4bb35d", "comment": "Malware payload (Loki)", "value": "d96a3454b794807bd7145ea2a18f86cc81bcc25e1ef63f3d5e6f2e6f034339d5e1dc7b015534d9ad93f93044e580776f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351765, "uuid": "0fbdc057-4aba-4bca-b983-9b1c1e44b54a", "value": "T15154BE1D3D80C7F2D6760530A7DAC7F0292DBC6CC966598F2B98B76E5E3C3919621342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351765, "uuid": "9aba6749-dc15-4cc0-af47-5b138a8ca552", "value": "f47739d0cfd89d51cbbbec502f2604c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351765, "uuid": "7ec5e653-5aa6-4c3a-8cc6-608ae3442fe0", "value": "6144:IhN2HJC884dHOuyUVwYiFCyIJROhxxpeTr/ekI:I6HJ984duubOfx3zxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633351765, "uuid": "526a0aca-7af5-4878-8a0e-e637332ca737", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633351765, "uuid": "3501b752-0c62-4bbf-925f-157b03dbe76a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351765, "uuid": "e6f001e6-784e-4b77-82e9-543085d84598", "value": "5a320540eeef00b5020c8dd42557ab2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90183867-2540-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1633371976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371976, "uuid": "f6aacadf-a4fe-4bcb-9bb9-b1c1f9056a91", "comment": "Malware payload (CoinMiner)", "value": "57e901877779b6c8cf65630d2c482b11", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371976, "uuid": "83ccbdbf-a638-478a-ae04-556d233f671e", "comment": "Malware payload (CoinMiner)", "value": "e558134f888d403ba60d7db59978502a9071951528cd4873bd4702921012d69e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371976, "uuid": "9737c22f-56c0-4aa3-92c4-04c6cbefd583", "comment": "Malware payload (CoinMiner)", "value": "f0c9983cad9ce9f9fecdacec33fd376e28d9db3a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633371976, "uuid": "57fdf4be-4a09-4da3-baf9-216ed9e80927", "comment": "Malware payload (CoinMiner)", "value": "0c027fd6e01bd504104a93fc2f1f11342fac4b6e453d60fd80bec90f8a7b605e09b4bc64b88a192b11f3c9873bb12af0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371976, "uuid": "33e065c3-3058-44c8-9f93-62602f3c2739", "value": "T1CC449D1931D0DBF2E3B20570B766C7F44A6DBC6D0E25528F2798272E6E3D3D1A622352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371976, "uuid": "5f685909-8281-44e3-8389-33cc23eed4d2", "value": "820638e32882fc55584544cedf889893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371976, "uuid": "f1fe26e3-8a0a-4ced-806f-fd8a8cfe0786", "value": "6144:RVMI2A3bCCEwH/8dG9ROhxxpeTr/ekIw:8I2WCCE2/wGazxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633371976, "uuid": "5388f5ec-4640-422c-b26c-a8581e7601b2", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633371976, "uuid": "62aa8ee7-f1c6-44bb-94e5-3528da0c761b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633371976, "uuid": "28f3ec29-8505-4e72-abd6-91165425d537", "value": "57e901877779b6c8cf65630d2c482b11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ce2a71-24b7-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633312901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633312901, "uuid": "0188ccb2-1981-4ed1-a920-d4f5677e8ce1", "comment": "Malware payload (RaccoonStealer)", "value": "d91de16e32bfeae49b81deee85ae5a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633312901, "uuid": "4525537a-9c69-4315-8233-3ada6d6553fe", "comment": "Malware payload (RaccoonStealer)", "value": "e55b2c5d2e4903c916a6b6982b7f0030ad4a4a3e0c1d3f8969e6646dafbb3c35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633312901, "uuid": "11855f46-d969-438b-a70b-8ace6b99861c", "comment": "Malware payload (RaccoonStealer)", "value": "fa205ec6c3766810fae319c576ddd30a547a6dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633312901, "uuid": "59106167-92bf-4ba3-87a6-f7b77af945c5", "comment": "Malware payload (RaccoonStealer)", "value": "dd629f7ccce804c8fd748014ee5864cdfbf6f60787ae1e3686b5597389bf81276b6aabec897416cdc3ff38328f3c0fcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633312901, "uuid": "23b772c2-58b3-4699-b70c-88b2a1c26003", "value": "T131C4F10835A1E7F2D6714674AB67C3E0552EBC5D4C3B86CF3B98672E6E39393A721240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633312901, "uuid": "1912524d-3f98-4ed0-adb1-1f7d7294b199", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633312901, "uuid": "f872b289-3010-4afe-8d01-3d1b62051021", "value": "12288:G7C/uj3/3MY9wZZkLGefxrxp+valtTlZKaYOw9zxp6L:G7XDNyZVefxrxp+SltrX636L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633312901, "uuid": "c3de5e44-a0a9-481c-bbe6-2b459a9df907", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633312901, "uuid": "2e65bd96-23d7-413a-be00-766b326026a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633312901, "uuid": "aa4513fa-fff8-46e0-964d-a5a70cb4f27d", "value": "SecuriteInfo.com.Variant.Fragtor.28226.22477.972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7041b8-253a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633369579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633369579, "uuid": "932efaf1-e4e5-4f9c-ae70-8fcdf34e564a", "comment": "Malware payload (RaccoonStealer)", "value": "10326f975d4fa470b90002f9004262e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633369579, "uuid": "741c0f46-2742-44a2-8dc0-e3af7d029c40", "comment": "Malware payload (RaccoonStealer)", "value": "e562200e74e0b5c6864514143e606de954e496f28518659b13789d0d205fe8fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633369579, "uuid": "980d0a38-a14e-4f2f-8751-67faec2cd3d3", "comment": "Malware payload (RaccoonStealer)", "value": "01216779b3b83ed2cdba8242faef79d5c00e5b0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633369579, "uuid": "f721cd1a-190c-472c-bc18-9dfe5cc8c155", "comment": "Malware payload (RaccoonStealer)", "value": "442560ae31d74d76b553f4edffade8adf37137b5f82d855eeea0a832ce181ed3b9db253f97c7e79d519f24811e5f826e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633369579, "uuid": "ae4cbb2c-9cc3-4012-82b0-c77d9f5ba8f3", "value": "T1E4C4F10879B1D3F3E2B2D170A762CBE0457EFC699D69528F6780A61A6E393D1D331312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633369579, "uuid": "ed48d8ba-2855-420b-8413-77479e4a8333", "value": "820638e32882fc55584544cedf889893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633369579, "uuid": "3b284506-a3c6-4999-8f04-747ed4f729a4", "value": "12288:KrRpZNSZOfRr+m9OVSQbjt08kVkkM27eWgwrVxMzxp6L:KPZNSEaVnfVyDZrzA36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633369579, "uuid": "daed1f00-024e-4dfb-9a79-906d57724ed9", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633369579, "uuid": "1833547f-258b-45d7-931b-0aeb95c4fe60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633369579, "uuid": "85328bdd-298e-4c60-9edc-57c9634cc8d9", "value": "10326f975d4fa470b90002f9004262e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9a5b53-2509-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633348511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348511, "uuid": "26fb9a2b-d153-444d-a528-f1cc35acdd5f", "comment": "Malware payload", "value": "4c775f9e98e5abd557666358875eaaca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348511, "uuid": "9218df34-34cb-40df-8e26-55336e419ded", "comment": "Malware payload", "value": "e5e86fc78982e40d4af4a74ca4a3ad86f9d8b8751f16be9f49ad486a8a79f81e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348511, "uuid": "2f399f51-7482-492a-8eac-6f82381085c4", "comment": "Malware payload", "value": "8d89172d4a05c5b8b5dfb92ef41e6501ea55289a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348511, "uuid": "6d7a9807-9bba-4456-945e-6d934fb634cd", "comment": "Malware payload", "value": "1feeb58d1d84203bad4fab9211571b99ba2e017fd28daff15fcfc7de8eff76a3a85eb52ef7676b0fa24b1434009ae903", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348511, "uuid": "6981eaa6-1095-48b7-901d-9d9c4cd685ac", "value": "T194B4237A25E4B31CE03CDD29A561D5C6789C56894BCCB6934BE40EB88793E9CDCCA313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348511, "uuid": "f4067862-f673-4e17-bbd1-9f7b5693eebe", "value": "12288:MddV0kB9WAUyEZ8dEj3haZkgpPdtVpMkwp6cp:MddRmAUhZ86kXpPdDaks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348511, "uuid": "ca2c193c-5cce-4227-8243-7c95129dfe10", "value": 500226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348511, "uuid": "3c18d63e-7aa8-496e-a107-04baaeb0e5b0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348511, "uuid": "a0f1ab75-7dc8-4ddf-8f5c-614a09a2dff7", "value": "PO.4870.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e988d3b-250b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633349103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349103, "uuid": "cd44287a-f2f8-48e2-9a9a-2d1945627f45", "comment": "Malware payload (RedLineStealer)", "value": "e26eed55e8a0900619b6360d508eafcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349103, "uuid": "fa372094-63bb-4d20-a76b-5bba4ce5503f", "comment": "Malware payload (RedLineStealer)", "value": "e607ee3f4a1c7a2aeff5f3d1af8f0ccf1e3766a7f702bf83df034de065600a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349103, "uuid": "77b9a963-9922-4dae-a797-745193d9eb71", "comment": "Malware payload (RedLineStealer)", "value": "1d2191dca513f9dc1bdfd980ca80230498479116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633349103, "uuid": "ba8bbdf7-29de-46e6-b9a0-220dd01dc104", "comment": "Malware payload (RedLineStealer)", "value": "a1378398b28cb7a4714e953749f75bdabb0a6fe318727bc575df8754ddd5f215a89ffb5cf390827974914ef46ad8d122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349103, "uuid": "dbdcb47d-d797-425b-b5d8-6a6860ea602b", "value": "T1DDD459153D4286B6C83C0ABEC67953C4A27D7D532F30E27D2FB076A91AF328D555D0A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349103, "uuid": "1c7ba434-fdd9-43a3-a6e5-7a997f935a05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349103, "uuid": "07171e2d-529d-406b-84f5-ec37b96ef317", "value": "12288:JVAXaPTGMbZBmkKP/CnNgAfHt9gybf4C/jQG8q:hFTmkKP6NxfN9gyMC/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633349103, "uuid": "00e91b95-0e40-469f-a3a6-0288309eee72", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633349103, "uuid": "799f013a-8d22-4d90-9db9-39fbc6889d1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633349103, "uuid": "c07fb4ab-8e1f-4d62-84bd-b87f784ed73e", "value": "bank in slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016f1d4f-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633354557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354557, "uuid": "e305c7bb-3632-4281-8c12-639981d34b46", "comment": "Malware payload (AgentTesla)", "value": "fa4ba824a689d6d8bf6738b41311951b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354557, "uuid": "ea297dad-6bbe-45fd-b5a8-a43b5bc4f4a9", "comment": "Malware payload (AgentTesla)", "value": "e609b0840d4e812a94c5955be5718583a4f589ad7dcc7e0893164d50bd000bd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354557, "uuid": "308991cf-2484-44ea-81fb-de94843cda72", "comment": "Malware payload (AgentTesla)", "value": "31001aea6e517e6d02d586ae444e9318f9c1923b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354557, "uuid": "d34800b3-5aec-4cc2-a980-70195c5414b3", "comment": "Malware payload (AgentTesla)", "value": "deb2950bd857c9b62004c0dd2b430fbe316b9382f1d043e0576017ccdb7c17449f908c841213c22307e258d580efb59d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354557, "uuid": "c7e8c228-5a24-4c95-a22e-2849f1e2dd1c", "value": "T1FF641219B1D91CBBD22332B10BBB76FDF38A3781A216590B0B301FB91627947D4196DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354557, "uuid": "0dd9b430-c065-4219-bd9d-27d0bb3153ae", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354557, "uuid": "a26cd866-b0a1-43ac-9d60-e695734e10b5", "value": "6144:b8LxBBXsBdONpPvE3XpMHdlYP03IqiJURlHB6p55/2LRYSbRvpqG31pQ68PTqRI2:ysBdONpPvXe036JUnHB6p55p4D3TZU72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354557, "uuid": "9b2319a0-e1b7-44a3-b987-2d56fd00c210", "value": 318718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354557, "uuid": "9579d714-4c5a-44d2-a945-36ed7c51bf9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354557, "uuid": "a1ab6985-da81-4337-86f9-bd14682ea63e", "value": "PO 87678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb2116e-24b9-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633313854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633313854, "uuid": "ae9f50f8-700a-4b27-9dae-4e7fe3237f9e", "comment": "Malware payload (Gafgyt)", "value": "bcc0539d01e2f2ce06dac1bca3a30f5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633313854, "uuid": "5f5b2433-b7f6-426d-bd33-03c1c9899a9e", "comment": "Malware payload (Gafgyt)", "value": "e617a9a9b0a2182d6e1c3d93c2f212751ffb33f784f9607bfe0e2d12bed79ed7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633313854, "uuid": "9e77f9b2-32d8-45ce-8196-bd242a20f47f", "comment": "Malware payload (Gafgyt)", "value": "1d8bd9118727abf10b78e4e07a904f4f689e5dcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633313854, "uuid": "b6bae3de-a436-4f7f-90cb-507d75948a2a", "comment": "Malware payload (Gafgyt)", "value": "1d5f5a624f08f7c8c5803c5f65bbc851abf884dd975289eb26ef91131b8a2b3c68532214359b5142e2563e0ddfb33822", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633313854, "uuid": "ec8a568d-1187-4cdf-b140-a21d732e6dca", "value": "T19CD31905F4514767C2D31379B68E4A5D3B321BE493CB33265A34AFB42FC279A1E29DA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633313854, "uuid": "50f0fac4-0bc5-43ed-adec-39da017ca2c7", "value": "3072:66LdGaAhDwVHWddQNIoFhrSGHhVAgzZmsQNYMQ/XYln:3LwaAhDwrIoFhrSGhZmsQNYFfYln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633313854, "uuid": "9689ac20-64b2-4b0b-ae1d-59b791044e8f", "value": 140421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633313854, "uuid": "927d8e16-2653-400c-8571-771326ce748e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633313854, "uuid": "6cb0d8a6-2e05-4fbd-b925-e7960bb0cee1", "value": "bcc0539d01e2f2ce06dac1bca3a30f5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bb2647-2513-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633352655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352655, "uuid": "b74b6336-631d-4068-9da8-60148babe482", "comment": "Malware payload (AgentTesla)", "value": "d4b04f4508066495d1d8b1d7da1ed351", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352655, "uuid": "7d4e2fb6-b9d2-41f0-b42b-2da843e23501", "comment": "Malware payload (AgentTesla)", "value": "e6b614140a9958008deb0444549def48bb2e36d7c452a29f4f7a073bdc6214e0", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352655, "uuid": "ef0d7065-b53f-4be8-91af-ce347bc037c2", "comment": "Malware payload (AgentTesla)", "value": "4651baeb15e0834a443f20be8e32a90ca8e1540c", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352655, "uuid": "a1ab2577-c13d-4248-9feb-78fd6c5eaba0", "comment": "Malware payload (AgentTesla)", "value": "85234d3daddbed9b2400806935d22369c7404668bdebf44711690924159a7d065cd111e3c938173726e6aaface8d8b1b", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352655, "uuid": "129028ac-54eb-48aa-845c-0c34096d6e8a", "value": "T1A79423EEBC6B7EF8685D308673830E45418644B7D68DEA9A153591B79EC70EE0408CBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352655, "uuid": "5782da30-344f-4d4f-8edc-4d2af28747df", "value": "12288:LCm3FiDr/TB/dR0yO9kP9tYTBNee+bq4VF94M:LMD/BAyOm9ZVn4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352655, "uuid": "f4b246bb-a05b-4b85-8fac-6d47d0a09029", "value": 431159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352655, "uuid": "e514e6b4-e7f8-4ab0-ba8b-dd3344266e2c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352655, "uuid": "f314529c-81ac-45bc-b914-2c7c246c8aae", "value": "DHL Shipment.