{ "Event": { "published": true, "date": "2021-07-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-07-19", "timestamp": 1626739381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "cd13d1a4-8ecd-47c7-b306-85347ae38c8b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fdba95-e86d-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626684343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684343, "uuid": "5ff9a0ba-382b-4aed-9d8d-1a63ee27e2fd", "comment": "Malware payload (RaccoonStealer)", "value": "6fa0e791f40fcd7b9ae5bedc6f1e36d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684343, "uuid": "4fc60f7f-ca19-41c9-a746-0e16d2fef975", "comment": "Malware payload (RaccoonStealer)", "value": "0128936379b8761d89b22f7eed080acfe103b2d429ef1b4d06f6c781f682bacc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684343, "uuid": "ea834fa8-92b3-4778-bc0d-e6a12522d0c7", "comment": "Malware payload (RaccoonStealer)", "value": "a9b2156cd82165070888d6d9b4f85c9044fdd09d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684343, "uuid": "3ccb52e2-7915-4513-913c-fa3454738100", "comment": "Malware payload (RaccoonStealer)", "value": "d153c1f1f8f7b8d9746166723893d4f3445e5e85a33d40fbffc0b6770265ccb22d7d403a405e4289f7c6bb9caad1ab4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684343, "uuid": "449728b9-974d-4f06-bda6-2b386919af5e", "value": "T106B4F11172B0C523D5E20AB09430CB66A53BBC325A34758F72A73E1F6E723D1B5B6786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684343, "uuid": "e4c43b09-8f56-4116-bc87-bc33dd0f29e9", "value": "4c2cb70eaa36e2f27e3da0ec1f2cb347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684343, "uuid": "345bab3f-7855-45f3-aa27-69568a289b38", "value": "12288:pbS7ktxBAICMdlySfmQ7IcyJ6a5gJHNBYvUBJ:xSgt7vCQRySBYvUBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626684343, "uuid": "277c63ad-3957-48b5-b782-3cc2e5352b24", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626684343, "uuid": "ff1b8625-a2a1-42de-a5f2-cb73e9cbfb43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684343, "uuid": "20976cb7-2499-497a-8ec2-d82fc2e5483c", "value": "6fa0e791f40fcd7b9ae5bedc6f1e36d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5a2b14-e864-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626680515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680515, "uuid": "8a1f2430-32c9-4f59-afbe-9f7e67c02d87", "comment": "Malware payload (Mirai)", "value": "5533fc9feb83a4993f8aa9f190c16c50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680515, "uuid": "8f60956d-1091-4ae0-bc59-312f01ad36a0", "comment": "Malware payload (Mirai)", "value": "01d4b0f541606998b628b219b80018fd21a2c6fde5f614befcfa8d96877e9428", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680515, "uuid": "c7a64fbc-60c7-4b82-9ed4-f2c2952cf9f4", "comment": "Malware payload (Mirai)", "value": "d44ebf08a8d7c6626a31e2f22ff568311ba1b189", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680515, "uuid": "c59ac7b4-4834-49e7-b365-26f296e17a88", "comment": "Malware payload (Mirai)", "value": "d52f7059c6e5554c525d2f18dd04f0932b9b39a8a17d4a3c13b5aa0848a83a651335df5e8d5fb2a441c6d298d858feda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680515, "uuid": "f94f0fd3-daa5-4793-a6b6-2909e141b2a0", "value": "T12B330256C7C3F76AC6E40D26CD8D1846BBDC4A7960AF31653A6D859CF3730091829EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680515, "uuid": "4c511224-e803-49b0-b089-29d9ee00cc4e", "value": "768:sdV04oRQ8cy2gC5p8/xfTB6gLLpT8Fj3RPtK5J9p79q3UELfNjckM3PXWf1bH6Rm:sL01R+yc5ppgxgFjBMXALfdtUmf1oQ7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680515, "uuid": "aafc3ed1-dfae-41af-9a7a-323468e62156", "value": 51620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680515, "uuid": "5183fbef-6c4b-4a31-97e7-0b066ed4c457", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680515, "uuid": "db0feb6a-4969-41a8-a885-f89ef5a4b407", "value": "5533fc9feb83a4993f8aa9f190c16c50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a93307b-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735840, "uuid": "8df679f4-563c-4ba5-93ad-6348612dff85", "comment": "Malware payload (Mirai)", "value": "35e37ed241ab248ab16b581e1d82a307", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735840, "uuid": "885c71fc-cd7b-4002-b1a5-0ea5e5cd644c", "comment": "Malware payload (Mirai)", "value": "02d97540cb37774b6396c5d6b30a4115676e43f28dbb398b981041b1e6666041", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735840, "uuid": "d12426bd-19d6-4ec7-b10e-5f5beaf0c6f6", "comment": "Malware payload (Mirai)", "value": "70ce09d4c194a9074ead00c2b2f8e69da84d5fc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735840, "uuid": "80360a1f-8686-48c6-a347-a1e96211a6c4", "comment": "Malware payload (Mirai)", "value": "a84717703f460cc0d63d15173e89d3a1e2730f3c2a58ca2666dcace33bbaf780ab8de7e24a3aca48b099ca486fdc0097", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735840, "uuid": "f0fe196f-fb20-4463-96d1-675441416605", "value": "T1414308C17881A626C7D05777FA6F018E37199798E0EA33538C295FA07B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735840, "uuid": "5959bc46-a96e-4953-b924-a0cb0957f223", "value": "768:N1c82KhvRRTdj7tsq5sebD07B8drbonjxDdSYGSq/EanRP89UapvTLwCVy/rCxH1:Nb24Th7ttujxynRP4U8ShW+15RL+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735840, "uuid": "592fd90e-2c24-4c23-8c3d-c6196311c79e", "value": 56584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735840, "uuid": "fc722cd4-7aa1-4ee5-b2bb-453f3c14875c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735840, "uuid": "8da5f1f8-e738-48e8-be22-086f9e282d26", "value": "35e37ed241ab248ab16b581e1d82a307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ce9625-e8a4-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1626707916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707916, "uuid": "924c7b92-6fd1-4d5e-9b81-e61cea21c0d1", "comment": "Malware payload (CobaltStrike)", "value": "6c63aed2122a6c4a6ab0670501a747c5", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707916, "uuid": "97a6b5cf-b946-4ccb-a8c8-4efba6355fe0", "comment": "Malware payload (CobaltStrike)", "value": "032f8678c49d5320602b75ce8da611d6bc4268354e905aed217451d7f739da67", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707916, "uuid": "f5380f0c-144b-4c14-95c6-e903fc3c765a", "comment": "Malware payload (CobaltStrike)", "value": "d9896d3d6df30c3d733d145b3e24e3844bbb6751", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707916, "uuid": "393c9bcc-5480-47a2-a7f3-f147119b2687", "comment": "Malware payload (CobaltStrike)", "value": "2292d240aa6ee1bf46e3b97975928044ca5b79e750217be4c20c6e309975b48485eda7913d32ba52a2aa02013be71331", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707916, "uuid": "778a6b64-4fa2-4d40-92ea-a4e98346dfa7", "value": "T1F336AEC66BAD00D4C892E075C4A37D07CA76BC9D22E1765F4924F7A62F33362CE1DA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707916, "uuid": "1b41203e-4315-4f7d-af8f-3c077991915b", "value": "30c36f9dc182a09e565e8c4883c61b1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707916, "uuid": "26ae6b6a-25d8-4255-ac07-0e9fdda1ed51", "value": "98304:m5a6SK5TDNoioYhZuL+LFLOAkGkzdnEVomFHKnP:H6xVLxhjLFLOyomFHKnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626707916, "uuid": "41e0cc1a-56a8-4551-906d-07b4b458ecdc", "value": 5314560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626707916, "uuid": "66c49fed-bd2a-48f4-bb67-9d166064ceb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707916, "uuid": "c5d9b438-8952-4254-9a02-2f6473dd15c1", "value": "6c63aed2122a6c4a6ab0670501a747c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75304ac4-e834-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626659756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659756, "uuid": "1a3d881d-c963-47ab-a8ef-456e5a21f3b5", "comment": "Malware payload (Gafgyt)", "value": "921f2ead6fa1d122e232af01a97badcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659756, "uuid": "bcc34891-4ade-4a83-9070-ced7ce620105", "comment": "Malware payload (Gafgyt)", "value": "05dbea3fc2d79fd9f9d2dbe72fe8dd6a7310822885c5e2b1c6cb0334c3cd2775", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659756, "uuid": "230d8617-a454-4101-b77b-f0a13db45722", "comment": "Malware payload (Gafgyt)", "value": "1c3274f24bf12d0df762ba01a3dbd4b90085670f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659756, "uuid": "b8d9919f-e1cd-43ce-98d9-6bd4a727c9a9", "comment": "Malware payload (Gafgyt)", "value": "be41edc77cbdcd1f91140a7a13d7341b5f88c6d50167b237737a273cc81437025c61f887ab901f1e16913373b2f0dd25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659756, "uuid": "e68b46b0-6f29-4e20-b030-48e9e4d904d7", "value": "T11FC3D631E8044B1BC2D227FAA79A835E3F351E97939733115B3879B06FF27991E25910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659756, "uuid": "560e7136-e74c-4319-a3db-d4bfe4b7220c", "value": "3072:MxHIYvMG2Ki8fgec2bmy0em7/L7QsvmGfIiNb:MZP2KvTc2bxjm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626659756, "uuid": "173bee7a-78b4-4516-9064-a87cdd49c6fa", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626659756, "uuid": "5cd46d89-0a88-4ddf-9a4f-d9c5c80abeef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659756, "uuid": "0fdfcf12-a012-496d-96f1-dc4d7c05f2d8", "value": "921f2ead6fa1d122e232af01a97badcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47479b2-e8eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626738541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738541, "uuid": "726ae2b1-52d2-4074-8eb4-1d515d62b2d5", "comment": "Malware payload (Mirai)", "value": "ee86a21dcf851adb15e4502e78bb3509", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738541, "uuid": "e79a651f-d77e-49f6-9f39-32d261aee63c", "comment": "Malware payload (Mirai)", "value": "07d40d8588d4401288c623e42e89301abcb7cd2921dae5bda3b8d781f2acae74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738541, "uuid": "3918fb9c-58d7-49ad-b961-1d75554bda0f", "comment": "Malware payload (Mirai)", "value": "e7e77aa995921fc4a9ad207a46244e26305ad1b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738541, "uuid": "8479d7cd-102d-4815-9209-ba09bcf71a5c", "comment": "Malware payload (Mirai)", "value": "ee1707617e6e1e76c92fc484dab51b8db9b8d109843decaa61a8847ced2f9da9c28a3a4c3c3b59f6e9d99563785aaa0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738541, "uuid": "93c96cfb-6b2a-469e-95d5-a34449c27ca5", "value": "T1D2233941339C0947E2972FF5363F2BE593AEDD9022A5F1C4224FFB4A8175A734609E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738541, "uuid": "ca666fb3-5a01-4b32-be13-6f489f6bb72d", "value": "768:UbCsSmkaMtbDUcrnXaopR2i+k12Pn6CyMUe6mDn1vis:+iaPmHrMUe6kVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626738541, "uuid": "11267be9-ced1-458a-a8e2-eb3ddc46834a", "value": 46400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626738541, "uuid": "c3606b87-1e9f-4e29-8423-eec05d41918b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738541, "uuid": "9e2d795a-291c-432d-b261-15fa113c9f94", "value": "ee86a21dcf851adb15e4502e78bb3509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6add72b3-e8aa-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626710419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626710419, "uuid": "6c41f93b-07bd-4351-b764-41396c53743c", "comment": "Malware