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23679d05-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633338723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338723, "uuid": "a0b83e39-a6c7-4fe3-8ac3-9b500e76bb61", "comment": "Malware payload (Formbook)", "value": "5b4f0a86299caa8167044e4c66254290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338723, "uuid": "11b7564d-5618-48c5-8675-6fcd011737ae", "comment": "Malware payload (Formbook)", "value": "e6cde5c1b614549613d30761b34c899f4ff69d7e6e3147c21d68bedd64f8fe25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338723, "uuid": "72e88609-0104-43ab-b63a-a6312a2bb2e4", "comment": "Malware payload (Formbook)", "value": "42a66629f75716d56790a610c404294e288224b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338723, "uuid": "d2069eb8-ed9d-484f-8f21-ec26d6017edc", "comment": "Malware payload (Formbook)", "value": "49884cb6eb1d7cadcebfc6ea8cb7759678d96c1f5111af6dfac348c22fe80fb3223931121dc81c528cf1a885d339c8fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338723, "uuid": "210d874e-254a-46d5-ad89-e42a164e75e5", "value": "T1CC841733B2AC738DDEC1A9B9393355799D2A4FABC092155138C8FE9F683248E1E113D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338723, "uuid": "bdc1cef9-e30d-42e6-918a-0832814ce320", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338723, "uuid": "14ff4ec3-ed1b-4bd9-a150-110c257acf85", "value": "6144:c8LxBD6v9qhYrkSm7Yn8RYzf1NBpHxehm+XeM33rAyrV3YNriVEXHU:XYr9mgCYBjrGX19Ae0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338723, "uuid": "127333b6-9350-4142-9441-49c48d7ef640", "value": 373997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338723, "uuid": "d9a21a04-0acc-41f0-8c6b-41485790d740", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338723, "uuid": "8551a7ca-7734-496b-921c-673ef5482757", "value": "Angebotsanfrage 86548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9ca6a3-24dd-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633329636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329636, "uuid": "3e891c6a-ee98-4288-aae3-63a7151f1721", "comment": "Malware payload (Formbook)", "value": "5ccd1492d563b11ffdfd66d51aa370b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329636, "uuid": "120fae5e-faff-43c1-a6ee-6df52e5e9bb5", "comment": "Malware payload (Formbook)", "value": "e777d588f24e21fdcc3add6de5b93d5fb498b594a59f03d02b5a7880bc5d5180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329636, "uuid": "f92bd0f6-0715-4e02-9e86-5663340e98e5", "comment": "Malware payload (Formbook)", "value": "3a7441cb83f5ca0732e8826f164c087b077a69a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329636, "uuid": "aa0ceda6-5b6b-43da-a626-21fcd9665793", "comment": "Malware payload (Formbook)", "value": "84f35639504b2fefc5e1ad0cf3b24a71aa0414731e446d81e31609ddde19d3459e2c884d37ddcc9d109980db14b82f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329636, "uuid": "57b3a34d-b990-4671-a7f9-33a860701794", "value": "T1239412AA73AF832DDCB987F5541029F2437A61452129D67C2E9D70EC3E233781AB0797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329636, "uuid": "d45f4aa7-2d7b-43c2-b819-69ad27c94a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329636, "uuid": "314cb84b-f974-4bf7-9743-fda264c99ee6", "value": "6144:cbhdbMroO/lGquzY2ZmmjrmQGnHpnP6aupTzqfU0IgDKTTVz6TRvdqs0QC+VkTfW:IbMrQHzY2ZDgR6aKiIgDQVyYAkTfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633329636, "uuid": "eaa9876c-559e-48e4-aaee-02276fa3e1fd", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633329636, "uuid": "c3752c8a-e333-43ab-a40c-af816f6dc08a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329636, "uuid": "f7b86027-1ad2-4de0-9394-108f94aa29f9", "value": "PO_A9164.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc31259-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633347811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347811, "uuid": "6104c63b-f45f-469b-9306-dfa1226f6f79", "comment": "Malware payload (SnakeKeylogger)", "value": "77de06c03c8866990f14127aaf49e98f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347811, "uuid": "f3540eb3-2cee-4e0b-abb6-b5c3307126d2", "comment": "Malware payload (SnakeKeylogger)", "value": "e79f5e64e95e3a4bba7d15fc9a8d2f5ca5cd5aaba67532246c16ed2f46abe485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347811, "uuid": "7ebd973b-ece0-4303-a65b-922060fb849b", "comment": "Malware payload (SnakeKeylogger)", "value": "90e98204369283fdf91068dbec3bf120f71d9e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347811, "uuid": "c5d8ab57-c0c1-46ba-8176-e55657139382", "comment": "Malware payload (SnakeKeylogger)", "value": "3046316bf248e124f969c8f4cc6e8c4b80b2dca1560506fa6d31c22c2a96b9066a68e49ab87275c68cef3e49c87d9f6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347811, "uuid": "50257d8c-76dc-4b89-8626-8767dd7f0575", "value": "T175C42362A1F0D0FAEB8C25702866797DE7B7035BB25C2B038768BF7236727D99610D41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347811, "uuid": "3cda1d86-53b9-47c2-981d-e9736e34877d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347811, "uuid": "c44cc9f5-f3f0-4aa6-a1f6-7760797565ee", "value": "12288:nG3ZMn2xynECklLW91NnmYqWo9BO08cCDJ4D/FW:nGJEEZr9B8DJ4JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347811, "uuid": "8f3a50fe-263b-4ec2-a591-a4b79b319052", "value": 592172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347811, "uuid": "0b16954c-e13d-49d1-8b4f-259972c49292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347811, "uuid": "1d8d61e2-5c33-4ae4-9192-2616172652d5", "value": "KH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6598c3-2514-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633353077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353077, "uuid": "94e99fc6-fa59-4910-abbe-524bbe98bb60", "comment": "Malware payload (AgentTesla)", "value": "f379279b5ec9b947c802cbe91b748d41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353077, "uuid": "617e2558-8096-41a4-98f8-663899c87820", "comment": "Malware payload (AgentTesla)", "value": "e8f337beda4f20832ac7afa1f95c2e97cdc09874cd385be68f549d249d9a23c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353077, "uuid": "8890b46f-be81-4030-ad5a-a181ddcfe78e", "comment": "Malware payload (AgentTesla)", "value": "0e288e9975cf20201a829c05c9dd82c82db28445", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353077, "uuid": "7f31e448-0714-4829-8b0a-f598c244dd9a", "comment": "Malware payload (AgentTesla)", "value": "4d1919b8f712351aa1498955fb685c3e165068e4fe5d34ebe07068b5181b95c451e697fff309b2d3e0d71e2b800924a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353077, "uuid": "4c7f244b-88c4-47b6-899a-bce1a23eb089", "value": "T12715D0202364C26AE1FBE73CC462D4718B7EF983A076DA5A5DC3D8DA4D25341851BF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353077, "uuid": "4991d38a-f520-4111-bd31-c2f05861b36a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353077, "uuid": "d1c0184a-ac5c-4d7d-ae6f-7dcd070e0cfc", "value": "24576:kA69FukcKdRboH3HWgeGG0L30tu7e+FoiYF:+9FuoRboH3H2NEEtu7e6oiYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353077, "uuid": "42a8fbca-4444-4829-8dab-917c5397b4cf", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353077, "uuid": "646b086c-1af4-48c1-829a-9304513a7393", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353077, "uuid": "253a9af2-6b3f-4a6d-bd8e-16603ac52d2a", "value": "NEW REQUIREMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9920b3-24fb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633342340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342340, "uuid": "5ada7f59-6514-4550-ae7c-9d458da74da6", "comment": "Malware payload", "value": "b6c8f797c67dfcb0abe3c2e67163c018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342340, "uuid": "6bae1b36-d743-4b10-ace6-311d85dfbe85", "comment": "Malware payload", "value": "e8f57a83f154fb0c67f6064d3dc6914ad4278e5f79d054ec66c3b8383aeb5b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342340, "uuid": "64828038-c53b-417d-b1db-c6c2e01d6325", "comment": "Malware payload", "value": "0675691842356fa468e8da22b1897a14f88aed21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342340, "uuid": "6d0173b1-f8b1-43b4-a5f1-bd429e822984", "comment": "Malware payload", "value": "25e0eaf81a0606c15abe9d22ce3c78ede00ef24fe1a764b145d59ddec131edb0b7b8e9629c7c6cfbddc3373f13299361", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342340, "uuid": "df93ffb9-2c7f-4dae-9c52-452f84d3a53d", "value": "T19666330867500CECF0B30031A5608535D13ABC734754D95B6A7CA62BAFA7EE1BDBAF94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342340, "uuid": "ff0c9364-a0dd-41b4-ac0a-12a62cbc8c5a", "value": "2cdcfb3a828433ba76b5b41f45519bd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342340, "uuid": "f1fd8706-0165-4f59-b7f1-f0ddc34cb3c7", "value": "196608:dv6x7kICteEroXxWVfEqlbkkwR7VTEJZFIyIw7lvHCL:ikInEroXgfEqirRRoJZqyIGla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342340, "uuid": "764b273b-33c9-49b9-87bf-fe28b77d60ef", "value": 6938921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342340, "uuid": "95caf808-9bde-4d39-a4d5-a749612de624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342340, "uuid": "145cd17d-52fb-4a7e-af5c-ab2634b2da1f", "value": "b6c8f797c67dfcb0abe3c2e67163c018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292511f3-24f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633338732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338732, "uuid": "863a1937-0447-48d3-b046-c00401159f3a", "comment": "Malware payload (Formbook)", "value": "b02138cb67b7de3a2fbc7c513c95a722", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338732, "uuid": "9a3d7a0a-318d-464e-b399-97db5774e455", "comment": "Malware payload (Formbook)", "value": "e93d06bb876c1368c112052ab47f8b813bd174ff0aa99468e1d11d0030ad1438", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338732, "uuid": "d5331aa7-603d-4519-a0df-d915a52f1a99", "comment": "Malware payload (Formbook)", "value": "955aa61d74b2126f46c0a10c1eb70545d559ccf3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338732, "uuid": "6b05c1cf-21f6-4ade-a213-040ef5f800e7", "comment": "Malware payload (Formbook)", "value": "5c2272c86d2700f83badfc2cd35f9372cc9dfbb3576c14ca5ff31acef84b0d65d3343e58f72c406472a7a76ccd830ee6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338732, "uuid": "03624f3a-9912-4d44-b85d-a8f3f3a49fdf", "value": "T16693E1AB0A52EEE9FCA272B68CD5948077237D4CC1758876940CF5277DF414E40EBB2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338732, "uuid": "339adf6e-e499-409f-964e-c3001877a537", "value": "1536:qouBygAgkeiKp9FT5qXgpIczdH5mWz5Z/QoX/601qPdXPuT4n:RuslgpRLXqwNh9ZYI6IqPlFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338732, "uuid": "8183c719-3201-4316-917b-4b15606f940f", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338732, "uuid": "6e228393-4572-4f69-beb6-dc43329e9aa7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338732, "uuid": "7435601d-3379-4802-93ef-ec17a6cf472f", "value": "original BL-332.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c271e86-24d8-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633327275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327275, "uuid": "abc48654-65eb-4abb-ad9f-a21f2cbfa1dc", "comment": "Malware payload (GuLoader)", "value": "6d8e840a913b5acafa7289af036939c6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327275, "uuid": "34387e3d-0eb6-4a18-bf4d-28f514760db9", "comment": "Malware payload (GuLoader)", "value": "e950c9dfaeeacc964d88afdcb075b51b88dd03c668060916dbefb250944a0cda", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327275, "uuid": "f0f7aecd-0f8f-4eaa-8ce4-82625ea19a8c", "comment": "Malware payload (GuLoader)", "value": "242b3286a8513738a75709bd1947e2432ff8139c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633327275, "uuid": "76935647-63dd-454e-89c5-2a142a62a83b", "comment": "Malware payload (GuLoader)", "value": "a63963ca9d0b043694f2fb16192196b3446e925e55c60164208576c02d422738214bd426edf78e5f5b761351ae67b072", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327275, "uuid": "82eedc85-d757-43d3-912e-df5cb26da903", "value": "T1493302E49BB2EADAC5DC08CF66FC942C5A87357793CA35AB18B27F34F189961112D031", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327275, "uuid": "148c7d65-e7be-4875-9f38-368038b7a01f", "value": "1536:ne3lHm5g4g6i+KPmfMIE8PG6WaKbzyAZqeFcWJ9:nL5LihMLEC5Kaer9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633327275, "uuid": "3b670ce8-3dc6-497a-b0eb-6f4868f21a74", "value": 54923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633327275, "uuid": "94a7e8b7-f573-48b6-83ea-db08b6dc3acc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633327275, "uuid": "9f31b30f-61c0-4232-b18e-20ef2fc3e764", "value": "Invoice Packing list.