payload (Formbook)", "value": "5b0a8804322abd640a1adfc8e19023f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626710419, "uuid": "edd2da6a-4ccf-481b-a677-fadc0d62a252", "comment": "Malware payload (Formbook)", "value": "0843599494471ac72b515fc33ea317ed0b384257ff9cb2de7e93a657f9e89878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626710419, "uuid": "78190e25-1e2f-40c8-b752-86d48dda4fb8", "comment": "Malware payload (Formbook)", "value": "ee79d3b51678cc4d8b8fcc5fc332ece0de0af634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626710419, "uuid": "f5f5ccaa-cf96-45fa-a740-5452fcdeaae6", "comment": "Malware payload (Formbook)", "value": "28c3bb92c23ac12c767e44ce51782bf5d471a3c613e537161a6ed908c0ce17db872d64d7ed006b661cbde003297a28e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626710419, "uuid": "f9b34ef3-8645-47ad-a982-db4478fb6fe7", "value": "T19B15F1263227A204DC3883F55C69D1F12BBE6C1A666CC7782AC4ED7F3D7267C5AD0681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626710419, "uuid": "6df765f8-464b-4107-a145-20807aca6f77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626710419, "uuid": "ab43c947-e217-42f6-b0a5-df7d1fe8e7ac", "value": "12288:0H6lNyvUIZbVlBPI2VBPzgTiBgJPMXDrkcamY2c1hhI3y3GN50pcLfqZQe:AvDBlBPIOBPiKgJPiDQ+Y2Dy058cLqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626710419, "uuid": "959052d4-1037-43f3-ab31-d3ae144185dd", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626710419, "uuid": "34908625-79e7-4517-8fd8-5f22c113515b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626710419, "uuid": "da220d44-3165-456b-a4f1-3ffdd4cb3e1f", "value": "muestras de productos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1506cc1-e88a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626696901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696901, "uuid": "97630c96-20a8-4b47-a62d-cac39f7cbf28", "comment": "Malware payload (AgentTesla)", "value": "282c9c3ec7ffed97693709297772c923", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696901, "uuid": "d830a93a-9e1e-414b-b34a-67992858323a", "comment": "Malware payload (AgentTesla)", "value": "08a2b7ecb3755b429a84894347e95561f04f726d51147a31955ccc830bbd47ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696901, "uuid": "e6289adc-2681-45cb-bc1b-c8ea7f9feb87", "comment": "Malware payload (AgentTesla)", "value": "7c1fbd143b0177751c7f6cf5e851da62c4b70a1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696901, "uuid": "e1d2f412-f25f-4ca4-b096-46f8ddcc4469", "comment": "Malware payload (AgentTesla)", "value": "77b4e284e9e1df4b9e2bbd5f14d8252e68af3d5ec1040ea6b3fa17b86f9606ecb2d5229d9a3b41f2e70a93d4a6125cfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696901, "uuid": "5e4a773c-5729-454b-a676-3e0a92bdfb25", "value": "T19E15F1612317A244CC7883F41C24D1B16BBEAC2A562DC77C2AC8ED7F7D736B89AD4641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696901, "uuid": "6dfa56fc-43d7-4344-aeb7-03817e4060ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696901, "uuid": "c42b7b88-4633-486d-a2a4-f21b2438722f", "value": "12288:ggvseenyvUIZbVlBPI2VBP06ZVrKL8wuAJU8I+KRqmh5X9nI/ovwiq17Qp:ggvs8vDBlBPIOBP06uLTU8I+Xq5tA/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696901, "uuid": "ac3f5833-ec5b-498a-ab1a-7f9847aff91d", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696901, "uuid": "7fc97446-7992-4db8-810c-f18d4634ad57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696901, "uuid": "6d6071cb-c124-4a51-a6cb-3ddda06213c4", "value": "cargodetails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9bd6d0-e834-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626659772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659772, "uuid": "cb54d0e9-bef9-4565-9e87-5541f2531fc7", "comment": "Malware payload (Gafgyt)", "value": "c5703e054d94827e45b0b669fd10bd52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659772, "uuid": "5baf83ca-f74c-4a92-b5e9-4138c65ca287", "comment": "Malware payload (Gafgyt)", "value": "08a34369b689900fd4510a89b3390b8759bccd1ceb00c7147e8b132fc34bb0a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659772, "uuid": "dbd1f0b0-bda8-46b2-8965-7cc75c7099d2", "comment": "Malware payload (Gafgyt)", "value": "be8bcb3f4f6ccb32be8bfe604b44d613a7d8284c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659772, "uuid": "9f4d09c6-6f74-4241-abce-eb7078f108fb", "comment": "Malware payload (Gafgyt)", "value": "c6f1bf604d19400faea3be6058160e6a1d616d7b08e341861456a8e511228d78ae6f09f7f1a595aeb01b426b72b9607c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659772, "uuid": "61ebb1d7-2894-4627-a2a6-c9696b7ed388", "value": "T19DC3F631E9044B1BC2D227FAE79A429E3F351E9793E733115A3879B02FF27991E25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659772, "uuid": "95b514d2-3154-4f4f-b6b5-4e6c9556ed24", "value": "3072:GxHOQ8RSS2OSdyaQTrfcb2ytoyzmP46aQyfPlfKsNb:GTdS21OrUbBnmP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626659772, "uuid": "06384b6d-bdb4-4032-a9cb-e38640608cde", "value": 129482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626659772, "uuid": "2141fd9b-d0ee-40e4-9929-91252a6c8ced", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659772, "uuid": "f5bb7abb-6243-4d7a-bc5a-4222dda944a9", "value": "c5703e054d94827e45b0b669fd10bd52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b259e48-e878-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626688918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688918, "uuid": "6b9cbad6-1cf1-4e5a-8d9a-428df87d1a73", "comment": "Malware payload", "value": "62d8cec5209aac84008585450d214ac9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688918, "uuid": "6ee8f65f-b4b4-474b-be34-7b104856db9e", "comment": "Malware payload", "value": "093adcee38b42ab61cc4d8c322411d9168e0ab63d8d3d6e259f3fb6c9f7c92d6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688918, "uuid": "89d73c84-7f8a-4141-b4d1-6b1821443785", "comment": "Malware payload", "value": "d9d27c6eb2aee1ae67c9eabfea0c27d291bdde84", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688918, "uuid": "cc9e2036-ba8b-4556-b44a-6a1759856f4c", "comment": "Malware payload", "value": "ae0adef3e897b4177f43343066448ff70ddab55af70d86888e58372e9d1a2077add03e3e2226ac890ce8c10df4f96c20", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688918, "uuid": "2f911590-fb42-4dcb-8087-322cc9c16814", "value": "T12933E7DABAA6DCEBD821173E54DB8325173DF1E04B434B032E30593A1B536A23FD8646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688918, "uuid": "a4f71a18-fcb2-4c33-9993-f2b1c58d7c55", "value": "3809496c3334cf1177b9411080d41867", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688918, "uuid": "57d556fb-2013-481f-97dd-5f6864ae7938", "value": "384:h6ejvfuQ0RGVezI2U9ZbGDPbkvK90Mr4c+g2wauN5Gv66jJzqLFopmfDhkLOLV:h6ejp0sVezIhbOPbkOFr4Dum2LSwLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626688918, "uuid": "094d618a-9d53-4312-9ea0-14476f47e4ab", "value": 51319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626688918, "uuid": "f6b7d37b-7491-4e8e-bd9a-ff8ac42a78f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688918, "uuid": "7b1ebb04-f1e7-4e51-a3e1-4600d534b3e9", "value": "cjbnyayhde.sikbjse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe5bdf3-e865-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626680766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680766, "uuid": "abf73a0d-7ff9-4341-b013-e00569bf716c", "comment": "Malware payload (Mirai)", "value": "0620773bb31ce228bc888f49187e5867", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680766, "uuid": "924dace4-39cb-4b87-9d15-c5d240aa1e3f", "comment": "Malware payload (Mirai)", "value": "0a38cbffe9a41dce15ae2ccd1b90ee3ae12ccdff94d50b031c3be6a767086d03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680766, "uuid": "fadde2d1-8693-4887-a1b9-b251871e7e25", "comment": "Malware payload (Mirai)", "value": "535b31b428014cfbd2ab934f6c1d95ffab5db9ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680766, "uuid": "5dea381e-f992-438c-be41-22d4267e2d4d", "comment": "Malware payload (Mirai)", "value": "d198036e94916398159fc6fac38305cc8bef8733c5407e58acec8837a0e3beabce22a6b0528be4365996e46205437140", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680766, "uuid": "57053f79-da0f-4d28-95b7-1e2abadd1d7c", "value": "T1F7D2E16A2B0204B6ED2BC47D2D922F502D353E86B417EC966619D2FDCD931CA5883FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680766, "uuid": "7f8db81d-274c-47b0-83a3-ddc04721a238", "value": "768:E1hwakqz7JJfp8cn5QSytK9DPTSSq1yP9OJgGlzDpbuR1JP:E1zd7J5pf51MK9/F16VJu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680766, "uuid": "9e5b8f54-6c9c-453c-a192-7de3a842bd0e", "value": 29008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680766, "uuid": "e7f3d396-75a3-493a-9b8f-4db6cbfe8c6a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680766, "uuid": "6fc7afea-a86b-41f2-93be-8e221f21ec9f", "value": "0620773bb31ce228bc888f49187e5867", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f419094-e89e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626705353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705353, "uuid": "4a0c33b8-9bce-439c-b38b-697567fb710d", "comment": "Malware payload (RedLineStealer)", "value": "9e332e0055d683e9a92ed746f5c1607f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705353, "uuid": "9c65893a-f3d1-45b0-93e0-db7f886f16d6", "comment": "Malware payload (RedLineStealer)", "value": "0a57da60edb393260bde08820ab954d33416b778abf9f2a36627e321079afe2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705353, "uuid": "fc378217-249f-4746-bc85-16b5d3c6def5", "comment": "Malware payload (RedLineStealer)", "value": "5c8083d719ffff06f91d9a34439a4e68424bb72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705353, "uuid": "5ba7e3e5-06c3-4fde-8ce9-e48bca3f89a2", "comment": "Malware payload (RedLineStealer)", "value": "75fdcdc9d27d3bf3b31f3fb5796cf20c2196316565bf9ee32a3b9747b33b7f74496d13de8cbabfdb928c6e4d71e5fb4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705353, "uuid": "368e1454-17f4-4956-beef-8bacef92369c", "value": "T11484332868BFC05985E3EEA52DDCA8FBD99A55E3640C743301B4633B8B51B80DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705353, "uuid": "05d102a7-01d7-4456-9386-e7efc0a24378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705353, "uuid": "adbc1d08-bb8f-4fcd-b68e-4d1248dcb383", "value": "6144:IZmajpDgpqi+2J17AAOmXkk8V2bS8bR94l:WmatDgpqqJ17AAOmXkk8V2b5V94l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626705353, "uuid": "d379bc45-97b3-403b-817c-027655e1b8dc", "value": 379560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626705353, "uuid": "ab28f780-817f-483b-9ef7-48a51647a6c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705353, "uuid": "5aa41c79-b1d6-4efa-bffe-b980cd891db4", "value": "9E332E0055D683E9A92ED746F5C1607F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c72e22-e88a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626696847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696847, "uuid": "732dbd14-ed33-4393-874a-958a594cb26a", "comment": "Malware payload (AgentTesla)", "value": "f29673f00584145b44295bd7f8803506", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696847, "uuid": "015f7e1d-6565-42b8-930e-3221b34237e9", "comment": "Malware payload (AgentTesla)", "value": "0b033a5d0a85e0cae87e388e1157ce28a7a754988368a88600efde3fbc484071", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696847, "uuid": "babeae05-73a5-4e84-83a8-9194ff2c4f42", "comment": "Malware payload (AgentTesla)", "value": "64888f643992c30b5824ff88e0d96272348c5ed5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696847, "uuid": "17877d52-0619-449e-b3e0-921bb4924187", "comment": "Malware payload (AgentTesla)", "value": "78e69c09c3d96e9b5485c12740ae27a8856a3b935fcdfbf9c56089dabbef14b01a52dcc84b1ffd081603fce07a452d74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696847, "uuid": "181b50c6-6300-48bc-83f0-b3fc5514af1a", "value": "T184059E9C32407A8EC4378E338994EC71F6D06C66570BDA0358D77DABBABC647DE111A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696847, "uuid": "aed0f270-0db8-4e86-a55e-2d335f40d651", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696847, "uuid": "6b8b8013-9c57-4c4a-9495-1a7dbd871b67", "value": "12288:522KAP7KafZX7rjk6gKgXyon8VyakI2bmAX02wiB0rIwcjDI9Kjm:gJAP7KSZX7NVrxka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696847, "uuid": "3cb96e6d-7d4f-4d31-a4f6-9b1877a4a383", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696847, "uuid": "5b7668aa-5f5b-4042-a110-13b9976e8f8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696847, "uuid": "544736a8-f351-4f4e-95fe-8ebc14bf4ec5", "value": "CONTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16283e24-e865-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626680642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680642, "uuid": "1ad177f2-15ae-4094-a45c-57087c16463f", "comment": "Malware payload", "value": "4c85bb3579782b726e9147c8267c7913", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680642, "uuid": "605ba309-3b34-47ad-94bd-724784f98b24", "comment": "Malware payload", "value": "0bdb9ace785947e65464550de3cb1e020c2b12374960480e75f62b6b0218f1ca", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680642, "uuid": "696e00c4-e8b9-4b00-bdd4-4f2d8b4190b6", "comment": "Malware payload", "value": "4c1c8d77fdb7d5585bee00d620297d4e087d3234", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680642, "uuid": "8dc024f9-3113-4d85-8adf-319eacfad92a", "comment": "Malware payload", "value": "6dccaa244c976c30558ba1be68cc9757b5c65d36c5cb4bfbe2b4a8696bfa2cfa7bb69f7cdcf6d6208fdcd3ef6f7342d8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680642, "uuid": "b6616e6b-1b21-4fc2-a32c-d0972c3669c8", "value": "T10FE3128B219A47A2E4854256F81EDE0FFD0761B886E0697C16178EE7FF1D48F047AC25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680642, "uuid": "12cce87c-fa8d-492f-9e64-e9f6c10c63cd", "value": "3072:Pje2Szr0eDXkFTzkmc6TkpyIJNQDGa7FcOKgpYNo8QbkXLY9HXutOdHsh/FBI6CE:7edXzDXkHkgmMZFcOKgpYNoVk70eaodb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680642, "uuid": "c0e527d7-a51d-4d7a-a283-9dbade5c7e4d", "value": 157156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680642, "uuid": "120d4c5e-7c51-40e4-9b3d-02bbf5ab44e4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680642, "uuid": "e1d0c564-0394-4c27-811c-4647ac39d1a1", "value": "order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de85567-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735845, "uuid": "ae78d8c0-c829-4b2f-8846-4c05941285bb", "comment": "Malware payload (Mirai)", "value": "bb9d0a4e4dbd92fe532d214f12fb2331", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735845, "uuid": "6b7db806-1f13-46ac-b9de-c4c5f105eeb3", "comment": "Malware payload (Mirai)", "value": "0c74317531a6462e13bf8396c0db4fa958687bd76709c3755c1e6c179e8c08b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735845, "uuid": "2655b8b8-cef8-4294-813c-6516aa5c84d9", "comment": "Malware payload (Mirai)", "value": "1161b2ce2ad742f60df6f8787764b5c3227dfad6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735845, "uuid": "bd415571-6a1e-4326-a1dc-ad238480cf39", "comment": "Malware payload (Mirai)", "value": "0981a7ccec1ec08729c9d2538300adb47785be45b1dd698bf3e2e3cf37d0cf4bcdb73927a9a08bea0cb7b4ee47f30603", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735845, "uuid": "8dd70339-8b43-40b8-ae8f-98fd65eac174", "value": "T17963A506BF214FF7DCAFDD3749A91B05258C640B21A97B397E34D828F64A24F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735845, "uuid": "a73e8409-b590-495e-a27b-7a3a93c45689", "value": "768:QxNCJ0EYlDYhHnrwqsFDwLX3U6ngBhN6PNUpGXS5SyeweVKe0n3oNWpkmPqXitMF:QxNCJBYlZFwwjhwPTXSNxIKzn6CpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735845, "uuid": "cd3b775d-6198-4055-a3a5-a2240ab970ad", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735845, "uuid": "a6b2b227-5b38-4eda-9fba-9f704faa8809", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735845, "uuid": "e12b83f8-899b-4d70-8d5f-a364e36c23e8", "value": "bb9d0a4e4dbd92fe532d214f12fb2331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b3ab68-e897-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626702225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702225, "uuid": "b7ae5dd7-0da0-44df-9be4-db7bfbaeb81b", "comment": "Malware payload", "value": "676f0aa6433d900313870d2b1167fb72", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702225, "uuid": "635ce4c2-b1e7-41b9-ab4a-91bbad6e54d2", "comment": "Malware payload", "value": "0deb51248fa5103572d01629d89e3e4982195b552afa355780028fcf021627bb", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702225, "uuid": "92e1bcd3-05fe-431a-9e47-b9fd1b7f94c7", "comment": "Malware payload", "value": "366b29a34b86041bdd80a8a3b8d545853b0d3a5e", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702225, "uuid": "45f96ec9-b567-442a-932b-6594eb3fe48b", "comment": "Malware payload", "value": "c1c8c36f9389fe33ca524fbb32419068e2702939d36ababc673063086b25466295655de4c42f795979402a4543518aa0", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626702225, "uuid": "de8bab12-b5f9-4fd2-a9d9-e66e3ba360a8", "value": "T192151242B6D00C71D7FA2A342C2B8204B95BB6C62A3CD60627E54484BE7576F773E35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626702225, "uuid": "600d14e3-9de9-4178-ba48-9fc819233d3d", "value": "24576:nyB1zXc6QiypdHcGaLSLmcbzUdIVvOMIxc7Xsw8hPeJ:nyXzsGO8KUdICpWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626702225, "uuid": "22078289-dc12-4df3-91a6-32f0feb57fc6", "value": 894644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626702225, "uuid": "a0c184d9-816e-4a2f-a87d-dcef5590e6a0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626702225, "uuid": "93431b53-8beb-405c-b14c-c9652d2078f3", "value": "log32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c450ef-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735823, "uuid": "8bd330f8-4c48-4dbf-a6d3-2c0b5f101283", "comment": "Malware payload (Mirai)", "value": "819bab835c8414f0c6db7975c3ad5bd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735823, "uuid": "eefe6dbe-7af9-4529-9773-1c5a6ac322b4", "comment": "Malware payload (Mirai)", "value": "0e603f668b3b6d8466b563dca274e337fca17cf4147b8040655f5ff62aac8d6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735823, "uuid": "9e81aedb-3e42-4049-abd1-2ab128f55e0d", "comment": "Malware payload (Mirai)", "value": "ed71800a01ceacc0042bf59c7475ccc9e6659e64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735823, "uuid": "1f95a7fc-52d2-4912-a4ea-b593f8de917c", "comment": "Malware payload (Mirai)", "value": "1aa2f4ce5a4f34eb5f2f9d8d5100f7f0857490472a662be7a2722b89f96e1629e90d0ff24b54f874c66c08b914d6f634", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735823, "uuid": "e2f40e40-8dae-49fa-8935-7f727093a2f1", "value": "T1DD338DA6C5BDEDA8C1544AB87D258F389B73E00086933EFAD644C65A8047EECF1593F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735823, "uuid": "95b3fc22-c14f-4d74-94e5-06f68cfbc9a1", "value": "1536:5aR5ewtQZut8GdcPs3q/aKlMLEm0DOFCn:5k5eDM2P+qiK60CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735823, "uuid": "4b31dcb8-8b90-47a9-a18f-222ca09938af", "value": 51336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735823, "uuid": "7d51a8e0-125b-42c1-be49-5963b03c0d8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735823, "uuid": "244eef17-4ca3-4781-8419-7bca0e63a88a", "value": "819bab835c8414f0c6db7975c3ad5bd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb09f6ec-e8df-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626733344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626733344, "uuid": "12bf02aa-9119-425e-8b68-b787db2af732", "comment": "Malware payload", "value": "349456ecaa1380a142f15810a8260378", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626733344, "uuid": "46c2618b-e688-43bd-a4d4-4db9bc0b1c17", "comment": "Malware payload", "value": "0f00c2e074c6284c556040012ef23357853ccac4ad1373d1dea683562dc24bca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626733344, "uuid": "b5db9a24-c17d-4cc8-bb25-a4d8b957716e", "comment": "Malware payload", "value": "02dd15ecdeedefd7a2f82ba0df38703a74489af3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626733344, "uuid": "22f2496f-543f-40fc-b5c1-b9bb86e67862", "comment": "Malware payload", "value": "f90d66a7336d842bc042b530befeaf85c1a3133087f5c33439e513abc23cfd43c46849340bfd5090695308574d3f8e2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626733344, "uuid": "f3c6bd04-5e7f-47ea-a5b8-8e35ff35b967", "value": "T184D47D06F243EAF7C4970570124BF7BF4230E6318412DF8AB6889D5AB9379F52A4E356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626733344, "uuid": "6cdb4446-b854-426c-aa6d-493a43695a89", "value": "12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrIT6yF8EEP4UlUuTh1Au:FBXmkN/+Fhu/Qo4h9L+zNNIBVEBl/91l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626733344, "uuid": "3d9a9546-c93e-43f0-aa5c-8b5c27bfc168", "value": 625889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626733344, "uuid": "f6b8ee56-4a36-43db-9b0a-b7d429b2c8bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626733344, "uuid": "b715ee33-5695-469a-8361-d9a0fc8741be", "value": "0f00c2e074c6284c556040012ef23357853ccac4ad1373d1dea683562dc24bca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ebc73e-e8a4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626707968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707968, "uuid": "5bb04715-39ab-4f6d-8643-df0cd878ffc6", "comment": "Malware payload", "value": "8cc4e94ce78d076cec99f5663d3650df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707968, "uuid": "c1caa67d-4d3c-4942-9ad8-402990983141", "comment": "Malware payload", "value": "11c918def783a81e623897abe4977610d51bda2bcdd71004ccf2c7e02a8258db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707968, "uuid": "e03d12c4-da95-4c01-a6c1-1199a8c0214e", "comment": "Malware payload", "value": "b275c4b4de7d148fc3a511162e4e55900fe7eead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707968, "uuid": "a3e8029b-ec65-4713-be0b-8f22cdeb4542", "comment": "Malware payload", "value": "c76c5315d6309ac3ce93bcd71551c0e851311df68af83b7242f95e5e26bb97af27d235194992b665e9bcd1d961e08481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707968, "uuid": "f6bef7ce-f566-4291-b252-4db8396abb6b", "value": "T172459D1873175F68FC3D43B6A0680414E3FABC03D7A2C96D3DE720E99A50FA59A61B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707968, "uuid": "21379a7f-f5dd-429b-a4a2-cac2e65113a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707968, "uuid": "69a5f4bd-1c9a-43d6-849d-1de4c5156930", "value": "24576:sOY8oXRvDB8fqzZTgnen8E+okyzOHtlla:sv8o1Wfqz1SA+opOtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626707968, "uuid": "50826d2e-8b95-4ff4-8fc1-8fe24e7f605d", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626707968, "uuid": "141a57f4-30dc-4e1d-a769-fbd68ad5d1b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707968, "uuid": "81eb34ce-9d3d-4c13-81d8-98ef57905886", "value": "PAYMENT SWIFT-Bank Slip.