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c162253-2504-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633346039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346039, "uuid": "963732b4-b4a2-413c-8ec2-ddb7163e2710", "comment": "Malware payload (AgentTesla)", "value": "f0e38ba220616f3b94a5f71712d52817", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346039, "uuid": "05558bc8-339a-411d-8327-ac56c587b6c5", "comment": "Malware payload (AgentTesla)", "value": "e9dc15fdcf77dd8dde52392b63a79e43e39d85431434198f5103ced790f9034a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346039, "uuid": "1135eb86-7a9c-458e-80ae-f13c4b0bd9e0", "comment": "Malware payload (AgentTesla)", "value": "f59a1e433565255d52720f49ce0f4e52c29b78bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633346039, "uuid": "78260158-0070-49ec-ac12-ab6075d76d4f", "comment": "Malware payload (AgentTesla)", "value": "362f8c4a885bacc2158dd1b1f3f96848b982ac94df8e67b930b0dc766369d08bdbb0c97b713a9a561d3f72be4c65f27c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346039, "uuid": "9944e2ee-9c0a-4dc6-a151-a79ec2558a85", "value": "T1CB94026823A7D314DE3483F43C18A69127FA742B151DD37C5E89E4ED3E52B748AE0A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346039, "uuid": "8aaff1a9-4ecd-474d-89aa-bd0968617ad9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346039, "uuid": "416cdd4e-3a0f-4680-9d06-506600f28c49", "value": "6144:6Axt05ERQ+3HwO0adBqsB9+U1eqjRISdJOyYge708qlv5/Mf76oAeEHm9E0:iESoZ4C9AWIzJgeCvlY5AeEKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633346039, "uuid": "4f22a674-02d1-4a31-88e4-cf24f184c9f9", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633346039, "uuid": "b520bfe4-b3fc-4753-bd64-73d5e742e8a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633346039, "uuid": "dd3dda76-76b9-4159-ab20-4fcb2d85109c", "value": "swift art.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c711ca2-2532-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633365877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365877, "uuid": "6f81d745-9240-4870-827d-6f4cd32b1d13", "comment": "Malware payload (RemcosRAT)", "value": "31acd33cd05fd0a5c0f51fcbee4a1139", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365877, "uuid": "5a48b7c8-7c12-4fa2-b263-7fa693cfb9a9", "comment": "Malware payload (RemcosRAT)", "value": "e9f2ab5922434c4c7eba4bf7d32037e3535e39af2426c761a535e91ef16ff585", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365877, "uuid": "2688356d-60a9-4cd7-acb4-0975773a0513", "comment": "Malware payload (RemcosRAT)", "value": "17a77e1fb780b251f2b949148ce6010b1e801587", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365877, "uuid": "31b8e8df-e6bd-44c5-9bdc-f8e20565b1a7", "comment": "Malware payload (RemcosRAT)", "value": "2f5ce10a2a8b71a803cb4cc4de25468a503d3829e5eb3090756c6bff41f9057852734445421fff5af2e66d5bf2179791", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365877, "uuid": "91bd4588-974b-4c93-9c27-86165cdd2841", "value": "T1B005179660801768F6533B32F85750191BD5AD3C2E1067BAFA98174F072F381AEC6A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365877, "uuid": "7b06bcb7-5536-4fbd-a989-c7bff3bda5b0", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365877, "uuid": "b205dd57-ed06-470b-9f9b-87e08e2fc101", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyNKYAycjL7YiEFXXXB:Naeq3gF1Sf+WIylAyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633365877, "uuid": "db20ccc5-c07a-4e63-9068-a8e6acf908a1", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633365877, "uuid": "431a106b-949f-4fdb-99d6-c4ba924a1c00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365877, "uuid": "95202943-f80c-457b-9507-ef5dbbd8f3c1", "value": "DHL_119040 de recibo,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcda5f7f-24fc-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633342846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342846, "uuid": "7e01e150-9902-4fdb-91b8-38e44a9b5e25", "comment": "Malware payload (AgentTesla)", "value": "5a01c7705a7797c88417a818725c635c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342846, "uuid": "57c48e5a-8def-436c-a3ff-e70d588feadc", "comment": "Malware payload (AgentTesla)", "value": "ea05b076974558311ff108cb966d05542e518acd31307ee21013e65c1034ed39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342846, "uuid": "d82fde00-aa0c-4815-b019-083963e0264b", "comment": "Malware payload (AgentTesla)", "value": "b80be16c704758b33bb525c4663ae4353f3a0942", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342846, "uuid": "32de6202-e9ec-4ca0-add6-64aab24819e2", "comment": "Malware payload (AgentTesla)", "value": "43e80df5faabffd7a2b9b0563d4cec31ad030acf338d310a53017a00ddd72d1071fdf122ea7364baf22be264ddc5b5a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342846, "uuid": "a8a92258-4603-464a-a383-f927c4a8fac6", "value": "T133C49EAC725376DECC17C9B69E686C64AA207477430FD213A41715ACAE0E9EBCF501F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342846, "uuid": "c0685877-c410-44f6-9215-c0591ea38c88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342846, "uuid": "9f759936-79dc-4597-a7d9-d235d27947d5", "value": "12288:udbf8rEEYRYxR/ZL1+ovHhwZFHbDoj3D2y6CDnD/38KoF:uJ8rEqXR1+ovBsHw3Xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342846, "uuid": "9604159c-dca3-4627-91af-b8ddbdd81a81", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342846, "uuid": "f55529ad-2948-4adf-aa8b-f4851f3bc3e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342846, "uuid": "e8185c20-616c-4caa-9101-ad7d423711c7", "value": "PO 3021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c289ff-2515-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633353388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353388, "uuid": "3c1e2691-cb01-4a50-bad3-b023d385fdc0", "comment": "Malware payload (Loki)", "value": "e794524e1b45cc7ddc29fb4c45c360ae", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353388, "uuid": "e7452bda-7a16-4f89-86d7-4ea4c1c5081b", "comment": "Malware payload (Loki)", "value": "ea105dc94b4189edab2ab9b3acb7f54bc499d748b0aa5660e3e6e886996c9d75", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353388, "uuid": "df545d8b-fcc8-4dcd-b2d7-10083a1f6ac4", "comment": "Malware payload (Loki)", "value": "e5049672ced5ba2317f20387c02f040490a0adce", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353388, "uuid": "a2690c77-115c-4384-a8e8-b1f223303ed8", "comment": "Malware payload (Loki)", "value": "31138b67d6f98aaaf9cef5d9fa8d1872432bfe4ea083c73b63ccbccc1fcd3a5ecb02f96c6c89f04b0fb78ad4821284de", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353388, "uuid": "824bca31-8d78-4f1f-8682-e7d43e15c89a", "value": "T125842364ECDE1F7F904376D2A5DDBA398411C222A9142D340035CF9E9AE4EA6E97B433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353388, "uuid": "cc66f7c3-be6e-42fe-ac33-632f89b23f53", "value": "6144:nHabKEezxgf6T9aPcXZdwnE4vIcXpzQ7Y8uLblbh8uVqXEghYV+Td+t9BgJV:HabKE2W6T95ZH4NBCYRblbuuVq0g+t9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353388, "uuid": "cca95141-4918-4abc-93c8-caac84a22e88", "value": 385313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353388, "uuid": "3e313712-58c0-4dac-a7c6-b711d8a83939", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353388, "uuid": "a3f98bd7-99d7-4993-891a-e0939e099b24", "value": "Scan Document.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5019be8f-2541-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633372298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372298, "uuid": "7b5b1c98-0769-40f1-8f2b-aedb96ee7677", "comment": "Malware payload (AsyncRAT)", "value": "4bc1e15a3b8ccbed4ed88a298d737ee5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372298, "uuid": "429f16dc-4f2d-42fa-b53b-83405cb07149", "comment": "Malware payload (AsyncRAT)", "value": "ea3d22065961b55c82ad89a5003ba6904e04598bfd6987bc847b68196e333c94", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372298, "uuid": "c066e7e8-621c-47a1-80d7-334007aeb6ef", "comment": "Malware payload (AsyncRAT)", "value": "f1d9f3ba07924492ce6640d7e4de08d36e3485d4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633372298, "uuid": "a1371db8-a593-4898-897a-7749e1465f20", "comment": "Malware payload (AsyncRAT)", "value": "292adb3a3647f77d0be8324085759b7973e18bb2e3f9b32b279e7f127c64bd180599c8ab817ffd0a2e0fff338914701c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372298, "uuid": "f2582731-9051-440f-99c4-1d60a537780c", "value": "T19B335C047FE9852AF2FE4B7458BA2E138676AB533103D5C91C8419961B13FC39A437ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372298, "uuid": "3e3b2234-38fe-4ffc-8370-627e515fbb20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372298, "uuid": "1f2e3dd1-cabe-43a3-9bc3-db2f69122d1f", "value": "1536:Uui3NTdBR27R515q2r3bSCubG+QSl6qzQgfmd7x:UuidTdBR2V51U2r3FubG+oRgfmhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633372298, "uuid": "a7557da2-e780-4ece-b78b-50b1caa31d31", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633372298, "uuid": "87c40b8d-7a20-40b3-9ede-538e3996ac95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633372298, "uuid": "31e3965c-a3dc-444e-9d4f-09b35577c868", "value": "4bc1e15a3b8ccbed4ed88a298d737ee5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a27aa1-252e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633364285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364285, "uuid": "28e2c03c-c19d-43d7-ac19-a93e49950c66", "comment": "Malware payload (AgentTesla)", "value": "cf42aa19bd88626813cb2aa7c8b68b37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364285, "uuid": "0d5a32ec-459d-47fa-9ccf-c1e8d9507091", "comment": "Malware payload (AgentTesla)", "value": "ea5f61ba2282bf0b98c22c548bd57a5f8115e93611d085953cd4e04f6a825615", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364285, "uuid": "d32c383c-d8e5-4f72-9c77-973d5599727a", "comment": "Malware payload (AgentTesla)", "value": "df529898b3da01a15392c008878288a2fa4a7576", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633364285, "uuid": "aca07b54-738a-486f-9d2a-21505a8b455e", "comment": "Malware payload (AgentTesla)", "value": "1d6a1465ff1e09f09dcdeb9ca390239e2c54b13ecf986e81c01e8b6333aeecfd5204ce37eb049b155ad69cb02ea1530d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364285, "uuid": "475ec7a2-a4b3-4b1e-87ce-d5a98d38db19", "value": "T13294017923B76718DD2483F13C64E69213B57026211ECA7C5D88E8FD3E63BB44AE0997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364285, "uuid": "8fee2bdc-3f76-40a1-8847-ae302283835e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364285, "uuid": "b91dbe0a-116a-4417-b7ca-d995e3a99fcc", "value": "12288:mCmESo6fj+uePPTONJuG35GrtWsuYM6GV4XppA9+:m9ESTfjnezOGIGrUsuYMD2ZpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633364285, "uuid": "d857db6b-c272-4ee2-9faa-436c608e0560", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633364285, "uuid": "847d5f99-bc45-4c3d-915b-ed57f7c736e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633364285, "uuid": "0244ad32-d509-47ed-baa0-9021e7808e77", "value": "NKIL 6552.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46e93a1-24d0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633324041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324041, "uuid": "7ed07072-6da9-4b32-8649-8bb3a8ee2b44", "comment": "Malware payload", "value": "3ab36d146f641f1c62c82ca74df793cf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324041, "uuid": "c9aa0f67-fab5-4e54-90b3-2601fa9575b3", "comment": "Malware payload", "value": "ea7acfa125a3a3b890f201a916bfa35a9dd47509b5e60b1767582fa5f0ad76bd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324041, "uuid": "8f9399ae-47a6-48cb-8973-2b921c3a6332", "comment": "Malware payload", "value": "ce44db25a0743ef9746c1bf102b6b3c9a7a7fe94", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633324041, "uuid": "635aa0c7-de09-4fcb-bbc6-28e33e0473de", "comment": "Malware payload", "value": "cc5206152efbb69bd090a8a059b491f5baea1730fae1710e17814e5ed9649679ca27da70b9dba702d4eb040bb19b8182", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324041, "uuid": "17d0b8ad-2119-42f7-81a1-e90670a75c6f", "value": "T137B57D22B2D18537C0776A3CDD6B63A99939BE101E38484B7BE41D4C5F3A7807A2D2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324041, "uuid": "9024e527-e323-45af-a3a7-c813f9e769b7", "value": "49152:JeBcLrHmVa5UjUxrcB5SnwacG5cTPc8WbTOYLEA:4cLzmkf25SwkechTOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633324041, "uuid": "b20fe57b-f7b1-4c15-a84b-9347946a3a24", "value": 2410496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633324041, "uuid": "9f2ed8c3-3b97-4c74-ab83-26de7d4ea5b8", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633324041, "uuid": "6125c56c-a0fa-448f-b64f-cf9ed5cc9880", "value": "pxsekhfncxpuywqcxkzzkosfhaczu.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9f8cc6-24c1-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633317532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633317532, "uuid": "70ca44b6-ab0a-4332-af6a-c8ef88bfd929", "comment": "Malware payload (AveMariaRAT)", "value": "4d2aff11a57b0b0c5b23557a4d0a115d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633317532, "uuid": "0ae654d7-856f-4a23-aeee-e36e5c59c49e", "comment": "Malware payload (AveMariaRAT)", "value": "eae18a76068a44afb34840b90fd2b859468cdd28787c94e76abed52b9b21ed37", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633317532, "uuid": "41b571fd-540e-4fbf-ba96-d0e41c45f3cc", "comment": "Malware payload (AveMariaRAT)", "value": "0a50030c150d166205c46ea32d6bfc4cf8dcc2fd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633317532, "uuid": "6dc3d116-9ee8-4eba-bf66-0a00cd75993c", "comment": "Malware payload (AveMariaRAT)", "value": "51f3261faa2f618860c3a84593768bc49bc5f49d07194f73c31476bbb77e9f443f178d7ba4e3a404705b90e6902cc184", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633317532, "uuid": "9d88b7a0-214b-49e5-b4bd-56accff1de1d", "value": "T1B925F9A013C79EC4F43A6234B0112CEBA5FD6ECEE36DCE0039D639975EB6650469DB84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633317532, "uuid": "13992fed-f5c3-46eb-bea4-38967c8a0bb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633317532, "uuid": "1a451255-fbfc-4562-8105-3065acfa84f4", "value": "12288:1O4jeQ5jsruJH+ReJqvqfLRXwK4+HNONnvsylatHy2K046Mnq0UnsO5lJkKzUvoS:sHMhyUpy1xT3z1a9JljK2J+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633317532, "uuid": "f94fc214-d778-44a7-a18e-25c8de0dd319", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633317532, "uuid": "d5bab037-4c76-403a-be3e-7453f729cf46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633317532, "uuid": "eddcf10d-f1c2-41b7-a42b-b28891b00f00", "value": "C06689-L2C.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4f7b48-2539-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633368995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368995, "uuid": "35194e83-c8ab-495e-909b-07aed7cb0f26", "comment": "Malware payload (AsyncRAT)", "value": "f5bb03b26f7e1b16494a62696de11716", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368995, "uuid": "4f16736b-c661-459d-ab4b-8db2e08f43f9", "comment": "Malware payload (AsyncRAT)", "value": "ebc2753a292cfa7588154308cb1b4f4c4715fa4960a05820e155938f21fabd3e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368995, "uuid": "ed811af4-f4bc-41e0-b585-ba52f2df9121", "comment": "Malware payload (AsyncRAT)", "value": "3dcb699af42e99c5ff605c69eaf64ddac14ccc8e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368995, "uuid": "8d75b1e2-3bdd-4eb9-b682-9018de356624", "comment": "Malware payload (AsyncRAT)", "value": "fb741347bd9bdae21d45eb77ee23c0e13778c9e6c3b3f7af62eadba1d36f4b8a33ce2b4979d87fcdedf8f1a8bdaabe6a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368995, "uuid": "a8010fb2-87f6-462b-9f81-9664e331259e", "value": "T12C0583D43386B5CDF577D239F4101CEAF9B8311EE31ACA0260672A968D6C682EF2D5D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368995, "uuid": "27c6a1b3-ecc4-4243-9bf2-35073632e912", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368995, "uuid": "3314fe56-6054-4ac4-a58e-1475bf8cae4a", "value": "12288:uS8p+id36qwoNVi3046Mnq0UnsO5lJkKzUvoPUu9Y1iWIwD5PkeJ/zFhDfF4o+v0:P8pDWdfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633368995, "uuid": "2760f048-bab7-4cc7-8e5f-623e997b4029", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633368995, "uuid": "09127980-fee6-46b7-a126-804fb2879592", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368995, "uuid": "5e1cd38d-63cc-49fd-824d-cd9066bf20eb", "value": "swift0098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d8a4c9-24ff-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633343876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343876, "uuid": "6e3b4035-5ee0-43b6-ac99-387b9e351156", "comment": "Malware payload", "value": "24a2062151a8e85e520399c543e80c38", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343876, "uuid": "19263adb-5ee5-4ff1-8b83-09ce533149ae", "comment": "Malware payload", "value": "ec64908012233e1a931ee14a0b10fe8491c1fd8d6fd52e795abbd11d1a800d28", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343876, "uuid": "f48e3593-358b-4efb-ac76-de0cbab18640", "comment": "Malware payload", "value": "2661dd0ab2df41375c44ea90284dabc160ab710e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343876, "uuid": "478b54fb-3cea-43f7-95ce-b02c3323c7c3", "comment": "Malware payload", "value": "ce28737dbdb4e11131cd2122b7079aea4079591214824d6bf793a1f35ccc0f95181cd39bd00cce31dee9d67d8b232674", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343876, "uuid": "bc6b01c8-9616-4389-864c-a41254e10001", "value": "T13EA423E973734A8CEEFA02F15207D565B70406726488F78D1E1CE3DDEE946839E89B44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343876, "uuid": "64331f5a-7ba1-437b-9e6a-0f56f4d301e9", "value": "12288:JEvew3xps+vgVKZlxTSohSbc82ehfpxEuIkbW:JEvew//3xTcbc82ehfpF1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343876, "uuid": "f3fbea31-904f-43a2-bcad-73eef0c345a6", "value": 482622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343876, "uuid": "0c5bd5e0-39bb-4abf-957c-c13ec094349b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343876, "uuid": "db98e04f-6dee-408f-a8fd-7a281b832f44", "value": "Yahoo Awards Center.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce1f821-251d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633356724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356724, "uuid": "56c89290-3ba6-49ee-804e-18d04decc2ea", "comment": "Malware payload (Formbook)", "value": "95b1387dcc4d63bd61ee0d8d78c83a05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356724, "uuid": "7ad1a000-7f93-4345-816e-27b653bb20d7", "comment": "Malware payload (Formbook)", "value": "ec79bbedd58dd5c093422074221dd9dc49a95310d94655d90f68decd7f46321d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356724, "uuid": "460ba6c3-8bd2-4b38-9c53-ce7c2c15da97", "comment": "Malware payload (Formbook)", "value": "6118fb9588414fa3c77f6f52b6a28e7b2bc2ef2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633356724, "uuid": "cbbf4490-b9f1-45cd-89a4-d7461ffb3f26", "comment": "Malware payload (Formbook)", "value": "9beff7e7a56374563703414f099855f763c2255ce50bbed9ec390125c90a47b1db50ae8a0bd959201997f5bd1f90f084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356724, "uuid": "f9ce4aa3-e20a-4124-a8f6-d3f29365d809", "value": "T19CF4585F2223E37ACC2C42BF1C14DDD0C722AD15B5D8B66D6A8572AD27BF63046B3642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356724, "uuid": "c834e509-ffad-4ccb-9636-46844b2f89a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356724, "uuid": "5d000c78-e072-4e3a-9573-079aa7564ceb", "value": "12288:7ESoYEoSTvzz8f3fkd9UTVPra6+13sf8irOhRxuXC:7ESKoG0HYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633356724, "uuid": "064655e7-8ae0-486b-ad90-24a6f3845e89", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633356724, "uuid": "cb3fec41-8a6a-445d-81a3-f11e6bcc9935", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633356724, "uuid": "7dcfebdf-e22d-4527-8d4a-93b6bb5cc5e7", "value": "PO#006566.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe290dea-252b-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633363141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363141, "uuid": "4425ded9-0812-454d-bd40-d1345d8e5437", "comment": "Malware payload (ArkeiStealer)", "value": "5b6270052e7cecea41cdba60dd9aef40", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363141, "uuid": "c389f472-eb93-467c-90cb-a23f7fa57184", "comment": "Malware payload (ArkeiStealer)", "value": "ec8fd365359a2988155fa7b5fabbe0ffab258a0778cff4df8541df479bfa7c52", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363141, "uuid": "0ca3cf7a-3e07-40c8-87bf-1e301bf38a32", "comment": "Malware payload (ArkeiStealer)", "value": "b6cc4807ac01b42dbc28c002d2340ee7887be3ad", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633363141, "uuid": "377ec7f6-bd17-4e2c-97aa-6780114465d1", "comment": "Malware payload (ArkeiStealer)", "value": "25f3ca036f3bac9001e30a1bc39e10a5a6f3dced28c47935009aa17d0bc337922cf1f1973fa8d7b81e16b045710a3b20", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363141, "uuid": "4ca7e23d-28cf-4bcc-827d-3f35d78a0577", "value": "T129F4012570C0DBF2E7791531BB61C7F4493EF8A95A6A626F3B48131E5E3D2A24E2130D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363141, "uuid": "891511bf-d100-46b5-b1a1-4d67b03a7fff", "value": "00e4a9909e1dd2f9b23ab751bea778c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363141, "uuid": "7088245c-8362-4675-9ec0-875636490973", "value": "12288:KfB+3uv4jqhF/JL19W3qjGtYVViMGLSM915J+r/vOnREpD+vI3ezxp6L:KJ+3uQWz06VVVHBAo+nGFy36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633363141, "uuid": "98dbbed4-1445-4814-8106-282165b1ac26", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633363141, "uuid": "41b59516-78ed-4704-9149-5aa3fe428a7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633363141, "uuid": "7f06a621-8cb3-4acf-921a-f66132b378c1", "value": "5b6270052e7cecea41cdba60dd9aef40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6deeb1b1-24eb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633335412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335412, "uuid": "2071f44d-d3fb-4b33-8c12-9f171bf83731", "comment": "Malware payload (AgentTesla)", "value": "9afb9830e80c3cc85bc5f89ea4118444", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335412, "uuid": "9d1143f6-713f-47fa-8364-797b96d78ea6", "comment": "Malware payload (AgentTesla)", "value": "ede3beb6eb831c6ff01cf267177ff8e71ca81b432175dc4d868af9e6172fb1ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335412, "uuid": "30693994-aee3-43ec-abe3-19aeddbd252f", "comment": "Malware payload (AgentTesla)", "value": "21f46e3a99eee9039921b3d602c36fd7146189c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335412, "uuid": "5f402fe3-6156-41f8-a42e-297391fc808b", "comment": "Malware payload (AgentTesla)", "value": "12377a9186484b6f3318bb1fa1ef0a173360958b287a42b6b723e27c543730d4b7f2eb3fe5bbcaacc079ad10cb70e86e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335412, "uuid": "09b5ebd3-0f4d-4a3e-99c1-c9b9d74b63d1", "value": "T1EC94016823A79344CD7983F53824D6921B7A6436245CC7386FD8A4FC3EB3BB44AE0193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335412, "uuid": "a3a75f68-8e94-4700-8d87-728bbc5ab94d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335412, "uuid": "e8d1a90c-70df-403c-b5f3-1b7a2f4210ac", "value": "12288:4ESo60y0AnBVqYd9tZCR85BxUfdZIRy/Y5qH:4ESv0yLHxB4RaOnIgYsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335412, "uuid": "929286de-2f06-482f-895d-6112aa4c9ac0", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335412, "uuid": "eb254fb1-6fc6-478c-b478-274c34a3b3f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335412, "uuid": "398f030c-34a5-44ea-b76b-842209ffa505", "value": "RFQ_99705546,99805546_Mark Cansick & Company.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3da955-24ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633309396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309396, "uuid": "76f45fd3-d8b7-482d-ae3d-1b8756be2f63", "comment": "Malware payload (Gafgyt)", "value": "43056cd1acb229e7c60916c64780fa98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309396, "uuid": "1409ee3c-8f89-4ddc-a5d6-71db4b9026aa", "comment": "Malware payload (Gafgyt)", "value": "ee2590edcf40f8e4c58130bc085914a97c3a89b28f247ff2d230be4a9553dd88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309396, "uuid": "b3e9847d-03e5-4a38-81cc-009b7a4363d1", "comment": "Malware payload (Gafgyt)", "value": "abab916a5da65041a01030ecb4738c7285ad3b60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633309396, "uuid": "5b102fa3-712d-4ef8-88ec-e104520b70e5", "comment": "Malware payload (Gafgyt)", "value": "27f557b08e262d1ce2ecdfc7cfc57288b0b1426019f17bd154676d7255ac6878d6cea052ea909350e96a56224d20b2cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309396, "uuid": "c1928b4c-fe07-404c-bad1-ebbdde3df0dd", "value": "T1A8A3F831A641CA73D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309396, "uuid": "5e01ed27-cb7b-4a05-b6ec-fda1e51dfc2c", "value": "3072:VK1z13U6ehHoXRtmTUhQovFvmmFVcqq0GP7ZT:VK7CxeKlovFvmmFVcqq0GP7ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633309396, "uuid": "651f3064-ee52-4517-bc44-12d49b2b50be", "value": 100041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633309396, "uuid": "17ab8744-b8c1-4f94-8d09-a670cbeaab30", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633309396, "uuid": "b849a3a6-3806-4edb-85e5-377f49f378ce", "value": "43056cd1acb229e7c60916c64780fa98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5c6ed6-24f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633341449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341449, "uuid": "239f9004-5e9c-483e-8efb-afd248af5891", "comment": "Malware payload (Formbook)", "value": "0ffff4a3b0d01a41806af134c8c3c4a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341449, "uuid": "4edbdca2-6748-4138-a242-cd7a41e457ba", "comment": "Malware payload (Formbook)", "value": "ee3de0972b839ce801d88ed0ce2946aa8900d0f11e497bb703f17d59596a1ec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341449, "uuid": "5918d353-1778-4f7a-a0de-e2b69fbfbf6c", "comment": "Malware payload (Formbook)", "value": "9732d27330679bdb49be84908010e42e5447c224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341449, "uuid": "5edce89e-5edb-47a4-b02c-c3166b4c8feb", "comment": "Malware payload (Formbook)", "value": "0c591c282ca1aa36d1eb1d526e867c680429fbc50d9029cc96077c78aa99be8b4217df727e208efdd6ab7ac4604469dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341449, "uuid": "f04938e0-2e6c-4ce0-a077-fab0ad496046", "value": "T17844AE21E201C030F25245B1B559CB7A87FBCC3C6660D397AFE13AA56FB0695B1293DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341449, "uuid": "2a65b7b7-70f8-48fa-a5cb-2defbadbb00f", "value": "034798d5891f6a110ab94befc4c55274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341449, "uuid": "975b7de7-6f42-4ecf-b489-58a50c25ab4d", "value": "3072:jSfuePNgafhTuMJUn2hjuoClIxZ009CxykFSc05qOk0J2nvb8jrrJecYAWGPABij:mHNgEh/JuoMQF9CxX/tO7JS4PIcJCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341449, "uuid": "3b4f9548-8a9a-423c-81d9-a74b58af3c23", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341449, "uuid": "d614d617-ebda-42d2-9a3f-f7621f5d1cc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341449, "uuid": "17ed739a-7d79-444e-96d9-54ae08133a89", "value": "New Order PO200305-01.