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9038bff-e8b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626716241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716241, "uuid": "a5086540-6e06-46ee-a8c9-dc1f0bc1a356", "comment": "Malware payload", "value": "1862bb8f0a0aa93cb30387bd2e9ae37f", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716241, "uuid": "95567e01-4d6b-429b-96bd-651af0bc6569", "comment": "Malware payload", "value": "1283d80c694913a2f496b9e00033569f1f9c8df333358bfb5b88fc243704807b", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716241, "uuid": "29ead8b6-7993-484a-a3e6-54143408497b", "comment": "Malware payload", "value": "5e902816fcff36a99d3753c0e3dbd8ab8269a2f2", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716241, "uuid": "c19d8a53-4773-40b5-b324-f47a46a2a47f", "comment": "Malware payload", "value": "21a7fd76062e1919889f80757a73f1c1549a11aeb6748e410aeed41b71616fa543a787f61660d5f4fd19cc48ad16816e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716241, "uuid": "b2657aed-803b-4cdd-a56f-887fa934d2d7", "value": "T147C4F18729021983FE7AA03C0FF4D85EF9BB9EDD274199DEAC45724E807D1DC058A4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716241, "uuid": "92c9d500-b0e0-48af-9d07-06076b18517d", "value": "12288:j1HB7lZLgYnexAoA0bzqmVOgBwsyrZzX58J8qypRX9ZwR:ltrLgYnexAoAQqFVO2phwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626716241, "uuid": "b2039573-1055-4fb2-92a6-02bfba05b871", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626716241, "uuid": "65cafcb6-4afe-427a-970d-a244b1a454a4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716241, "uuid": "9324b06b-3763-4411-967a-45bef076b61a", "value": "New Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc6a98e-e86f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626685295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685295, "uuid": "a1db4e69-a476-48d8-87ba-6a72bf209f86", "comment": "Malware payload", "value": "3ed5730d8b144e0dc00d144595e21551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685295, "uuid": "6cf0eb85-d88e-4d82-8406-cc3a142db535", "comment": "Malware payload", "value": "1440bff2b78dd4a3cd09e6463cb5e1773427bc87c73b82cadda166d4b5130b70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685295, "uuid": "3cef461e-55b0-4c70-a787-9db5790a179c", "comment": "Malware payload", "value": "165f0f32d5b8ace5b0835cf5d851c15f3f30aca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685295, "uuid": "8dea9445-e6b4-45dc-96fd-ff9b1a4b195b", "comment": "Malware payload", "value": "95219b47174dcae175aa4feb6b51571e1c08bb517ff4394565821362945414954a84415940188d1013b7a0333bb60525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685295, "uuid": "c6648758-245e-4f1e-bfae-dbeea80eb2f0", "value": "T13D159D6C324075CEC4278E3389A4EC71F6906C66470BE90758E77DAFBABC657DE110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685295, "uuid": "e5c81ea4-49cd-444c-9400-4455647e467f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685295, "uuid": "90e61aeb-bf50-45a5-8d77-7d6e96802bcd", "value": "12288:p3YqCggEzZIMRXq1dt3EVT6ia+TorMLCJDnxjtaH0loKW5RwCZ055ZIXWTB4:4zsZ21dCeVJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626685295, "uuid": "9fd76291-a693-43a4-b301-0bca290f8772", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626685295, "uuid": "9b1411db-9979-428a-b664-98632a454542", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685295, "uuid": "0eca68e3-89be-44f3-8ea8-61c702bc1171", "value": "invoice copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad6019c-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626708943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708943, "uuid": "204e7472-2eab-4a5c-a461-4599f3929e11", "comment": "Malware payload", "value": "facf63137dbdea9cacefa9ec4daa3f00", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708943, "uuid": "e55786e4-46d9-43fc-aee7-0fce37d38e1d", "comment": "Malware payload", "value": "15becbaa3657b788030771ccb6072e63f14728533aac9f1dcfe2cf89ebdac51f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708943, "uuid": "5c8a2266-9c44-43ac-9b79-54699bd95922", "comment": "Malware payload", "value": "eb63911b6cee65a41d7b5493bf2c30ef60b78800", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708943, "uuid": "a0a8c20a-5a25-4da9-a37d-279e2c6320ca", "comment": "Malware payload", "value": "7e392286fadad9d725d52eca41f43f7d3452b530ab06ae0a68027b1afbcc454e04028a64986171a3851575c6a0653e72", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708943, "uuid": "a7769ef2-a11b-4ab2-8888-38c50e89bc0b", "value": "T14BC2F906F3E8C126E6FE8EB9ACB5021807B0B627E521D75E04D914964B33FD69143BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708943, "uuid": "403b4313-3ec2-4538-945a-3c9108e7eb5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708943, "uuid": "8a39cda9-a701-4185-9933-fc00ff5ebcec", "value": "768:LKevRRStulCQzYX26fmYJ8Yc0CpzhPK7CxPn+G/KCKL:LMJuRZlKOnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708943, "uuid": "79e1eeb5-8881-4b53-a183-de5efe8d739b", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708943, "uuid": "40bf5b00-de92-4847-87f4-973612146fe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708943, "uuid": "02f9cc21-e5b2-436c-8183-416fc5791c60", "value": "LnTJWyNn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe343315-e8bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626717968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717968, "uuid": "4eab948d-6193-4e48-b8fe-34f0c0cc1c54", "comment": "Malware payload", "value": "432f0e0aab658de046d8b41d2cef8253", "object_relation": "md5", "Tag": [ { "name": "Astro Grep", "colour": "#41DCB8", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717968, "uuid": "b416501e-8763-4be6-860b-860d8b2290b7", "comment": "Malware payload", "value": "17d1c0045155ad9c523c07e0f37aa16cd036915f38b73090d8d8ba930db149fb", "object_relation": "sha256", "Tag": [ { "name": "Astro Grep", "colour": "#41DCB8", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717968, "uuid": "d3df355c-2ec4-4070-ab05-1d2928122e75", "comment": "Malware payload", "value": "7ba5b175ffb4bb976c54177f9c40a7339a088654", "object_relation": "sha1", "Tag": [ { "name": "Astro Grep", "colour": "#41DCB8", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717968, "uuid": "24302215-63e0-4b12-abbc-67c216e54259", "comment": "Malware payload", "value": "b94f81b35caad93b396368e084af211b59f5db891171c4de6015b7b520f929f77ef8eb282750754888b51af4c7feb9b1", "object_relation": "sha3-384", "Tag": [ { "name": "Astro Grep", "colour": "#41DCB8", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626717968, "uuid": "741c11c4-ac31-47e1-8975-7fe3c2acf7f5", "value": "T180233C003BE9812BF2BE4F74A9F23245857BF2673502DA4E1CC442975B13FC69A525EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626717968, "uuid": "f087301c-5fcd-4326-9104-e3b06f158e32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626717968, "uuid": "23671e38-8f88-4714-a26d-53d34dab6e16", "value": "768:quCFNTAolrhWU5TeLmo2qrJW6K8e2gaM9PIItc5pIX0byDBm1ERjvmFq+YBDZsx:quCFNTA2G2d6K5aM6Itc5pIEbyAqRzyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626717968, "uuid": "95082786-e456-47c7-a453-64e3529a0634", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626717968, "uuid": "59961ddc-e1a1-47f7-8d61-9c25d4471032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626717968, "uuid": "e0f809cb-cc4d-4dc1-b630-13e787df586b", "value": "ASTRO-GREP.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbab2b45-e87d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626691281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626691281, "uuid": "7e5a2f05-5b32-42b1-a073-0ea8dbed5be7", "comment": "Malware payload", "value": "12f91295b63310efc5458a93edccad6e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626691281, "uuid": "b56c25d9-06ee-4f27-a9de-f3709667a9a9", "comment": "Malware payload", "value": "188b9ba067cd7ce1f5bc1798f838ba2887292a0afbfcc2ce708923f2a443adb3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626691281, "uuid": "d67c7762-4bf2-43e2-a813-79e103b61e9f", "comment": "Malware payload", "value": "28fc6d5444fa3ed8bc9f2978a345f7bb03a6f8b4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626691281, "uuid": "9f9e434c-713d-4576-bf71-c59336a5230c", "comment": "Malware payload", "value": "9bee1b258f13d17d233f1ac1b3b9d42880fe6a49ad4bed4a94b1e50be2a26eab09d83bc5c708daec293062a341055451", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626691281, "uuid": "3379c5c7-6bce-48c7-a85a-57a92617b289", "value": "T1C0B423B9214B65F860146FFA7A7B3AB7EA3901B11DE70B83B65715F82504E7030ED9B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626691281, "uuid": "2a7e3d09-81ac-47db-8d3f-3219eb142eb3", "value": "6144:EjWEe8+lXulnsjUAzfrBlA7f/UBphYEgvChGQdwaGxkFskMV49t4x5cDUl/nnVQY:hE1IEgfVBnYd8Gih0EtcpnVQhCsbraOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626691281, "uuid": "ea9d18a3-a347-44da-b7ed-19f812aadb6e", "value": 526884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626691281, "uuid": "c3b3355e-d5a6-413e-a0ae-f13216d2bdc0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626691281, "uuid": "7a32eee7-f9d0-4a04-9aab-630d5f0da008", "value": "Nuovo ordine .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627443ad-e83e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626664020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664020, "uuid": "878aae1c-60c7-4e05-9256-a28af25ffcf2", "comment": "Malware payload (Mirai)", "value": "dad721da7c429de8bc412c33a1354651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664020, "uuid": "0ef424ac-714a-4735-a361-ac4b1bd9e6f0", "comment": "Malware payload (Mirai)", "value": "189d5314ce773d4497cd2c8aacc99f939bbc32c188d9db8a09e12005ae6e2b44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664020, "uuid": "4946844c-2e53-4e1e-bf0c-9e7300704a22", "comment": "Malware payload (Mirai)", "value": "9e8747675a2d257e581cc9cc7e55a8530ba536e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664020, "uuid": "0fee5534-90f1-454f-be92-9a67f4bf6215", "comment": "Malware payload (Mirai)", "value": "3c9b7aa67be39e37c88831c6d8a34a6f39de376b35f315c205257c7ade35100c7a385e3d894cefafb4d1a2942d7b83bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664020, "uuid": "fd6f05d2-6e5e-4207-a5a1-b61d9c76b8d7", "value": "T16E63022AE6530EC6CF4942F2C63A9DA46B1E26C1DDCE16E0151FA366109D707EF645C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664020, "uuid": "dc2a6df6-beca-4211-8bd3-bfaefb4b089f", "value": "1536:F/W8WnbSdZjDuRad6vaOQI11SAts/UHai/a5lgL:byqYaAvaOQ+Sz/U6IsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626664020, "uuid": "59fe0e04-c35f-445a-bc08-7b818826d293", "value": 69660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626664020, "uuid": "3167f5ba-f6f6-410d-83b1-b1cf8d059d84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664020, "uuid": "d8a8a6dc-7742-4618-9289-ff1c93823245", "value": "dad721da7c429de8bc412c33a1354651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978be764-e894-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1626701046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626701046, "uuid": "b981dfdc-8e78-4ea8-9b8b-6dd0ba764afa", "comment": "Malware payload (ServHelper)", "value": "ddec83ecea8cbbe61b6f2d9534b5a828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626701046, "uuid": "7575aa8d-984d-466e-afe3-1fd393c13b47", "comment": "Malware payload (ServHelper)", "value": "1920244ea95361df3053e49c5b05d7fce99d87af60051cbc155b1cd5bbca9957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626701046, "uuid": "45e86486-1e8c-4f65-92ab-35d00c8d0033", "comment": "Malware payload (ServHelper)", "value": "2472cba04e80add4a3bf10b041fad1942d49f5ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626701046, "uuid": "a784ea68-0f27-491a-944e-10435c208531", "comment": "Malware payload (ServHelper)", "value": "772ab17d389960fb4536e4e738fbcae7b0cdfda605c71b182746a741a0af29cb4b91ca8a43db413c93fb71037d45e132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626701046, "uuid": "f01bc6c7-a722-47c4-adf1-85238bf1a331", "value": "T16D56F002FCE214BAC57AD17084569B617A313CA483367BE72E94B5A92F75BD02F3D324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626701046, "uuid": "bb800c65-05d5-4ff9-87b9-89efc59f6568", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626701046, "uuid": "e4377290-554f-449e-a6b3-341fd5b61ba6", "value": "49152:tu+ne4aWsWg5/a5dFBPiD0VwwvbmMJbqq2zqWPs76UiWiPgvykciD/xv551Qx5bW:ts4aW6/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626701046, "uuid": "a57466dc-5cc4-4fcc-9037-2a63949922f3", "value": 6329856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626701046, "uuid": "d5e204fc-5a1e-4a02-8b33-81d8c81bdfdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626701046, "uuid": "acc45cf0-f1ba-49e7-aba3-34c3356b2cc6", "value": "ddec83ecea8cbbe61b6f2d9534b5a828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a592b1-e8a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626709176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709176, "uuid": "5e4af0c6-5971-4b7d-8c9f-c17427ee1b49", "comment": "Malware payload (Formbook)", "value": "6d5ef38c928715d84453b55395976428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709176, "uuid": "fc55eb7b-dd60-4fbb-80f7-071d60d220b0", "comment": "Malware payload (Formbook)", "value": "1a222b6d3a94cd1c8447b52f150e6d7dc20842da0d2e81ccbd0d6ecd5d01f59a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709176, "uuid": "66a71633-7fd0-4676-9337-6c77a53e06b6", "comment": "Malware payload (Formbook)", "value": "639ad90723c7e0473d320cd308116eada0f41d65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709176, "uuid": "2d531261-b7e6-40f3-81cc-3e5276cbfad9", "comment": "Malware payload (Formbook)", "value": "b38e576ccf0846ddc8f6ee696be7ba6b05bd750b7cf24b801240a00db5596bcbf55d31b9e1b50fa31a1c8b5b82f189c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709176, "uuid": "5a9ef43f-b3aa-4be7-9694-2c3e281495cb", "value": "T16A0402142B3FBF2EC07CD0786C61306F49B95DB7799F1AEB67496B1083816C12A98B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709176, "uuid": "cfb6d6ce-9c81-4be1-8915-c6e953849cd3", "value": "8b9c7c9498a635f685c3b4d13969793b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709176, "uuid": "21dbc69f-952c-4443-b124-d39d39dd433d", "value": "3072:EiwBxfa5UOPrDvotY6lf6Js2OgJgt3pjl0yvdPRWeSbep0yBH:EtBxy5XrMY6Z6m2OgJgDOa1ESl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709176, "uuid": "bb343f03-d855-47a0-8a6a-473c91bf8137", "value": 175808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709176, "uuid": "d512cdd9-b44a-4e1c-8634-c5ed1370233e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709176, "uuid": "fe0b258d-d6a1-41f7-9d7e-470f92a1c9e7", "value": "6d5ef38c928715d84453b55395976428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef439ab-e8e6-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626736277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626736277, "uuid": "187c0667-25d8-45dd-b27c-6d648780c0d3", "comment": "Malware payload (NanoCore)", "value": "3e34330994894b86a9ddb3c57515b20c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626736277, "uuid": "224e5e23-8409-4f1f-8aac-e2db561a3ec3", "comment": "Malware payload (NanoCore)", "value": "1a3736d0a59836c3feecb448a77c4ab269dbd29df9de58ef81070129e248eb6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626736277, "uuid": "945885c6-c418-4cf0-b6c6-4cec4fbfa38c", "comment": "Malware payload (NanoCore)", "value": "911ca34e73efd1fa6eef4f9c4e2a455fdcce4a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626736277, "uuid": "a02d81d8-5280-4b63-9be0-283c7809692e", "comment": "Malware payload (NanoCore)", "value": "4ecab6ea6f76e0a6c36c886436d5952e3c0a0b7f815a3c7b4059247027ed28f9b656a8fd1c61f41ac6d205855c9f3828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626736277, "uuid": "96a53171-02df-45d2-8f81-b521db0d46db", "value": "T156751212F6C15871E6611A3674295630253BFEE00F358A7F53AC1B4D9B73D82AE31BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626736277, "uuid": "bec21b89-01d4-4bb2-9b40-c95972b55ba1", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626736277, "uuid": "a399dfac-7342-4e65-a039-4f053f90f08f", "value": "24576:zDWHSb4NBD+GVFGhSvqYreqcDWsn7/oi9xqEEvoLlc3CQpMiLulatHTK/CTZu0j:O84n+GVFxrefbhqEEcZQpMaNges0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626736277, "uuid": "df015372-5c0d-465e-b002-94460ec6149b", "value": 1555651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626736277, "uuid": "65d8b2fd-9c11-422f-a234-459529e6acc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626736277, "uuid": "7f67f59e-bc2e-45b3-ae87-f6bb72a64325", "value": "3E34330994894B86A9DDB3C57515B20C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e545b1e-e875-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626687662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626687662, "uuid": "24e7c7e6-f29b-462a-bc04-d40b02cf5883", "comment": "Malware payload (Formbook)", "value": "ecd258238b86f2a1d9981f36c8725c44", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626687662, "uuid": "05f7d328-727a-449c-a90b-454f0e6d84a5", "comment": "Malware payload (Formbook)", "value": "1a5818fbaaea2fb0bf9a307576b01837fc0bf6963c727839768e0dccd67cbb97", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626687662, "uuid": "424045fb-8e00-407d-a995-a808f2b820e7", "comment": "Malware payload (Formbook)", "value": "1b63c2131d0b7063c1c651f6a0e4af6f48444fd5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626687662, "uuid": "d75b68d4-a2d8-4b8b-bd85-4894e43e3b15", "comment": "Malware payload (Formbook)", "value": "b83539b60e0b46d48cf71040e08ae3e50ddf9ed4ff8adbffcf100e01f7f7c6134ee40fee36a78c22bbd13a4843a9406c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626687662, "uuid": "3177b1da-b004-4a94-acec-9d9b5d5f7dbf", "value": "T194E433A14112A3722D2724AFDDC63A9D72D8C44CF9AB44F46878F841BF12F3356235B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626687662, "uuid": "39053518-1b25-4208-a9d0-8a5e7fce7ee0", "value": "12288:AKmVtJ+bfRQvgPJBSk0FpRWg0NJxoH0tc8C3LyQdYbvJ/zXheF+p:AFoPJck0Fpo/zu0tcn3LSvJbXA+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626687662, "uuid": "30212081-c329-4c76-a732-81acd05c2e42", "value": 713158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626687662, "uuid": "e577c2d6-11b1-4e07-b479-bdd09dca38ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626687662, "uuid": "79912512-c2ba-492d-a893-ed13d9e3a4a6", "value": "Electronic_wire ENQ2021PDTCA27 Confirmation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7942c47-e864-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626680483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680483, "uuid": "6e23f29f-b95c-4621-8605-1ae68a0fff72", "comment": "Malware payload (DCRat)", "value": "071070f090c360df20d552bff290f98a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680483, "uuid": "6ba8a7cd-af09-4c62-a9bd-e0ba709aeb39", "comment": "Malware payload (DCRat)", "value": "1bf07924cfe39aa003047cc03bcd94b3b7f8b7256688da75cc622b17e546f43e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680483, "uuid": "362fff70-ad0c-4725-9a42-02c68bf2bc7d", "comment": "Malware payload (DCRat)", "value": "a64ffda21ecc53731c68bafb675f1503c1493aea", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680483, "uuid": "68ad5c62-f321-4453-9acf-e284aad94497", "comment": "Malware payload (DCRat)", "value": "8a7a7c0ea148b146d3064401852ca47998f85dbcffd74172c394171fb2706e1963726642147842e4e7825161ed6d4b96", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680483, "uuid": "8e4f0db6-977d-49f4-8d23-04d08d350ea7", "value": "T1B23518027AC4DD21E0291637C9EF442847A8FD027B62DB1B7EAF3B5C64163A75D0E5CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680483, "uuid": "202cc606-4876-4d58-9d58-28d0d029d1d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680483, "uuid": "a778f9b1-dd57-4ff0-a33c-ffe0c9077f6e", "value": "24576:IYvhk8mtcbjQe0cjg+nufbNfLNsnop+4:R+W04184", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680483, "uuid": "e5e657b1-d85d-4617-9315-f4850c741b3f", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680483, "uuid": "f8839922-5f19-4e58-9a85-0e7ce669fee2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680483, "uuid": "7a481b31-163d-4b0d-97e8-14eeb81acf22", "value": "071070F090C360DF20D552BFF290F98A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2844d7df-e835-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626660057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660057, "uuid": "1918bdfc-d115-467e-9f46-8b0b6daa4cff", "comment": "Malware payload (Gafgyt)", "value": "a12f0d60894e7e9d05efe9fdfe6956f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660057, "uuid": "94af0d03-f1ff-435c-9f82-7e484519f3dd", "comment": "Malware payload (Gafgyt)", "value": "1c06a43d9e8cb960c8c41e70f8be326e7ecaf8ea8d2d2c068dab5e23fb6d6689", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660057, "uuid": "77d24e8a-bcff-4230-babe-bbb7764d52db", "comment": "Malware payload (Gafgyt)", "value": "b611d4656f7a496926f8e0fae6d9db167a8348ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660057, "uuid": "39cc84de-166d-41a0-a9fa-36f27a93313b", "comment": "Malware payload (Gafgyt)", "value": "29d7ad45bd977c7b3de19e1f29d9eda7390ec7e1e3354d555b82d827ead154727ff5bb8e7ef93c3a2b3f9c4c4baecaf6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660057, "uuid": "1bda4de4-3980-44bd-bc09-8d81cbdb3cf8", "value": "T1FCC3D63B27170E23C0CA10B101E74332AEB5DF9B34B95297AAD07D686F366943856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660057, "uuid": "0de3389e-e86c-4a2f-8310-d0e53841fdb0", "value": "1536:GBb/yJmzyoT8KYj1ZkcpN95VZTtf1ztiWMcBxV8VAQJ6mmi4QMurzF1nLGGNb:ZHLjTtpNPVtYWJnVmm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626660057, "uuid": "c06d381e-4844-405d-bb8e-7c428f645812", "value": 129312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626660057, "uuid": "5f4d6eea-7d13-4519-a559-17d9e5778a79", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660057, "uuid": "3cfe2bc2-0e77-4f3c-83d2-c5caff2c88f2", "value": "a12f0d60894e7e9d05efe9fdfe6956f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebbfbaf-e8d4-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1626728438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728438, "uuid": "849d64cf-405a-4aec-9942-b21040628e1e", "comment": "Malware payload (OskiStealer)", "value": "1237f369ec92c5687259e97d5c63e8b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728438, "uuid": "dfff6ec2-e178-4d30-8d3a-35290361a8c1", "comment": "Malware payload (OskiStealer)", "value": "1c4ec1ef14f5198854fe7079a278c2cef82056410b2ccc882b820f84422e9257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728438, "uuid": "6921380b-e41c-4453-adcc-3ad0eb9cc6fb", "comment": "Malware payload (OskiStealer)", "value": "bb7a9b1dd81658a8de1a1408cdd94a2bc6685678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728438, "uuid": "4c92afe3-d987-46b3-b037-74097ccddb23", "comment": "Malware payload (OskiStealer)", "value": "9a9a2f171842967cc40a421c3b58b662efec458cb0db082ac1baecd3500f80fb130969895f06fd3fe21b42c2644aae6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728438, "uuid": "3a80bb0d-b77d-4657-bd70-a6d4bef0d152", "value": "T138146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728438, "uuid": "35f771f7-e37c-4ab9-9fd1-b5c3383037ce", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728438, "uuid": "716346ce-43ad-4643-b96d-0ef0fdb1d57c", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIV1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNY1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626728438, "uuid": "3d93b8ba-ae96-4532-bbde-4da3600fe6f3", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626728438, "uuid": "1a000f72-2ce5-4584-af22-90f650c715d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728438, "uuid": "b7ce441e-8c7f-4050-b2fa-a7f52be1fa24", "value": "1237F369EC92C5687259E97D5C63E8B9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b054e3c8-e83b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626662862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662862, "uuid": "2cb2c837-f7a8-4b22-81b4-5da88c00b80a", "comment": "Malware payload (AgentTesla)", "value": "7a15c195fb598e46a7d8ecef14ee24ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662862, "uuid": "dfff9cd3-de85-4344-afaf-f9e87191d258", "comment": "Malware payload (AgentTesla)", "value": "204591aa6d44da7eef69d7ee3d32a9b4cb8e405a575fc3cbcf2d5e0217879cb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662862, "uuid": "b72a8b68-aac0-4d30-bfb8-b2861a35541d", "comment": "Malware payload (AgentTesla)", "value": "670daee05f85f7c30030bd12ae6dbb5c5bcce1cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662862, "uuid": "520700ab-7bc9-48af-ad1a-c9d353275763", "comment": "Malware payload (AgentTesla)", "value": "d0e9c365f24a8744e13e0433ec7239059973c9dcf5660f12829fb7bdd12ffd82b7a5f8191e79c33747fe6c3b829cffe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662862, "uuid": "1e0fe43b-41fd-47e3-b365-97ac495882de", "value": "T1EF059E9C324076CEC4378E3389A4EC71F6906C665707DA0758D77DAFBA7CA879E110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662862, "uuid": "038106c5-c424-4e8f-b49c-9a24fcbf92e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662862, "uuid": "335ab471-c9f1-4058-823e-5f6ae30abbb2", "value": "12288:oTJU9zZTsvdtjZX1BAc8D5Dv3wMoKaQH02NsCo3KLqxfy+vxkxNSLSsJ:oTJEZ4bj9A5D5jVD9H02NRuKLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626662862, "uuid": "b96174ab-c798-49a7-bdf3-a2977a2be9b7", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626662862, "uuid": "2b443fcf-cf6e-4d57-b59c-36f15535ee1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662862, "uuid": "9b0939a1-d7b9-47b3-87bb-e6c982978ad9", "value": "SecuriteInfo.com.Scr.Malcodegdn30.14111.32457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2139803-e880-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626692500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692500, "uuid": "e79d20a5-0d77-4680-a6dc-baf0fbf1966a", "comment": "Malware payload", "value": "463da2ea96c5d11ae4f5f2bdaa887087", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692500, "uuid": "301ac33a-5713-475a-9d1d-b9bedc3d9c95", "comment": "Malware payload", "value": "209caaca181a8f73a03b62771f81ae3e07d25aecac6e64dcfe0cf780a056b7fe", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692500, "uuid": "4a868b2e-5f98-492b-9781-f0fb8f392f6a", "comment": "Malware payload", "value": "bdfc3f99529b93330a6ead6819a119bc740edfbb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692500, "uuid": "6f3f88ee-e151-4214-aac0-4fb1333cc070", "comment": "Malware payload", "value": "4b75e934da086621750a55b6545daf2396b6a71afcd243d79ee845584ecd853d1d8513fa96563e3d0d29757e9c76aa4d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626692500, "uuid": "0882fd0e-97b5-426b-aa88-22c9dfc6bbac", "value": "T1F8C423CBA4A7E88E74376E8532ADC32059951C2EEA656E38B42F30D35D4F284B3F1571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626692500, "uuid": "d1cd001a-d1d3-41ce-80cb-da45d27f9449", "value": "12288:cRPGjpAK1O6cgNMDAI/0Z/A2M4OdgcHzzv7xw3stka/4w7Azh2ADliOU:cRPMjcEXpM47cHzzv7t5gtzh2ADl/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626692500, "uuid": "ac2100c8-891d-4a53-88cb-22a31118befa", "value": 577372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626692500, "uuid": "984f749f-a727-4ea1-bd74-421a7094bfbf", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626692500, "uuid": "511d72d2-9f6d-4877-a433-4933cc5d2463", "value": "87597.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11978a37-e840-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626664743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664743, "uuid": "a315fbeb-5276-4f28-acbf-59c48db9b43b", "comment": "Malware payload (Mirai)", "value": "ba521548815820ce948467df0b3e4481", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664743, "uuid": "c6f74f8b-34b7-4b4e-a72b-d53b635dbc72", "comment": "Malware payload (Mirai)", "value": "221629ff182ae32bea09c2bc6060a0f498f739fe7b29a9dee5572e373f772539", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664743, "uuid": "5ae99e1a-1107-40e1-8393-56ed3ec7b327", "comment": "Malware payload (Mirai)", "value": "2c5ccc99963512df332cc06253fa09e4025ac355", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664743, "uuid": "b577126b-1a48-4a57-8ae5-551bde298f9f", "comment": "Malware payload (Mirai)", "value": "01963036deb98797e7128fa665a17b32b86b8fdb89b42fe753a9b301241d31fadd6d025c05fbdf19d8d405db8b7c1e23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664743, "uuid": "443d911b-f5cc-4120-94af-bf4e34e9fe12", "value": "T179936B22BE3A2E13C0D2747B61B74720B1E257CE35A8C71F7D720E4AAF686502517A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664743, "uuid": "82740176-201f-476f-a2dd-a97d93a86a4c", "value": "1536:vhuSyE53i3a8xoLIgvlfvjTc2N8UdosvW9O6WmVfiV0oF7:puCHgK2+xtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626664743, "uuid": "c8b52432-c67c-4741-a933-dee64de4e54c", "value": 93112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626664743, "uuid": "a90de49b-1158-4f46-abb1-14b6701ea083", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664743, "uuid": "49dd23f6-b9fa-413f-a2d8-6eae14c27191", "value": "ba521548815820ce948467df0b3e4481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85d4c0a-e893-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626700752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700752, "uuid": "300a7c41-a2ff-464a-be2b-844e339cec80", "comment": "Malware payload (Formbook)", "value": "1cce05c8a0f6e395073718aae762ceda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700752, "uuid": "074da61c-a550-4e87-98ab-55b82ec203b9", "comment": "Malware payload (Formbook)", "value": "226b86760e9d055f5d5bbb414a3b0daa69fad524622b2b5a41f044a8c7a210b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700752, "uuid": "46b5631e-8e46-4b80-9a58-2a0f22b1c051", "comment": "Malware payload (Formbook)", "value": "6c3cf0f5b06f7969dd8c8a658d198729b2fea854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700752, "uuid": "fd43d70a-3ed8-4510-a121-9236971f9dec", "comment": "Malware payload (Formbook)", "value": "9cc112f354c6f806ab6d4b47fec3b50febad253c753c24eee4fa8dac50a97bdd482185ae2660587bcaef32dc4409aafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700752, "uuid": "7ea2753d-87ae-4b96-996b-b4f93958cfd3", "value": "T17E15F122222BA144DC7883F51C39C1B16BBE6C2A566DC77C2EC8AD7F7DB227C5AD0541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700752, "uuid": "db6ec42b-a30d-4506-b883-afeb0caaa4b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700752, "uuid": "5652ffbb-06dc-4f77-bf6c-7231af35fd43", "value": "12288:EE5ayvUIZbVlBPI2VBP0kaY4PG+CXGbliQlIpqmXU6kiBfTvQe:VvDBlBPIOBP54PGlGnIpqYX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626700752, "uuid": "14f587e3-35e3-4de6-900a-8018b9b099dc", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626700752, "uuid": "1761daba-6ef5-4daa-9d58-26d281ef5ce0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700752, "uuid": "3860c210-bf99-45a6-b22d-14c9156471d7", "value": "pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d900049b-e855-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626674097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674097, "uuid": "080a3752-789d-41b5-b2d2-a251816801fd", "comment": "Malware payload (SnakeKeylogger)", "value": "5b87572e958972acd5a11b414fc6fadc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674097, "uuid": "0ae5604f-2143-4d59-8aec-60369b677e21", "comment": "Malware payload (SnakeKeylogger)", "value": "25f255928492775b77841008191950270dede41fc97a1011e3a8be395d5a3a7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674097, "uuid": "dfbef95f-a6a6-4fdb-ad6e-3accfa71a64c", "comment": "Malware payload (SnakeKeylogger)", "value": "bc6af1efd2082310800ecb7bb0f6d1c62b348202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674097, "uuid": "a7a9bcba-8ece-42f9-9779-ea30f0c43d9f", "comment": "Malware payload (SnakeKeylogger)", "value": "fc924631a59e58fa208e436f836d0d88c7bd6ce13692008a9c8d2c46c5c235b851eb7b223f02decef361f72677f1e392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674097, "uuid": "7b9687a3-7959-4a68-ab65-b707fc43c813", "value": "T15DB4383439FA502AB173EEAA8BE475EADA6FB7733B07645D105003464723D41EEC253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674097, "uuid": "9260024e-dd0f-4ca0-a7f7-78098ab36332", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674097, "uuid": "db8bfe5f-5863-460c-8542-9755f8daf005", "value": "12288:QNZc3tFNiKnUH7PrjSzKkTFSvhjd/EzhnZSRVoVrNxTmXyvhKL9gK9R8HE:t4UIo9ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626674097, "uuid": "29e48621-72c1-487f-b09d-c2f75976b3f6", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626674097, "uuid": "ea5a79ba-6d99-426e-b6a6-d95e861092a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674097, "uuid": "c42f3df4-e3f4-4dee-8fcb-f298ae0cf07b", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c55b5ab-e8b6-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626715603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626715603, "uuid": "4baa6625-53da-4690-b156-d3fa573ad1fc", "comment": "Malware payload (DanaBot)", "value": "9a4a6912c1c3b454fadb56a59c23f068", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626715603, "uuid": "a261c3ee-3d49-4882-91a6-08d01585617a", "comment": "Malware payload (DanaBot)", "value": "2628c0e7347bd706341c56a0fbe0574502dfa01d20efa2bad39c98fd48e1e4e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626715603, "uuid": "671990d2-468d-4cdc-8b73-8ab2726131a5", "comment": "Malware payload (DanaBot)", "value": "49298cae3c0945e5bdb016010a913e60f5bf163c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626715603, "uuid": "eb582258-3ebf-4259-9ac0-1919e002b8a2", "comment": "Malware payload (DanaBot)", "value": "359798a12f4be54d55bca1446015743a9badecc7291a6a9af005331483d8aad5af10a6e0ff1a34f6f909f753cdf1da50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626715603, "uuid": "48ebbeb2-d7f1-467e-a317-6632709e9f88", "value": "T1B5352310B9929833E8F2493424F5D1A62C3FFC31297A9A4A76C876DF3E720C1A59D753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626715603, "uuid": "a6ab5dec-9d86-469a-aa20-3523a73ce5bd", "value": "60dca3ce0efd49409d1dcd0dd66924fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626715603, "uuid": "49548f33-ebb2-4f51-9c6a-cb43ad34b693", "value": "24576:HShtOSlXIRtKmSiCd+3shLqVAe+T9nnSiZmy:HSrqVSiCo3oo8nRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626715603, "uuid": "616bf94b-f792-49a0-b4a4-d7bd143187d0", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626715603, "uuid": "cecf301a-933a-4501-a017-7fb613ba3b6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626715603, "uuid": "3420168a-a97d-4d5f-8d60-bfd352723085", "value": "9a4a6912c1c3b454fadb56a59c23f068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8b26c8-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626735657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735657, "uuid": "81c6e638-6889-442e-a6c0-c65c3da73613", "comment": "Malware payload (Loki)", "value": "4391a1171f5d84bc2dfd22659477cd8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735657, "uuid": "2f90453b-7173-4614-ad1c-fc87a3d2a455", "comment": "Malware payload (Loki)", "value": "269f4d17d4d613d6d23c3e96da17ee29cd8b10d95bbceb89fa433060a53e4620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735657, "uuid": "0df5eb03-adb2-464b-9c24-01d3334793bc", "comment": "Malware payload (Loki)", "value": "1daf6d81663e5cf442ce4d11e274bb837308e35d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735657, "uuid": "820de6e4-f9b8-4888-abca-68839526a66e", "comment": "Malware payload (Loki)", "value": "ebc65b2b4ecab5eec867e623d47c85660292882e7806d1fd25b063890aabfadcdcef132e1ad87200e1aaa5bf936c9344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735657, "uuid": "7284a7d1-3537-403d-9f19-ae9b220d33c6", "value": "T128257C64236B5F58FC7DA3786038001853F4B907E369DE6C7EE610DE1A61F858EE2B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735657, "uuid": "b2078948-0acb-488c-9834-5e0211f29d8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735657, "uuid": "f1dc0d70-6484-4bae-93b7-cf0ad54e6852", "value": "12288:hlvSleDTeDXNemX4exeTgeL5pG1wYnHP4EEyvUIZbVt73FKsrRPwQkliDbiRbnAs:HSQsnHA0vDBpAORPRkliniRn8+ZFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735657, "uuid": "5bb63349-c145-4390-9129-9722bfda21af", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735657, "uuid": "80659455-dd08-4519-9854-7001c127b207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735657, "uuid": "79cc0565-7159-4aed-85ab-cf82a57b4b75", "value": "Payment Advice Note 20022640 20210610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bcc9ffe-e86a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626682853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626682853, "uuid": "ae6f25fb-713a-4808-9e3e-153d9a509854", "comment": "Malware payload (RedLineStealer)", "value": "a25a889dfd6998dcb3cf1ce7b1260d33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626682853, "uuid": "b45410be-7f89-466c-8183-7f94cef7a893", "comment": "Malware payload (RedLineStealer)", "value": "26c5f491edb4bd69fc3e3c4f0868d45c922ec58c7d5f465c070f891766879b72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626682853, "uuid": "c3c4fb13-0cd1-4c88-9508-9646562c2728", "comment": "Malware payload (RedLineStealer)", "value": "52e151b57d8220d274060023c6704043bc61bbd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626682853, "uuid": "f7310cde-2131-4e67-bfd1-3c878ec5ff6f", "comment": "Malware payload (RedLineStealer)", "value": "d34a3438c5c59c31f6484a7853c8b28d3dd2ccfe5a81eca3df40fab4ffa75eb81d0c163b39680d831a81a4cb852d6317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626682853, "uuid": "ebef079b-a7cd-48b0-b217-241942678e56", "value": "T19214C090B1E0CC71D9B225325974F6B91D2EFD762B50AEE72318313A8F381C19630E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626682853, "uuid": "8b0bce2a-9092-452f-91de-ce0fd34762c5", "value": "8d36f6a979fb5de10175121e64553b84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626682853, "uuid": "96b0bfb0-c057-4d75-b683-9f52ecce6c5d", "value": "3072:IIUjxorKkhwvR+FGsc72KD7uT3K0nNqzFzNFNoZ8YVmzZThhnk+8GleIlicOmLUA:II0OrMsNyuT3JKFipVed5kElRCCt2GPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626682853, "uuid": "8caf0dec-642d-4816-b50c-dba908b584a9", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626682853, "uuid": "d929e9a1-1796-4a94-a5d1-6a6bfb8d4439", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626682853, "uuid": "b24560dd-a5e7-4551-b07b-e41d10535c2b", "value": "a25a889dfd6998dcb3cf1ce7b1260d33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead40ca5-e865-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626680999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680999, "uuid": "ed4ae322-8514-4bdf-95bf-846008b04fc1", "comment": "Malware payload (Mirai)", "value": "4b3c4850a68a5dc04f134e24e1febe53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680999, "uuid": "efbbe7e2-a5d8-43cb-9fb8-24bfb6869f52", "comment": "Malware payload (Mirai)", "value": "27121a938594e68f8045009f687a41aa9a86adede6257d3a83d790fd4537099c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680999, "uuid": "fec159c2-d473-4048-9270-bba539642310", "comment": "Malware payload (Mirai)", "value": "d6bd072a31ec30e53461c4917f4dd04f2a2e2cdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680999, "uuid": "20ea683e-5776-4620-a56a-94d656957bcf", "comment": "Malware payload (Mirai)", "value": "99cf3fe6635fc497b088c74297e0ddce7e7197696c6d5b3bfe0b36e075cea391623e1fb9cffff193853d51b4186509f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680999, "uuid": "c1ac8990-8864-432f-a212-f4430aa9dda1", "value": "T151638D3AD529AAA4C0864978B8A5CE350F02B08087532EF7DFD582E65853DB9F444FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680999, "uuid": "69e7c090-e6de-437d-9f85-b6ba4fba9395", "value": "1536:havHfA0QjujwtaeaotZeufs3I53W/qaIzBVCD:hIHfA0QjYCJf+IxwIzBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680999, "uuid": "89ea976d-be8d-4041-9348-1ae8455275c0", "value": 69368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680999, "uuid": "55a5712c-8241-4eab-b9f5-a12d310e8bc9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680999, "uuid": "b09b4b1a-2999-4aa3-bc9d-2586b88ffbca", "value": "4b3c4850a68a5dc04f134e24e1febe53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e25098-e83d-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626663671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626663671, "uuid": "4f1604d5-2e81-4f45-b82a-fc164ef90915", "comment": "Malware payload (NanoCore)", "value": "c120fe6aaf2080c9220f9b6fa0cea1fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626663671, "uuid": "9d2e1915-db07-41be-8e06-997ab5532a0b", "comment": "Malware payload (NanoCore)", "value": "275c98e9140a1189557307f363b897d01a080472510231103c602bc0b84c739e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626663671, "uuid": "af9ba486-62b6-4084-b9ac-0af88fca06e6", "comment": "Malware payload (NanoCore)", "value": "c55a1bfc5304cb3000920a9d7ac883c570ed4a60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626663671, "uuid": "6fdf05d3-4dc6-44e4-92f0-54ae2fdae9db", "comment": "Malware payload (NanoCore)", "value": "85544711af335bd4c4f045b8b890de83881eb00584a830c914522998932a1c26525c9b9b8f90f95c36889342c4b9dd13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626663671, "uuid": "b2596b8e-ac65-4d81-b57a-4f25a39ac80e", "value": "T11D53F14A173CCE39C742963345E6FB305329AB524E33C6A93F1405655FF2E18A9E0B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626663671, "uuid": "0f050bfd-ab3e-4617-b432-faa9ca66007b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626663671, "uuid": "3e4bb29f-4122-4b0e-a846-d34e909348dd", "value": "1536:QZ8pt1/piyGDfI8AP8pCyFdqYTPg9kIdd5l6shjO:tH1/0yygn8pCyFdqYTPg9kIb6sZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626663671, "uuid": "3f313c89-29c9-41c1-80af-b5a179f5f334", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626663671, "uuid": "0d04c62d-724d-4260-8c30-06f21443abd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626663671, "uuid": "f531a486-4a49-41da-aa46-65dc744a4591", "value": "C120FE6AAF2080C9220F9B6FA0CEA1FB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd9d098-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626708656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708656, "uuid": "38944d05-f5e5-4601-9902-3390c01f53fa", "comment": "Malware payload (Formbook)", "value": "0c042c677d4541852529e242a1ed3a86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708656, "uuid": "5c5676da-db4a-41ed-9aa4-a5cf78182b44", "comment": "Malware payload (Formbook)", "value": "27662960c42152868cd03fc425ce95ba5a4ac363aadf4f81bc119bf16ca467dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708656, "uuid": "9cf22284-3bf3-48b8-81e8-7dcf54ddcdc4", "comment": "Malware payload (Formbook)", "value": "0d4552d6638f4cb53e6ef02c3a18eb909b8180a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708656, "uuid": "a91cec61-de6e-480f-9fdd-226aa150044f", "comment": "Malware