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d365f53-2513-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1633352644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352644, "uuid": "9a0de811-3718-4c1b-b018-432254ebb883", "comment": "Malware payload (CobaltStrike)", "value": "2533b09300b21583d86192548e8282da", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352644, "uuid": "ad488ea0-2c02-45b0-8369-294f5f9e0c30", "comment": "Malware payload (CobaltStrike)", "value": "ee7932f9d6ace3828b43c63e727497e014931c1c2cb3c21f90065e4098e9e4c1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352644, "uuid": "94a3ee0a-4c41-4d9b-bfae-2a8d2cac27d6", "comment": "Malware payload (CobaltStrike)", "value": "efb3112994506cafd748154479bb11b502c84a9f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633352644, "uuid": "781b281e-315a-4a18-ac28-9c7b2d94624b", "comment": "Malware payload (CobaltStrike)", "value": "486b2870c9e253ea10fe138eae63592ef78604acb2b747626329755dc60bbc1799d055a0d63847369abcb17eab75317b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352644, "uuid": "3cc36a7f-cfc5-4f1d-bbf4-344a75a2a8d0", "value": "T19324DF7BA948DBBDF41A8E7654FB98AF3D521C838E6E45D38C62AFD1D6C0365CB11008", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352644, "uuid": "01b2a2f2-5be9-4127-85ba-6f74b8b7dfbf", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352644, "uuid": "0ac05315-63fc-40db-a7dc-04a415e87b92", "value": "3072:VPdi+x1PzNtFAQaHrWsjiwz8yHAK5cngVYN/o35PPpwy/+0hcn0GcPJOKAYZYSI/:9dJVtFAHrui9HAznUYupPPaWXxOy63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633352644, "uuid": "51b2aac2-61e7-476f-8c42-e73471e07235", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633352644, "uuid": "5393f026-fe7f-40df-948b-3e95f1453fd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633352644, "uuid": "071b6261-da02-453c-b99c-5fcd47385838", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cec0dd-24fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633342052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342052, "uuid": "59ca7c8a-ad2d-474f-a5c2-12b0b8f0d18b", "comment": "Malware payload (Mirai)", "value": "3fd98abad6c70432232571c5109ea64f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342052, "uuid": "3b090ae2-580e-442a-8e44-42231c37dd4b", "comment": "Malware payload (Mirai)", "value": "eed11e40a93a53d9c0f857f4b8bfeacbafad4d28f07abe7012238f145c4b2aa0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342052, "uuid": "2ff8358b-7fef-4bb7-aa24-04a7144d3864", "comment": "Malware payload (Mirai)", "value": "081ee829f29794ec9a3fd485bd0cd031905666ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633342052, "uuid": "196607c9-85d8-40ed-a7d5-fc66c1dbbd52", "comment": "Malware payload (Mirai)", "value": "c1d636482ddf60c13d25f18aa7f4163d1a0b2071a4db411a80672cdbe069f0ead6efcb490e5cb397738eb743cb1e105c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342052, "uuid": "60806af9-382a-4448-9317-367256fd2361", "value": "T16EF2E0BD71154EF2E4459DF92AEE9F90793D0AEAA42B9C834A09F8F34D006A0D8034D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342052, "uuid": "23879be3-b2ff-4402-ac60-5c46d5b48433", "value": "768:+ML0U51CY9SzFLNIYnNoZFyiR78Xzuc99xkT17/q8FmGPAzQeyWTdJgGlzDpUYs4:+iTLD96JNIz0S8XzbOh7/q8wDAWT3Vqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633342052, "uuid": "77f6ddb3-b9d4-4c1d-95a2-1e88bba7493d", "value": 36384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633342052, "uuid": "5f63f487-3e01-4170-897d-966ee78b618f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633342052, "uuid": "e8f44357-a676-4246-b48b-b48f3d5eb489", "value": "3fd98abad6c70432232571c5109ea64f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0755c9a-250f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633351039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351039, "uuid": "743946ea-4c7a-4667-b6d6-0f33e0fd2e44", "comment": "Malware payload (AgentTesla)", "value": "b0fdc1d5d662600356931895750433e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351039, "uuid": "3f72e1a1-b8b2-4739-8734-0451ede32e65", "comment": "Malware payload (AgentTesla)", "value": "ef0e7b943e7baf777538a3b2b83c30ed0e4f8282a014a9d6a73aac1e4b08d2b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351039, "uuid": "faa9647c-c6bf-411a-9150-e07622c6445c", "comment": "Malware payload (AgentTesla)", "value": "7caacb3ea5931b8b48f78ebea88ff04257b1ee95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351039, "uuid": "34405147-ede4-4f70-845d-3c032b70b6a9", "comment": "Malware payload (AgentTesla)", "value": "b206386b7633ff4dd8f59bcfeabba24ee7d58255791e5b8ccffedc91101fce555c486b497ff650f571b631e1a211fbfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351039, "uuid": "489b39db-e279-44ea-bd09-a7daa3484f40", "value": "T15F6412D3B4D15ABBC12241786727BFB9F73E844915304A8F2BF01E77287219E152B6B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351039, "uuid": "74701c1d-2f91-49aa-9d82-eff6d833f521", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351039, "uuid": "9377297b-1fa4-48a0-a115-43e580893c44", "value": "6144:F8LxBsQD6P34xvCGg0f0XVKwn+P8r5g6BKGsUz6vPJa0eaNgYqUsy6Y7qQoOn:/QJxvPg0sXU8r5g6YGCIR7y6GqXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633351039, "uuid": "597d1570-7d11-4797-80b9-7d15696f5b2a", "value": 311028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633351039, "uuid": "b96c6557-8311-4616-9a57-24142f2f181b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351039, "uuid": "ff9ebefe-7377-45de-b851-fa9d236a6412", "value": "b0fdc1d5d662600356931895750433e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ca7133-252b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633362777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362777, "uuid": "34b20ee7-0cc8-4db5-baee-42297c27a6c8", "comment": "Malware payload (AgentTesla)", "value": "12274ca5d8ef8c03e9622b88c95c1ad9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362777, "uuid": "d3fbcb4b-222f-4fba-92bd-9545d3345026", "comment": "Malware payload (AgentTesla)", "value": "ef353cfad51b3beba940f414763905bc6c3355397b8e4f3e8f3a88ab19da0f64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362777, "uuid": "d5ced17c-3263-49bd-8451-40d34f21b2a0", "comment": "Malware payload (AgentTesla)", "value": "8449af9fd0afc4c6e5b25ff3ff03c7217ce08163", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633362777, "uuid": "7f7c4350-e291-4385-8b6c-7512995bf762", "comment": "Malware payload (AgentTesla)", "value": "f0b1ba896cb259e3a1667fd8bc8ec5a5094223041a035fa399e3ef6f0b4187c97da93ce6ede1d465486726324cccfe7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362777, "uuid": "43a08eff-2f34-4851-b13a-59acbda1eda1", "value": "T181F4CF64BB43D517CE754BF028ADA2405739AF211648C32E3889BBBD1D73B742A4C9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362777, "uuid": "ae428380-a1c6-43e7-b00c-edd53fd12fea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362777, "uuid": "98c9d7b1-12f8-410a-8536-d12698cd8242", "value": "6144:meLbWRQ+3HwOExx/55tpIYyuthEK0sRTpbaVR2OUMEh9lh3INJFBGbZ7TAkh80AN:FLo2Gq3D04MR2JM22JFBGF7cNN/zoYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633362777, "uuid": "d1606696-262e-4ef7-a1b1-3ec25c196b0f", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633362777, "uuid": "1cd79f0e-7489-49d0-8af3-4d9675046dc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633362777, "uuid": "899d74df-5dec-4b79-b4d1-ffe185579582", "value": "Pedido PCS104004 PDG0153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8013f12d-24ec-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633335872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335872, "uuid": "aa06c2ef-371e-4d52-8ed5-d6a6753735d4", "comment": "Malware payload (RedLineStealer)", "value": "82ad6d4689e3490835817606958cf5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335872, "uuid": "de168563-cba4-45c6-9ca4-fcdafbb4927a", "comment": "Malware payload (RedLineStealer)", "value": "f1e9550490c3ff70c5a36623d87419084d07fe0d8f6590cc411aa15d5c9d769b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335872, "uuid": "d29efa5f-0985-4cac-a075-26dba652e241", "comment": "Malware payload (RedLineStealer)", "value": "95040b9910f5d2a54323e1d88cfbff152b22f87d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335872, "uuid": "16e1c624-0298-4993-93dc-8b8a5030b310", "comment": "Malware payload (RedLineStealer)", "value": "17d76163a8a220f32dad7cfbeba2b88f7c4dc614b5a9917f11ea7845655162d827dba072232c9d281cadcbb507e90856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335872, "uuid": "0f1cb28a-23c6-4428-91be-596b74641db0", "value": "T121B4DF9C7650B5DFC82BC9368EA52C64EA2074BB570BD243A42316ACED4E5DBCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335872, "uuid": "27f90436-6122-4785-8703-2a594e819c5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335872, "uuid": "d32f67a2-fd2d-4f9e-967a-b968e3f321ee", "value": "12288:P1clJL7+GuvYWnePtWZ80dLAtlr4BP6ahH5ehx3q/lgt:P1cfNuvz805g4P6Aoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335872, "uuid": "0b6e8cb2-b59b-4f96-8ae9-d580a2119674", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335872, "uuid": "a9d89e7b-e486-479d-924f-37c639cc21bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335872, "uuid": "4cc877cd-eb0b-413d-8265-8f5d3060bde2", "value": "Quotation_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fa1bbc-24f2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633338625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338625, "uuid": "36dc9561-6c85-4d05-8b4d-8712b96be54a", "comment": "Malware payload (AgentTesla)", "value": "ed2cb7b64281d2def1ce2b0cb8c1c968", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338625, "uuid": "d8981f44-e7b4-4839-b549-f9b85da752a8", "comment": "Malware payload (AgentTesla)", "value": "f2615e71b31631261c0b7363c84582a0d3c01d9f68892708940f8574a061d4af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338625, "uuid": "8d6333a0-07d7-49e1-b8ba-271893203639", "comment": "Malware payload (AgentTesla)", "value": "c9cf421e018bf9101bf6c02fc5d7d1923a48ab42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633338625, "uuid": "33ce04f0-531d-4c45-a5cf-82d94eb565aa", "comment": "Malware payload (AgentTesla)", "value": "9108fee14edcee9981b8419cc4f3a462f44dbfe56687b214ad176261fa3d23d7370a871096b201e6a4312b568c78a70f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338625, "uuid": "0e5e3eca-cd05-4ace-a728-33c3e3bdb23c", "value": "T10E712AFF2ACC1D85E69898F3CC113D9511E7B15749EE0BE9388DF8A24F1F0092D22901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338625, "uuid": "5b1b76d5-80e4-456e-bf1a-da279828258d", "value": "96:cECpJC0sohcc8Oi6LxUJysW4wfaoGTo4VuVJtnTo2Czu5L8:XCs7c8qLKUJ4caEt0dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633338625, "uuid": "b030032d-eb96-495a-8fa8-6c5ecb99e958", "value": 3769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633338625, "uuid": "bd2493c6-7c40-4a2d-83c5-c71a7dcd2dc1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633338625, "uuid": "e0bd86c0-d9c6-428e-9655-39f41dc383e3", "value": "Inquiring.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7db0ced-24ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633308531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308531, "uuid": "ceb9c3e9-e056-49f2-af9e-028b563c3a49", "comment": "Malware payload (Smoke Loader)", "value": "85932af248f49cff1034094aa06f01b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308531, "uuid": "29ade89a-79f8-43af-821e-4b4894d2a3fa", "comment": "Malware payload (Smoke Loader)", "value": "f2edf69ca64bb435d61ded2c3ca210d1bd19952c19275b7bd65d0d707fedadaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308531, "uuid": "811eb30f-3ca1-47ec-b091-c7f40cf48d0b", "comment": "Malware payload (Smoke Loader)", "value": "cec5565d276c35642d212048c1a6369230a299a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633308531, "uuid": "54a8b309-2e0e-4b33-8270-6d77d54373bd", "comment": "Malware payload (Smoke Loader)", "value": "b5c23cf4da6ba15466d49f7f22ab24660faf769012a2958ed74201a06f9f2ebd5e443616a7ee88008e9b1ee2f2ba15d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308531, "uuid": "909b84e6-0e77-4b16-86ed-2686b670ab9e", "value": "T19A44AE483180DBF2D27E017CAB26CBF0092DFC6D5D6A564F67A9271E2E3D3D2961124E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308531, "uuid": "b7e42a31-1f84-4b27-8e12-96f7ba4471fc", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308531, "uuid": "5b457626-28bd-46ba-98df-00fee4b12536", "value": "6144:O7J84fLg5mu5a91mT+a8tnwJxROhxxpeTr/ekI:cJdimu5auT+XVwozxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633308531, "uuid": "049338b6-1b34-4b72-b0b9-a3a2b8966518", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633308531, "uuid": "302f73f3-a862-4f24-b519-32efb2c0376f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633308531, "uuid": "ccf24ad5-7ddf-45fb-bc82-27d1b21b1311", "value": "SecuriteInfo.com.Variant.Fragtor.28226.24516.25851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dee7642-2527-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633361235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361235, "uuid": "907d7e3a-d840-4ef4-8ff0-248d0a0e9e71", "comment": "Malware payload (Formbook)", "value": "1b68afffad286bd909572d959b9a2e5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361235, "uuid": "25e12e47-13b1-44e8-b3c0-050493670b0f", "comment": "Malware payload (Formbook)", "value": "f36144c1f50d385009541352868b0544feac1f1c138c848baa1512165d7bbe1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361235, "uuid": "e1372f69-fd06-4898-83ac-e7ecc8391739", "comment": "Malware payload (Formbook)", "value": "cff5c6c37f14d1a512268d63a46d1c13b96dbeb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633361235, "uuid": "dd6b8b05-b290-43dd-ae33-04a9e819925e", "comment": "Malware payload (Formbook)", "value": "622fdd6d8d4410a8cce3f79712b1bca2afd77167ea50fc7931a18f85edc681294d4b8c21966729396ff7ab639e858fc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361235, "uuid": "f505521e-9c43-4596-9739-811369f1ae44", "value": "T185055C1223C86B55E03EE37AA2342145DFF2E597D325CA4A7C9E02EB4F71F815A53B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361235, "uuid": "888523ee-79ac-4f26-b15a-5a397974f793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361235, "uuid": "cbda7204-8e78-424b-a023-1a8e90fb6898", "value": "12288:DQyRQ6+vcAblCVl0G3DJUs3DJU9F3DJUnnLBB6HpgxXxK1ZtlOD3DJcyrat:M3KvzJ9zJqzJm36JgbegLDJgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633361235, "uuid": "bc8c7aed-e775-4f9a-8eb5-eeca6f959d8d", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633361235, "uuid": "56c838fb-e263-421b-a9b7-884ae607be71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633361235, "uuid": "85454ce1-4ddb-4f5d-b9dd-be87c807b38f", "value": "1b68afffad286bd909572d959b9a2e5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d40baf7-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633347759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347759, "uuid": "13f6b6c1-5b30-4d49-bcd7-bb83944075b6", "comment": "Malware payload (AgentTesla)", "value": "e6abae726fe1c201ac4ff243ebba5e82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347759, "uuid": "c11c2685-b229-4f5c-ad1f-e486cd04ae08", "comment": "Malware payload (AgentTesla)", "value": "f3ea50efcd18af6f89a15f83213bd535965ab73d47806d3869a6a91d4ad2f4ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347759, "uuid": "f8c872a7-16cd-4da8-a5b1-c6397efaabb0", "comment": "Malware payload (AgentTesla)", "value": "80f597cbabfc6c820c80547b949ac3d2cbc31c8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347759, "uuid": "237028aa-2fcb-4f08-a285-53c5fff21992", "comment": "Malware payload (AgentTesla)", "value": "919373f0641fbe2eff3f8dedc296ab1c098689b26aa5ba9e3ab4baabff73156349078447cdb6407f5bd59088390f5029", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347759, "uuid": "42accda5-7d37-47db-a443-9663670d2050", "value": "T1FA84232A85C30DDB69C1343345D59B48C75E87A08C8A91B7B2EFE96DC81E2CD27ED50E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347759, "uuid": "a1d3cfca-9210-438b-a1b9-122808693db8", "value": "12288:vq6+SStkMHhMaayKyRcpxfUBnZzT8sG7wzmH:vquSt/BM7WcpxMd8T7wiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347759, "uuid": "f2a5b25d-fc35-4032-b88d-e57706bf3d5e", "value": 396348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347759, "uuid": "51cd431e-6298-440e-b092-906dfe9824b0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347759, "uuid": "56f359af-9708-4cd4-82f3-819db14b7562", "value": "sale order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0360084e-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633360573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360573, "uuid": "1be868d0-73ff-4478-be89-1fa253cce9e2", "comment": "Malware payload (RaccoonStealer)", "value": "39334f7bcc79560e4cba9026fcae6151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360573, "uuid": "a9b68fc3-6c73-4c68-97bf-6221ec9580a5", "comment": "Malware payload (RaccoonStealer)", "value": "f45b444b6e8d66dc8d97e8ec397a4ffbf1545bef57d783ec906d2c7695b25ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360573, "uuid": "2dc196a4-d285-4a8a-8345-8abebfbfd82c", "comment": "Malware payload (RaccoonStealer)", "value": "eb95a578bb947f52bdf0b779b90f605c5a3277d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360573, "uuid": "ccc75206-a0dd-4731-8f27-74ff839751a2", "comment": "Malware payload (RaccoonStealer)", "value": "00470f964624d963312da403b78e76415d0a65eabb322f459b3f12699e862f7819ca1b48cd47389dbc0b8d2ae64f288d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360573, "uuid": "a0ef7399-8042-4341-a4f1-ce05a32a5b82", "value": "T154C4F18875B1D7F2E6B306B0B766D7F0096DBC6C5C2A5A8B3795271E2E3C3928721305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360573, "uuid": "13dec4a8-8eb7-44c3-89bb-51dbeb0a3c33", "value": "00e4a9909e1dd2f9b23ab751bea778c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360573, "uuid": "4a6bbe8b-f6f3-430b-a1be-d7f03040026a", "value": "12288:HMkq6+XFjS7Yejblh8OeKxsXhWigSUTS6xzxp6L:HLGVeMejb7FsRGRu636L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360573, "uuid": "f90cf1d6-2691-4985-91ac-8a4787219565", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360573, "uuid": "5cd4f108-7a06-4b57-ade1-ffc41480752a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360573, "uuid": "2206a35d-d332-42af-91ec-102cbe4b6e04", "value": "39334f7bcc79560e4cba9026fcae6151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45dbfd8-2532-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633365997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365997, "uuid": "b8e8b6a1-9ab9-4600-b76c-bc43d0a96c02", "comment": "Malware payload (RedLineStealer)", "value": "2269e9421374a2d98c7f69153a5ca647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365997, "uuid": "39eaaefa-73d1-4997-863e-4040bacdd588", "comment": "Malware payload (RedLineStealer)", "value": "f59e70c1e2703fd8d6016bad2f6b4ebd7824b52eab2bf63a0fdc96f0a3d16011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365997, "uuid": "03919146-c58c-4f4f-8bd4-700fc16be067", "comment": "Malware payload (RedLineStealer)", "value": "18a8bf91b7b121b617921ab3e8acf79599a353a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633365997, "uuid": "e0824ac3-72ab-4d63-bb18-ac1dd67ef23e", "comment": "Malware payload (RedLineStealer)", "value": "a67450d765ec5295a332f69689b9e5d2dcb126bfeb48e7a89a79e70121ddd96f474677b217c61d606a247cae34057f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365997, "uuid": "bfe26d26-6fa4-4874-afd4-0831eccc9714", "value": "T10984D0057190DBF2F6720531AB26C7E44A2EBC6D5D65928F37A8375EAE393C19232703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365997, "uuid": "6045fc5c-065d-4b2d-a207-eb015f434923", "value": "820638e32882fc55584544cedf889893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365997, "uuid": "c87f17db-81b1-474e-94d8-37b0a099687b", "value": "6144:mV9qgzGpmE2fOz417Fdix5i2jsKcpq7nCwvROhxxpeTr/ekIw:aqgzGwE2fOz4Ux5i2jsKx7Cw0zxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633365997, "uuid": "e1a80827-cb21-4900-9ed2-b1a46ab6898a", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633365997, "uuid": "b2c8edd4-e494-465d-91f5-5b1483113455", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633365997, "uuid": "adcfef73-a7da-41bf-bbbf-76c167d78238", "value": "2269e9421374a2d98c7f69153a5ca647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cb30c7-24ff-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633343956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343956, "uuid": "802b3fff-e8b4-41ed-87cf-2bbb90635f44", "comment": "Malware payload (Formbook)", "value": "c0be9e2c8ad076b340f2daafb1412265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343956, "uuid": "a2fc3864-5710-41c9-abdd-e80d2bbd1e94", "comment": "Malware payload (Formbook)", "value": "f5db176e54d46bec4fe01e52b8f5798b154ce202f47c0cbefe111b569544a707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343956, "uuid": "2db91be9-8d58-47cd-bae9-162b9274bd18", "comment": "Malware payload (Formbook)", "value": "6a0abfe6c73a44255b0aff6575459c04aa3a9aaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343956, "uuid": "0f736837-5bab-4a0e-a63d-851bb8960a87", "comment": "Malware payload (Formbook)", "value": "cc34d33dd1210dcf534bcda7946982e149462b4f0d7f99e6c8acbc49dfd59ff5520e088f1c37ad2364a4e9a5b1b536d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343956, "uuid": "38494846-974b-4b21-9107-59f0424cd60c", "value": "T15D737D82F684E672C83C4636D45781821761BD6A9AD16FDF31CCF33A1893145C76AF3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343956, "uuid": "1a473779-1d72-4ad9-a08c-d267f9999841", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343956, "uuid": "44662673-ecfd-4cfd-9ea0-b6cb7b530ed0", "value": "1536:Eb5u5fejAeXpmFM0pJAvckOXw72AtY4fAci:mcfpesFM02BY4fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343956, "uuid": "f0dc130f-d3a8-4003-b4d3-0d04a34c5c19", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343956, "uuid": "0428d118-5b40-4945-9dc9-0064baa62860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343956, "uuid": "1c9afcca-4e7d-4cfd-b02f-e72a507e8113", "value": "Angebotsanfrage 86548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524bc5aa-2508-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1633347821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347821, "uuid": "3caf9619-4aea-4a93-bdb9-59f4a2e760fc", "comment": "Malware payload (XpertRAT)", "value": "f11edd8f122829ab3b3a69397e345250", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347821, "uuid": "7ac09c35-760d-4c0d-8e97-61fe95f59eec", "comment": "Malware payload (XpertRAT)", "value": "f5fab1f13cc0df6b37eb6a308adbfac7dc8e3d376a85a744fbf3fe8c1419ece0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347821, "uuid": "43ed662e-867a-455f-aad7-888cdb0affa0", "comment": "Malware payload (XpertRAT)", "value": "31c9d13f4554240fe2eb6bd9c9042862e5a5920a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633347821, "uuid": "c39b46a0-c0dc-43db-9575-b3694a0d0222", "comment": "Malware payload (XpertRAT)", "value": "9f20671d4864956eecd4ad705c66012dc0c0e13073280cdf72c35051e6a3e1d77d7db4d994844db9c6b951cec9919ce0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347821, "uuid": "807641b0-3999-4180-9e50-928b8467dad8", "value": "T16464E5E8255F86BDEB08DD0CE9953046ADB2FBA630C44E20535D8460CF5DEF7DE88692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347821, "uuid": "6abb6df0-1a83-4554-b36f-bbc586ad9b02", "value": "1536:iK3bWhTBE24hASexo9kS59U7xlvVTLywdzFz76mAg5eeVhMDw5wfL7:iNCYdzFtr5RDAw5wf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633347821, "uuid": "4ca526ad-5e7a-4087-8041-9b6be1fe68bc", "value": 314664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633347821, "uuid": "e56883a7-4164-4da9-9b87-88353a8c14e3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633347821, "uuid": "b5b57779-6dd8-4b8c-8f92-af1b8160a912", "value": "RF Quotation_04102021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dec213-2543-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633373038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373038, "uuid": "6ccfd846-52f6-415b-9266-612cabb556b5", "comment": "Malware payload (Loki)", "value": "9a56a65a7b5c51d2aa7af350fcb3d342", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373038, "uuid": "95238c7f-44c6-487a-8a2c-f875eb9d0b7f", "comment": "Malware payload (Loki)", "value": "f5fd07b67dba0e8c5ee1735b621e0ac297c1bac222beeeda262bff2be9961024", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373038, "uuid": "29470770-376a-434f-bcd5-f5b2fc4fd73e", "comment": "Malware payload (Loki)", "value": "1f8df1cc3959aaf01514e3858a98fcc991c641e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633373038, "uuid": "645b43cf-0b34-4f73-9567-221ee6876472", "comment": "Malware payload (Loki)", "value": "4a16f2a67d2eff7a5d4971a92ba2c7b64cd3658fac5320a9b1e98641b9b4ec82f1dd83f0c2bfb49c4f156138d41ca361", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373038, "uuid": "a4e8378a-fc4a-4c33-9886-e8ecd309e2ea", "value": "T1F7A32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373038, "uuid": "aece1d5e-98f7-4555-bcd3-e4a01e71fb3c", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373038, "uuid": "140a7c12-44d3-46e1-b560-174270946537", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633373038, "uuid": "88173479-3b01-46b5-9668-680dec7b4a87", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633373038, "uuid": "34e64dec-7493-4fdf-9644-885be7c15ca1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633373038, "uuid": "6efd2d01-70ad-4013-a65d-1a943012a5ce", "value": "9a56a65a7b5c51d2aa7af350fcb3d342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b41109b-2522-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633359030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359030, "uuid": "6f3d06b7-db13-4017-b70c-701de58a3ba9", "comment": "Malware payload (Formbook)", "value": "d531c1611fff29efcbc94d6ae2720a0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359030, "uuid": "fe0bdf4a-b966-45a0-b4f8-9cc000456613", "comment": "Malware payload (Formbook)", "value": "f6586429253fa9d4f796399044b55740cf50d812fff96e796febb1ef685ad709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359030, "uuid": "e4ed752b-200c-47f3-a2aa-af6779f5e7b2", "comment": "Malware payload (Formbook)", "value": "d55d016de9913d7059d44f401e3a07e4c9a1f64e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633359030, "uuid": "81bbf2d8-1405-49de-b8ea-2208f273f5cc", "comment": "Malware payload (Formbook)", "value": "a27f31706f29f3ad4d45770e7aa3920c140f0decb59c57130dfba2e3d2350a0e3846bc7d56a9f8625e4b8a2d8c499fa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359030, "uuid": "656181af-a338-4145-86d1-b691ddd4b30a", "value": "T19A055C1222C86B55F03E937AA6386145DFF1F597D311CA8A7CAE02EB4F71F825A13B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359030, "uuid": "afc98ed7-3c02-4c89-9494-2f0e921d1223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359030, "uuid": "b7ca0520-120f-4bc4-9f92-f7a53a1e6d8a", "value": "12288:AaUXsq4eulCVl0G3DJUs3DJU9F3DJUENqx/xJqfT9ZFfU7i9d5g2F:NKvzJ9zJqzJPQ+7lUO9d5g2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633359030, "uuid": "9cb59686-3e83-46f4-9f00-928c207cc06b", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633359030, "uuid": "16bfefe8-9098-4536-9b76-5f74b4f778d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633359030, "uuid": "2db7ec0b-349f-4b3d-b1b2-bf52bc0c4b1d", "value": "d531c1611fff29efcbc94d6ae2720a0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f9aa7b-24a8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633306679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633306679, "uuid": "ce19c2ae-177e-4595-9035-fe38bd16bb24", "comment": "Malware payload (RedLineStealer)", "value": "17fe15c3f5f28d07fa885bf7099163ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633306679, "uuid": "69874526-1563-4508-88df-1eb3777344f7", "comment": "Malware payload (RedLineStealer)", "value": "f71af69d5802a003452e0401c936c344911f215d6d8a9f34359b9d1cdc758542", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633306679, "uuid": "92b88e44-0731-43bd-975e-78fb6acee426", "comment": "Malware payload (RedLineStealer)", "value": "8a53ce1263a67503522090c7ba1572491590f254", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633306679, "uuid": "3b15ab23-2708-444a-bc2f-4a4b2afc0a55", "comment": "Malware payload (RedLineStealer)", "value": "ae57c960996bae19fa894581f43d3edcd252bbe17c466a8ca7ab7aca0424b46d075ec8479fbb3a44480356d2b5f61261", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633306679, "uuid": "78b34b55-d362-46bd-9705-e0a09d5eb3c6", "value": "T1EB15126235E1C032EC3358709DA5A762FF75BD31AAB11A87BF814B1E2F71561C21AB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633306679, "uuid": "c40d463a-919d-4920-a042-50769ed9e50f", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633306679, "uuid": "72c70309-a304-40da-8fbb-87a295736799", "value": "24576:t20gPgFK2MQxAVBbIcXQzkUWSQshQwxB7yCE:EKpxAjIEsrhxBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633306679, "uuid": "264a7f80-0e88-44de-8753-f589bb686a09", "value": 923069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633306679, "uuid": "1b2f635c-4930-4b92-97e4-23e9eb81b9a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633306679, "uuid": "c95236dc-1874-471b-a1c9-d8030804ff05", "value": "17fe15c3f5f28d07fa885bf7099163ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ecaa04-2510-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633351479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351479, "uuid": "278726f4-49a9-4328-8730-8b4cc7fb88a5", "comment": "Malware payload (AgentTesla)", "value": "54c1a76ade1bb5415c97a6c3d6857731", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351479, "uuid": "a7f09a9e-f94b-4d54-acfe-f326885ef150", "comment": "Malware payload (AgentTesla)", "value": "f74641b6679a070fdc646ba59e70ceca780fac09cd4b9188c97f16218d65b8f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351479, "uuid": "0967afc3-17bc-4499-ad52-4944ad18952f", "comment": "Malware payload (AgentTesla)", "value": "c71bd373c79ab4aa0ab7da36f7153eaf3833a55e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633351479, "uuid": "b84f170c-d5a3-4793-ba3a-22edfec544f1", "comment": "Malware payload (AgentTesla)", "value": "3f830eddd19cb75b941f524259960bf13b88562b8f414a3f94e631191216b2925df1d3d834925e2b1b3ba2b2bceb06b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351479, "uuid": "9a6ad174-eab1-4484-b0ee-ef0c53746149", "value": "T1C5642322E2D3EDFBC6675430D5A7ADB6F2BB94584701C84783B15E7373A148B320A6B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351479, "uuid": "d0c03b2b-765e-41e8-848b-bdde61df48cb", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351479, "uuid": "4cc00909-de5f-486c-9b95-c45541b5fb7b", "value": "6144:F8LxBs0nBcQxb/xiGfE8x3RnZBUsx5BLWlID+sAqFbc6m3sJnC:/WBcwb/xlfEKlZHVL3+sAqbTCoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633351479, "uuid": "adc39b01-333e-45fd-be10-debd14840d10", "value": 311249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633351479, "uuid": "8b320b9a-6b19-4fa1-9fd8-cdd76561b362", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633351479, "uuid": "f95d7ca9-8646-4148-9a65-6c0f0110c4ea", "value": "54c1a76ade1bb5415c97a6c3d6857731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b75a1bc-24f9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633341394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341394, "uuid": "0f3b3fc0-ab91-44e6-95e1-e5d87ef95ec6", "comment": "Malware payload (Formbook)", "value": "cb198e943e5c25204869a0e0d2a0d964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341394, "uuid": "3e7a027c-3ee0-4cdc-ac3e-2645b94ef3a5", "comment": "Malware payload (Formbook)", "value": "f85b0ebf72b1230d8582028ef03f438d04996f2d227f5d3f3af40694a56a724e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341394, "uuid": "ae50e390-ad66-41bb-92bf-0ac21b95a952", "comment": "Malware payload (Formbook)", "value": "96c3810223482ed17cff242e5fef92b5e8277152", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633341394, "uuid": "1211dfb4-75a7-4b26-b960-b33b9b9be619", "comment": "Malware payload (Formbook)", "value": "e9da2b4362175070d301afd08ca9d64b3f1985e63c78567a1e2e299d6b86bfa5473a65280bf7337ee30c07e7b84e2960", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341394, "uuid": "a4cc959e-b1ef-481f-9c9e-1b02b351abd7", "value": "T1B5A5E61123ED2608E07E6EB95A75509947F1FF277AB3C6CE010C675E5962B02CE63B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341394, "uuid": "9464376c-a391-4720-a5bb-f6320ce8dfbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341394, "uuid": "cfbc14d5-0caa-4a90-aef4-b1e7b4dc717d", "value": "24576:vo9iLCQbWxKSYcSIsu4kUpcZcAGSOAYpwcG9e9O1eR:vbbQNCID4kUS6sOJVWCOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633341394, "uuid": "ad6da91f-a707-4b49-8505-4f0d5efc8bca", "value": 2136576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633341394, "uuid": "00d53305-00f7-489f-a8a4-ed979a16a20d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633341394, "uuid": "2340c41e-ec29-4685-a798-0352d1fdde14", "value": "cb198e943e5c25204869a0e0d2a0d964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2ea7d3-250a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633348940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348940, "uuid": "fbb244f1-618b-4aa5-abea-45f362cfee15", "comment": "Malware payload (AgentTesla)", "value": "4b1b1e6e168db2092a78813b83149655", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348940, "uuid": "8e621f98-0be1-457e-b083-5294c3ae3cd4", "comment": "Malware payload (AgentTesla)", "value": "f8dc0dafbd86c3ebfbade47dcc66084303130b82da9c09132a9407c05c0d4641", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348940, "uuid": "0e0c9e34-ce89-405d-a33a-bf54b2a3d242", "comment": "Malware payload (AgentTesla)", "value": "3588b0ee6d4e10543def3b00cbf760b1ad015f24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633348940, "uuid": "971af7cb-83f9-449a-bd83-a3b9d4cb760f", "comment": "Malware payload (AgentTesla)", "value": "5b14db2c0ea7078b27ec6d3151827ee9ce4cdb07d6d5cc09e2abf9b4310ddffdfb659b633ce1dc4dacbaacbcff677e99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348940, "uuid": "1f78400d-abda-4849-9240-60e263e65c81", "value": "T12783AE10770BB921D4351F7288BAA3D143B2E389A057CE5F398E0579AE627CE1790FD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348940, "uuid": "894b4a1e-e207-4e13-be7b-4f921e87dffe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348940, "uuid": "aab435dd-f5f9-47d0-8c63-09157f3cad35", "value": "1536:aF+kYdEL+H7TVLS0Cy74CT3TrYz6vDpMQ43+41xPNfadO:h2+H7TtS0h0CTXYmvFMQ4b1Lfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633348940, "uuid": "639eb1bf-785e-45ee-b5de-ae481ff9822f", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633348940, "uuid": "8d3057bb-46a3-4068-97f5-94ab701d502a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633348940, "uuid": "8a6ec087-6da4-4c65-876c-4281da0ca40d", "value": "Quotation Sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9650bb-2521-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633358550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358550, "uuid": "6ea002ac-3d06-4600-a7d2-a7d151245d29", "comment": "Malware payload (RedLineStealer)", "value": "f67049d9610c9273798558a47095c4ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358550, "uuid": "9f39d1f8-d221-472c-aa11-800fe45a24d6", "comment": "Malware payload (RedLineStealer)", "value": "f9a46ca4a4d8f3b6ee972db845a2f283b64f07ef36b3683afaf86da8da3bca29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358550, "uuid": "d95763dd-645f-437d-bfd2-cf5af36d375a", "comment": "Malware payload (RedLineStealer)", "value": "14721501325a50158e49e7d0ed4aeaa9aa3c1eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633358550, "uuid": "de654e5a-f615-41e3-80cc-72cdf2ebddaa", "comment": "Malware payload (RedLineStealer)", "value": "ee26824ff55ad59912dd692611b7312e8a68626887343b1dbf4fdf17e2060474d21f24b1df89a1efc8a3217be6e847a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358550, "uuid": "2975f2cd-4e68-4886-a905-a42d43c6fda5", "value": "T1E0949D203CFA6129F1B3AFB95AE4B5868A6FF6233617E45D148103874B23E41DDD173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358550, "uuid": "3053f83b-1aac-4ec5-82da-62e6a5ef04f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358550, "uuid": "3d2520f6-591f-469e-adfa-5fede96695aa", "value": "12288:mbk4DbF53e0IUFL26O2cV/TmXWlDFI0YGvQ+:OSd2SCXUyO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633358550, "uuid": "22a6348a-02c0-4189-9ad1-f30a9d15d40e", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633358550, "uuid": "76929bbf-14ef-4ecc-840d-ada60c9eae64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633358550, "uuid": "567e8412-031e-4434-a82f-15089ca68802", "value": "Tips Ref.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff695f9e-24ea-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633335226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335226, "uuid": "e1bde585-0356-4a72-9062-43c086be38ce", "comment": "Malware payload (RedLineStealer)", "value": "8ecae235331118e8516646fa9ea08b69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335226, "uuid": "da662096-d7f5-4e84-a1f4-6701e1af552c", "comment": "Malware payload (RedLineStealer)", "value": "fa02c90a4b561d732823af4a93026580838b1bdda9201a26daa413ca19b65346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335226, "uuid": "1be2a5ee-74ef-45f5-a495-4e2d7fcf1f24", "comment": "Malware payload (RedLineStealer)", "value": "145b2a1197aae6fb360d48efb9db7fdbc5b2948b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633335226, "uuid": "b1092e2a-d864-4209-94fe-e3c9e1635f98", "comment": "Malware payload (RedLineStealer)", "value": "9d797e0a9be6a5766d46dcde4d90f477cb79e056baf43aed7c958a685c95d9cebe9d0b594e92b012ed461eea89c18d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335226, "uuid": "9edfd78c-6a0e-43a5-b40c-eb8b9111a79b", "value": "T106C37347BB812EE9C5940A710D8BC6386FA76E35025681CE5FF07F1FBCB136C9929681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335226, "uuid": "1add4de7-c504-4c92-b15a-932b2db16191", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335226, "uuid": "ccd7aeaa-fc30-46d7-be1f-d1c0c22f914b", "value": "384:F3waq7dBsjW7/JkeoKmfANzNs0HA2q4j0v16Z+XFTbnnuU34ylxY1rWm3vL3TMv:Bq5BaE/XoK2yxeN9uETbqfv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633335226, "uuid": "9c8dbd15-0975-4af0-9d28-c5da154be3ea", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633335226, "uuid": "fc7718b4-5e33-4b99-a698-05c809bce233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633335226, "uuid": "482a3033-0c33-4622-81b1-5273ee46181d", "value": "Divrik PO#290921,docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65eb2da0-2515-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633353437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353437, "uuid": "89facf87-23b5-4d28-a69d-286d84b9c78c", "comment": "Malware payload (Formbook)", "value": "ec50a0d1ba634421cc3301633343ed04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353437, "uuid": "aa527d58-a646-4269-b835-dbf7f7951c73", "comment": "Malware payload (Formbook)", "value": "fa0d4eeae6c743ddc44d9664b0e6d44238beff477d1f4e9a560e68026a4264d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353437, "uuid": "a2fa490e-133b-401a-941d-ca6cdb6c961c", "comment": "Malware payload (Formbook)", "value": "bbb06fe1fb5e61e37a3e709228064ee318e6c74d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633353437, "uuid": "bb4d1c4c-d393-4719-ba87-5e19d60dc7d7", "comment": "Malware payload (Formbook)", "value": "4478e81ef0d8a1d5f93a381d52dc98633e4427523126ee624ce90896bedfe0b71d3f99783d2e965eecbdf6879e3cba8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353437, "uuid": "cc973c0e-0293-4e34-b6f3-2537b115d5b2", "value": "T15044122AB3814EFBE68B0B340D37B62FF3BEA01A115225C347960E3E2E5159BDD14356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353437, "uuid": "4f8b3cf7-25ce-46d0-a5f1-004c7b362908", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353437, "uuid": "f6615a58-2f17-4370-8574-1be13ee6b328", "value": "6144:F8LxBs2+gAyry4UTQ9V+wp8SYNbNlpX40zpMmEg4FwN:/2+HnSV+wWvNbNlpXzJMwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633353437, "uuid": "6106a139-2e4f-458e-8030-3de821bdc2cd", "value": 264130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633353437, "uuid": "be087a65-3c79-4d31-95c5-8afee84d011b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633353437, "uuid": "1c4a6375-8da2-44e3-8c66-b63b6dc7fd59", "value": "rrfee1234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056e583d-24b7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633312903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633312903, "uuid": "0481e9f5-d5ef-4915-b05f-71552ed8db0d", "comment": "Malware payload (RedLineStealer)", "value": "94fa890b7a91f842e006e1c7c795b616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633312903, "uuid": "d9d02a81-4820-4d4f-813b-f79fe1dd1a7d", "comment": "Malware payload (RedLineStealer)", "value": "fa80322381b685e9bfbe9562b0f072e1075f2b2c72c9ed924c6d933455dad886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633312903, "uuid": "b9e6dd07-c025-406e-a4d3-6ec035a8ef7f", "comment": "Malware payload (RedLineStealer)", "value": "a8a42de4640849fa36ca2ee9918825b0dbe3bbf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633312903, "uuid": "d4aef2af-e90e-4e93-b874-54184d51c343", "comment": "Malware payload (RedLineStealer)", "value": "6580f6e4c94033f2005ef86f470650f0311b62038ff816dffb7af74c23ad8b11bfb5420aeac0cfecb2082eee31e4c863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633312903, "uuid": "fb0ea40d-ea49-4a6b-986a-1edd8ed86d0f", "value": "T10B84D038B291CBF6D631C131AB16C3E0496EFC6C5C29568F6B982B1F5F7D3929A21305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633312903, "uuid": "07d79ed8-6359-4328-9e4e-3c3517820d5a", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633312903, "uuid": "c38ada20-cf3d-40bd-b541-e73a23e55e63", "value": "6144:IcZIY/cLq84cQZ8TH20w5sarZmdY8Ge+NEIOEDk/U9F+PJF6AnhrROhxxpeTr/et:/I3P4cQZaH24arP8G9Ntf9FEF6Anizxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633312903, "uuid": "f4d37ea1-5047-46cf-9170-a420b3cbdfe8", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633312903, "uuid": "0427539e-c188-4165-aee5-735877098f21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633312903, "uuid": "3a5e5edf-a63a-4dc6-a91c-391fc2ca0154", "value": "SecuriteInfo.com.Variant.Fragtor.28226.81.26299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51406957-2533-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633366287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633366287, "uuid": "9f0a83f1-9342-46c0-83ae-5d1f14caafb1", "comment": "Malware payload (RemcosRAT)", "value": "b7abe32dcf9563d6214af4e111fbc3c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633366287, "uuid": "d130a72c-8dd7-4fe7-b38c-61c98962012a", "comment": "Malware payload (RemcosRAT)", "value": "fba31a212526660d90a18e87db2427d72a328a87b35b5783567af5917423ed60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633366287, "uuid": "f4f65090-5a13-42df-aa6f-7fa2f656b36d", "comment": "Malware payload (RemcosRAT)", "value": "0457e89df7483ddad2fb05d43fe6a262cead873e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633366287, "uuid": "e7b7059a-c549-4f70-bc1e-d51ac83f872b", "comment": "Malware payload (RemcosRAT)", "value": "afaa0062e1ef17d408538d70b3991758edde11efb14899d38c259ac64f3e972d472f9310030221af132389ba88932cb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633366287, "uuid": "1a01846d-f5ea-4c12-8119-0cbe08e0b331", "value": "T199155C3292E98433C1A327F4BD5F96A4053F7E223E2095DB50CDBA6C7539BE52326187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633366287, "uuid": "f7984e55-3a33-432e-b72d-2ca5fdfaaffc", "value": "b007c2633498ce5e9ac88f6c5e852d8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633366287, "uuid": "7d9f2b2e-690f-493d-84d4-a1a8a19d478c", "value": "12288:jlDYMzwNJM3m4uZQvFTt0jjqipWUUtWZPO19tT3jcin4uq8S:7KpKvFTmjjTWUrZW19tT3jcin4t8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633366287, "uuid": "950652c4-2540-4f26-af6d-1a1e39211ccf", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633366287, "uuid": "ac8d70ea-f577-498f-b57f-e1d0e00fb4c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633366287, "uuid": "5aa3e729-5ece-4586-b1be-331a4db9c9c6", "value": "SalaryReceipt,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0d8e01-2518-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633354761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354761, "uuid": "1de56289-9d2e-4c83-bf55-2cbcc34eb553", "comment": "Malware payload (Formbook)", "value": "4ba87f01d518f5b660cc487d488dbf3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354761, "uuid": "5fe3ac1b-c724-4447-bef3-1e5bd9d607b2", "comment": "Malware