payload (Formbook)", "value": "553248d95222a7bd738d5191f4d30f72ad95067ce1fec64887cc112d1bcf3625ef59873bc9a893b75ce3293f1119c3dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708656, "uuid": "9cee179c-0398-4192-8fb4-814cb3973320", "value": "T1E70412B553AFEA35C65124F758834EB7AF01C2B0446F0633BB1C3BAC90485C59E7A7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708656, "uuid": "b74c9c12-7991-4d7c-a876-94f3e8a6e730", "value": "b6cd2b2e7da625c041547b6a9ad4c4c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708656, "uuid": "6de50123-df4f-49cf-97db-bcacd3a9050b", "value": "3072:7Xg3bdoROW8r3B4W+tPQJeZzS/lzFCRtH2eMmSOH1SbOELP38t4RbE9I3iL:smIWuCWHJe9kzFotH2ehN1NFG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708656, "uuid": "5193c097-4ff7-439f-9e00-9968af6c6b96", "value": 175227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708656, "uuid": "5002c43c-c3ed-46ee-aeee-1f2fcf29db6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708656, "uuid": "d79ddae8-92ae-4c3b-a668-b1c8b39611fe", "value": "0c042c677d4541852529e242a1ed3a86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f8e8fb-e855-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1626673793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673793, "uuid": "e0d1c170-c227-4b38-bd75-d76ee0d3a71d", "comment": "Malware payload (CobaltStrike)", "value": "a1742b2d2f3ee699ed80be22f444b9a3", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673793, "uuid": "f51250d4-9933-41c4-8326-5cb601f0f046", "comment": "Malware payload (CobaltStrike)", "value": "27d2465d10dd5daa883cdc963424571231ef99faecb93ad06347a91b6621b2c0", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673793, "uuid": "16f51634-8c02-4263-85e1-02866e62c247", "comment": "Malware payload (CobaltStrike)", "value": "25fcbffb9dba9f3c360ad6a9cf17853f150f1a10", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673793, "uuid": "96a45387-93f0-445e-8165-60c2d7238807", "comment": "Malware payload (CobaltStrike)", "value": "f35babe9573415a1fe67a0a01a4eba2641350413434711972fef15c16b0306bb5bb7a29180e90847f5579fdcbfce09e8", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673793, "uuid": "1400429b-2c45-4521-898a-a555e13e56a0", "value": "T15854CF1AD97CE116D36B6EB3C96F31AB5927B38A563E2BE4816DC1854F0C712C873B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673793, "uuid": "312033cd-d4bf-4aff-aea9-d7dcce1f552f", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673793, "uuid": "a873a4ff-c95f-4ce5-a934-74394a26bdb7", "value": "3072:ARx9Twvchj7xhH1/mXA1B3y51obk5cYyXyLCyq6C3Qzrmokd+fJn3i1Rk3P/Ruly:ARxWsD1ZD3mzRLCgPzrua3P5ulur2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626673793, "uuid": "ee6e2981-7829-417c-a002-43383f4453ea", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626673793, "uuid": "2eb3852b-aa26-4f30-967c-dea294c85bf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673793, "uuid": "c397b34d-8639-4872-b017-2f496b724f19", "value": "a1742b2d2f3ee699ed80be22f444b9a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dfd9e8-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626708671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708671, "uuid": "06f0bb49-4171-461a-906d-c6c0315c98d5", "comment": "Malware payload (AveMariaRAT)", "value": "069c9912fa773cada0e357556182f089", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708671, "uuid": "25dcb952-708c-4365-a548-649b5224ff11", "comment": "Malware payload (AveMariaRAT)", "value": "2a0f53dd66eff57c82fcad2fff75d7ac63f6f4d764ec27fe862e6b3f01a21c03", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708671, "uuid": "35600faf-c3fc-4c46-bbe9-80c231d142de", "comment": "Malware payload (AveMariaRAT)", "value": "4f3e4f2d9b361b5747baeeb0178908a2f8d3339c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708671, "uuid": "2344400d-916c-4325-a246-57ad713043e2", "comment": "Malware payload (AveMariaRAT)", "value": "8c9cef342554b366365fe326da9cb111e2637041e273968840e8bdbdea8488d1171228ec68c5e42a50e551124a13a551", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708671, "uuid": "74a7ea5c-174d-4268-b59f-424c87aa1aa0", "value": "T1D60512301861ECD5CE8F433C44F31BC66FF156B7C2458FFA45A9211ED667B848A4A9E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708671, "uuid": "76db2652-d5dc-4abb-bbb9-4491faed74c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708671, "uuid": "12c27076-cd75-4c31-885e-427535d8c1bf", "value": "12288:z+MO8FsF87bhQxUKKKVxeTwfNIez6T600a348hlscT+GSDCi+d1gPs:z+MOQW87bhQxtVUsVpz6G03kGM+dKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708671, "uuid": "32e8ea45-e462-4cae-a5d7-9a5eebaedbea", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708671, "uuid": "8f9c7608-4df3-4238-83fc-920f028510da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708671, "uuid": "048992b2-1174-40a1-a397-66295676f590", "value": "069c9912fa773cada0e357556182f089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51009be7-e873-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626686754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626686754, "uuid": "1815710c-8f00-4b77-a236-f86d7019cbb2", "comment": "Malware payload (SnakeKeylogger)", "value": "7a20fca2f86df8d559c5375f340463a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626686754, "uuid": "3198bf9e-c453-4dd0-b67a-e6df244e8e86", "comment": "Malware payload (SnakeKeylogger)", "value": "2a91e3c56d2e6e834bdfdab27b2092386d549d5ef85536aaa76ce5829d1090e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626686754, "uuid": "a4574caf-390e-49a3-994d-db0f0a04579f", "comment": "Malware payload (SnakeKeylogger)", "value": "f25f8e0786f25e4ed04b4a9bc2730cad02a4e4b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626686754, "uuid": "6006a4c1-753c-4230-969e-fae6442ca529", "comment": "Malware payload (SnakeKeylogger)", "value": "231b7cbe066fd0fce69c6705ee94e3d4c206e572e46d8c4c54fc5013ed19886acaf47ca4e2e4fb05f078030e09f4462b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626686754, "uuid": "84d7affa-880c-41a6-bdb6-52deefafe356", "value": "T17F15BF166203E204DC3847F6DC29C9F016AB7C26E939D16F2AC8BE7F79B32F915A1145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626686754, "uuid": "f16468b4-76ad-401e-ae1a-80c96650ac1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626686754, "uuid": "93f81643-e1cd-4cdc-954e-f72c1d18891e", "value": "12288:reNyvUIZbVtBPIKlBPUegPy3U2Sn0bCfKjGDncJOhdEe9CyXCzI4QG:nvDBtBPIoBPEkUxnOkKjGDpQe9CyX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626686754, "uuid": "1d16a0ac-e0ba-4bd6-88a8-124341986d4a", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626686754, "uuid": "53367b5f-9894-4098-b9d8-9d25ee79bfc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626686754, "uuid": "47a7b839-210a-4daf-a84b-64044e55a31e", "value": "bank swift... Scan pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f67617-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735859, "uuid": "fedc3d12-07c5-48af-8123-5b341c80633c", "comment": "Malware payload (Mirai)", "value": "4d60516871c79162f956b29ff8c8aee3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735859, "uuid": "534c9239-487c-4523-a9d9-a48b7cba5cb3", "comment": "Malware payload (Mirai)", "value": "2b18dbe733f9729ab47c0e6b115382f17c1d2fbf48d21212800fff31978bcd80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735859, "uuid": "3c4284ca-c289-45c1-a4b8-369d206ce4ea", "comment": "Malware payload (Mirai)", "value": "4b3fbe6df55b0f752b3588093aea927cacf246e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735859, "uuid": "7a4fce28-2672-4f9f-8d8f-74bdf95041ec", "comment": "Malware payload (Mirai)", "value": "4e0518cc0b60a6e3e66d311e71f44de0c975be1431c1a682d434c6a9eea2d39519b78d15a7525bfdee17ae3b69aaf29d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735859, "uuid": "c4f011ae-711b-46e5-9409-499bc5a42986", "value": "T1F623E8C27881AE29C7D157BBEE6F018E3354A798D1EA7353C8240B947ACA90F0D57F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735859, "uuid": "842ee409-c962-44b2-ae5f-23427f19f8bc", "value": "768:PqPo2Ap9tDjGuqPDkj9o1uDuTA3nRqM+7ojxed1VCFEn/OXwCVy/zmJHUhG1jeww:CPDC7jnqwj9KTAYrd+Gn/FzVLS1S2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735859, "uuid": "d29ab03a-3dd1-42c7-a7d2-648d32330f89", "value": 46416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735859, "uuid": "5a890349-0506-428e-b65e-3c51ef6dd35e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735859, "uuid": "c6aee8d1-c149-46f0-8a95-d2802c9bdc23", "value": "4d60516871c79162f956b29ff8c8aee3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0e0aba-e8da-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626730880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626730880, "uuid": "286f5871-a73e-424e-bd5f-152de1f931ef", "comment": "Malware payload (RedLineStealer)", "value": "be9b4ab2ee879c0aa4f727e5a4e25d4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626730880, "uuid": "559576b2-0740-4c11-887a-7d3af06687a5", "comment": "Malware payload (RedLineStealer)", "value": "2bf7a7d3424e40cfbcb0ef3d27044872cf36310a300a076c1d172cdb0d707248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626730880, "uuid": "43918ebe-b428-4268-b8cd-879f0cd3a78f", "comment": "Malware payload (RedLineStealer)", "value": "49458cca9b8b56f99360219dac774c185ed6d459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626730880, "uuid": "eb5dedd0-2323-4934-8cec-e905b875cc3a", "comment": "Malware payload (RedLineStealer)", "value": "1f19d0a5435fd34647b18d2d2a41b70865f1498c9bb01bc446d51f5e240c85753240e1f74233b113e8722ac688172dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626730880, "uuid": "74931571-e679-43e7-8bda-145a6a64f045", "value": "T14C84242864BFC05984E3EEA52DDCA8FBD99A95E3640C743701B4633B8B51B80DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626730880, "uuid": "c7f555c8-2e11-4741-b6a2-604ad2939d44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626730880, "uuid": "a1218203-9644-4244-89ad-c6f798f45cca", "value": "3072:Rj9ukVYUVNCkr2R90/sPZ8k277DzjViQEgwqwO+wm58gCp3D9qp9PYBO8hoJ/nn9:/LvCkr2R0sPZFCvzB6gwqwwm58KdEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626730880, "uuid": "e903b1d6-cabf-410d-8b6c-284f39a68534", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626730880, "uuid": "cb08956e-722f-46c6-ba22-8540f8b302e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626730880, "uuid": "38a3bf2b-3f38-40f5-8cbb-82f6d73c9f75", "value": "be9b4ab2ee879c0aa4f727e5a4e25d4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1344778-e8b0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626713195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626713195, "uuid": "5532083d-e492-4d4d-8327-4f86c15b977b", "comment": "Malware payload", "value": "028bf5bc572cf06e10c315334c397649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626713195, "uuid": "3843fd1c-397d-4431-b571-476e44fa51ae", "comment": "Malware payload", "value": "2c7540c6d066510b73a1a5c668dc74ec6d0d3f0716bb3adb6cd83afdd07f35ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626713195, "uuid": "1af8a9da-6ee6-4e42-a189-6769710f