payload (Formbook)", "value": "fbaf103427e20432a3dcf19733b5f447bb6f0b2e5c700c76df55c2d977d080ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354761, "uuid": "ba7e6d9f-b98e-4286-9345-1ca95b61f367", "comment": "Malware payload (Formbook)", "value": "48ac926df1e641b32935f095523140701d5013c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633354761, "uuid": "28d6d2cc-0c10-4a45-85e7-cb5a14137e78", "comment": "Malware payload (Formbook)", "value": "6ce1aa14e5a78c7e94b7d4b45af2788383e23aa77584b60ec83a41225687dc580cb43c13e6b9079c1f43059dd3b295bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354761, "uuid": "7346c0a1-4606-4031-b0f0-6e85d7d69ea5", "value": "T1D20516164190AB28F1173B32FD4B028847F5683D2E144B35E6941B979B2F780EED69BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354761, "uuid": "013673b8-1dd9-4351-868f-d81f7748df24", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354761, "uuid": "0533f8e2-8069-4838-bbe3-b317c4d23d4d", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyNsYAycjL7YiEFXXXB:Naeq3gF1Sf+WIyXAyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633354761, "uuid": "a967892e-ebbe-481d-85b1-2a6b36bef705", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633354761, "uuid": "9c0f6fda-8c2b-4a0c-ae59-17050401b69f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633354761, "uuid": "b9713cb8-3be3-4e21-b660-5ceba02b3f55", "value": "PO.10032021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34bd3ae-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633360895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360895, "uuid": "a6be7394-3130-4ffa-aafb-1cf92e13e21a", "comment": "Malware payload (Mirai)", "value": "09a580164433a56c1a97ac800b0944fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360895, "uuid": "591951e8-6b35-4f0f-8edd-78a083e11726", "comment": "Malware payload (Mirai)", "value": "fc29d476f049c6d8a0b91cee712a63d6761b2a16eca42d2c6dac24073509afa1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360895, "uuid": "f560430d-bfb7-41f1-9357-1ccc8a0fcd99", "comment": "Malware payload (Mirai)", "value": "ee7496a4a25deda85961059c2ed0864c0aefde53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360895, "uuid": "2c59e9b0-a4dd-4e94-b4e8-8775fdc9b34a", "comment": "Malware payload (Mirai)", "value": "e6fec32b17ce477bb51266ef163961365fefbd4394267737df31a6d0b454bf427cfa52f1f4c03163fa6dc28b5c452544", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360895, "uuid": "40b98dff-2e2b-47bb-a2c8-cf7b19af15cb", "value": "T17E239DF3C02DDDD8C54902797A285E3D5723E40086671EFB9E9A86A59007EECF60A7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360895, "uuid": "d63c51fb-16ec-45e2-8c47-247fe07cc898", "value": "768:saV/hnrsPxgOH59EEvs9Nh2/RJbtsqFamSdXz8uPCboxOXI8C3f:saV/tsFZ/s9Nhw4/X/TxH8C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360895, "uuid": "f5be3fe6-32fd-48cb-be80-be202c852187", "value": 47232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360895, "uuid": "4e347d2a-a33a-4d21-ab46-bc2cb0c5dcbb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360895, "uuid": "c3cae0e2-530d-4c87-bdbc-2449c679c499", "value": "09a580164433a56c1a97ac800b0944fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a5d2bd-24de-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633329660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329660, "uuid": "8d88f469-0443-4990-8d13-1403025fe5f0", "comment": "Malware payload (AgentTesla)", "value": "b82e673efd6472e2ddb1dd3f03e96314", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329660, "uuid": "51433f23-75cf-47b5-9fe8-d0151f331d5e", "comment": "Malware payload (AgentTesla)", "value": "fc6d5dbcbfcc99e88122cf7321bfc682637f756d6bd18356d9e1c3b2ff6a0db9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329660, "uuid": "58577bfd-e188-404c-8bf8-e38ba7d46b4d", "comment": "Malware payload (AgentTesla)", "value": "398d9545bc0416d7437f8f89489f99e9eb9394a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633329660, "uuid": "be8403b5-e9ec-4838-8ed7-9bea59f97ac1", "comment": "Malware payload (AgentTesla)", "value": "5371b687f58666d4421680445d93b1813d2059048ff045f03df422eda0c108811aadebe27341587d038d6f86496ff18b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329660, "uuid": "c3c4bcf2-fc77-43bf-a815-6dba8889e498", "value": "T1EA451269376B426CCEEAC3F96470E5C107F1B866146AD3787E8C60ED2F623BC5A50907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329660, "uuid": "dcd10381-5624-4fb5-90d6-e0754625a7f5", "value": "6144:cAa3oTMCoO/lGqRmMZZlUeTQovmYWaq0UFyzInILgdchnIITHJ7lMRicE7E/DxPC:yAMCQA5ZZfTQa3UU5LgqnHx4/BhlAeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633329660, "uuid": "6d6e17e4-e65c-40b3-b426-e3466b7ee4c2", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633329660, "uuid": "8acd647a-f6f6-4495-81ab-e6ee4d5dda2f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633329660, "uuid": "53d9ccc1-7299-417a-9e89-3728d51312c0", "value": "PO#A91642-MRKU6307240.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1539c060-24a7-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633306057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633306057, "uuid": "fb777085-4ba7-4427-8e42-adb8db983329", "comment": "Malware payload (RaccoonStealer)", "value": "71cc05964391b90687e6c717b0e71714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633306057, "uuid": "78e41d00-d42b-4b29-a450-2ef5fbab18b0", "comment": "Malware payload (RaccoonStealer)", "value": "fcd4fec8c6c38b2ddcf5d018d8ae08a80a495477f2618b825d70820354fcbfd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633306057, "uuid": "19ed7973-896b-40b6-8171-e14c223a24d6", "comment": "Malware payload (RaccoonStealer)", "value": "cf1e465995d64ed6fcdd596c181ba7a818a56dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633306057, "uuid": "0dbbcb9c-69a1-4d52-b208-54d95a17e00f", "comment": "Malware payload (RaccoonStealer)", "value": "a9d1a1505d4503e74be4ed588e2ee23cbe2d75f28d1b39b00c76e559a3c135ba17070522fd1270c35e50a7500977575f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633306057, "uuid": "c8a5a71e-41b5-4280-8f02-57878e9a7454", "value": "T136C4F10875A1D3F2D67552B0BBA6C3E0862EB81D7D15DE8F3798671E2E393C29721243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633306057, "uuid": "a64c124a-589a-40bd-b3b7-d3b321d595fe", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633306057, "uuid": "9044a655-937e-41ff-be7e-01afd8816109", "value": "12288:GXtI1j3rP44CYTnay8VJR3wj5ntlJFeu9CCE3hxK0U14gzxp6L:GXUDT44CAaZRg1nLfeoovDU14k36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633306057, "uuid": "8caa8d37-0b4f-4595-b8b2-132b3f68253f", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633306057, "uuid": "d3eba5a7-3506-495a-8458-674decd225cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633306057, "uuid": "c5013762-8ed7-4e35-baa2-c0c2f442b6f9", "value": "SecuriteInfo.com.Artemis71CC05964391.24041.3107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49af91ca-2538-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633368422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368422, "uuid": "2cc8047a-b14a-4cb7-8f2a-4a38a0d2dcc9", "comment": "Malware payload (AgentTesla)", "value": "158e01f538628b2df12e60a92ca26a1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368422, "uuid": "e59b50c7-78ed-49d9-94ec-3a50edc636a8", "comment": "Malware payload (AgentTesla)", "value": "fcfac8f0934e1b33eead1e730bca5ef01e42625f37b011e14e4b94caf4b3f528", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368422, "uuid": "ba3796ec-e7ca-4600-ba28-59acb73e8a76", "comment": "Malware payload (AgentTesla)", "value": "3fb303b5a6b3783a8004f3ed5cbd41f7f29dc02a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633368422, "uuid": "f95969dc-115f-4265-b7c8-5c768f78d027", "comment": "Malware payload (AgentTesla)", "value": "00361fc589cf7887127e86fa683844dbc802c9564462888644c8d0b9927a316fe2364cef99a30ce15564ebe25e4d3c4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368422, "uuid": "a1236f0c-2f15-43c9-b724-a728eef77a0a", "value": "T122F4CF64B747DA1BCE7547F028AD9240133AAF221A08C72E7C85B7BD2D73B74164C9DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368422, "uuid": "bd631af0-01d9-41cc-9a68-1c36ed9f3196", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368422, "uuid": "54aa2382-11cc-496a-97c1-1a3b6e63cfe8", "value": "6144:gOacLYW1Q+3HwOExxBHVu2wYNlvZGKshCxi6RELqi3Jr7W9+ECwoSmvYqTu/YYPe:HLGoa1ZNlvZvi6yqi9KOwUT4YjLsx9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633368422, "uuid": "b5af4041-c5c6-41ba-b8f2-ee3d569fcf60", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633368422, "uuid": "703687fb-883e-4ff7-8549-76faf1970de9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633368422, "uuid": "4d4635bd-3480-44de-904c-0f0a6f7038c9", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be842760-2526-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633360887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360887, "uuid": "140661f7-cfed-4e9e-9ef7-6f243ad48135", "comment": "Malware payload (Mirai)", "value": "8fe6fbee44db379beb35dc086fdb4c56", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360887, "uuid": "48172bdf-7f92-4aca-ba07-6bef99e5fdb7", "comment": "Malware payload (Mirai)", "value": "fe4f2bc89b6f91a707e7f3ad4288a78ca6038eac6a3ef0cb0c4b7b2dfab6b22c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360887, "uuid": "fef8f062-4feb-4005-a6f4-73560c100017", "comment": "Malware payload (Mirai)", "value": "d479c4c8266925a10be375f97501840be681050b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633360887, "uuid": "4c47f923-bbcc-435f-8ef3-4c7f16a55af3", "comment": "Malware payload (Mirai)", "value": "4f551e93d237bc87f6eb11beb9e60746e5dda749df9c291fc87851fed8c1190177de3d9b605ff13c54f30095b4327658", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360887, "uuid": "2dc1ee49-eafd-49a7-883f-ef7b89c96120", "value": "T10533280BA58181FCC559C17443FBB53AC876787E0239B1DA7BC8FF276D85E601E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360887, "uuid": "380b1c6e-4716-468a-8bc7-ffa600d16346", "value": "768:j7s093tGOHn2PAe6nCAQTGWexrecbwBg4ubt7IQE1rjWb57Vn70ungg:M0937QAe6CAQiWexKg1U11rs7Vn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633360887, "uuid": "6bb7848b-1cce-463c-9183-f99921943e4d", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633360887, "uuid": "326e607a-0c60-4ebc-94bc-75fd5cf069d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633360887, "uuid": "147272c9-3e2e-48aa-9033-23c9bb517a91", "value": "8fe6fbee44db379beb35dc086fdb4c56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3135b112-24fe-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633343470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343470, "uuid": "19e54e05-4d6f-46c3-b7c6-e23f27c13f49", "comment": "Malware payload (RedLineStealer)", "value": "204cdae0b9583005eed92479e5f27e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343470, "uuid": "37686839-3831-443e-b5fc-9a1138d12247", "comment": "Malware payload (RedLineStealer)", "value": "ff144f47f95b7b8f24573fc07b29562fdff19ea4a0d784e5c122995ab42095ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343470, "uuid": "f4fcc09f-b8cb-40fa-aaa8-456c387190e0", "comment": "Malware payload (RedLineStealer)", "value": "9a48eff585ec5955fc10ae06a8c1e16ad804c869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633343470, "uuid": "92144d27-9c6e-4737-aea8-3d5845950b42", "comment": "Malware payload (RedLineStealer)", "value": "f046a52a085a8e5e43645f8b2000600b985a7dd36de1b75c4f32286d9dfdd01050df7efe4e8b4bd4abc1b96bd753d0d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343470, "uuid": "af30f4b3-a37d-4e82-8590-f1b0cc88e7b0", "value": "T1FFD5BF013E8F8601DCBE4ABCA83B95A453677D40BC7CD0A7B16A739B1A30B43D676716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343470, "uuid": "ee6f27a8-211f-4d5f-930d-0032d540c2ae", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343470, "uuid": "cdac124c-2a9b-4ead-86bd-25a349d7e45c", "value": "49152:IEUIGm7mK9f3hxmq5c5hCGJtjMhp2sOLDq6+:5UIxlpDNYhCgi2fHqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633343470, "uuid": "b2eaacaa-c005-40bc-b61d-97b3b53c0370", "value": 2818048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633343470, "uuid": "921aa6ec-f577-4953-8c39-cd526715d8b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633343470, "uuid": "8af50a7d-e820-4376-a3bf-1283c5c9232f", "value": "204cdae0b9583005eed92479e5f27e01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042fc98e-24f5-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633339529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339529, "uuid": "f3f0e1a5-e9bf-4bc6-82f7-86e979b76baa", "comment": "Malware payload (RemcosRAT)", "value": "83aee6709caaf9035a38ca48261b2980", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339529, "uuid": "67fa26e0-90e4-46c7-b89e-74c7b72592d1", "comment": "Malware payload (RemcosRAT)", "value": "ff5447b359711095f909692d48cc1b597ac4e5b7c976a8a91f2b6c2c8a7e54ae", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339529, "uuid": "09c488d7-ed29-4730-8bfc-08f0c72266f4", "comment": "Malware payload (RemcosRAT)", "value": "3c27fa40c64fbef53ca2a1d3b3ef0d9b43066f76", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633339529, "uuid": "881b7e9f-2d59-451a-9602-2b373895ecda", "comment": "Malware payload (RemcosRAT)", "value": "cd918753ceb0023eade30d53a673104b549508942d6cf9917a9ffeaa256fcb2be4b2c927dae19d3a76cebaec2ca36da7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339529, "uuid": "c95f2bd8-0315-4c23-a908-8f489bbe88cf", "value": "T1660518019251632DF5073772ED43140447D4693C2E148B36EAA42F8B6B2FB91AEEAD7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339529, "uuid": "ea229730-9bdf-4ff6-98a7-68a5731e95c5", "value": "8276363bcf2f383c8cd04fac30801161", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339529, "uuid": "13edac74-2d65-45a1-907a-603bea7ea7c9", "value": "12288:0w6jlNSq3W9F1Sa+tiDWIyNEYAycjL7YiEFXXXB:Naeq3gF1Sf+WIy/AyAdSXXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633339529, "uuid": "8da5d5f0-9ed9-45de-84f1-7197766810cc", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633339529, "uuid": "db9db73d-8cc5-4f37-b3fe-e653afd91409", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633339529, "uuid": "980cfccc-e8f1-4b59-af0e-151ceae8d6a4", "value": "Sat\u0131nalman\u0131n DHL_119040 giri\u015f belgesi,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }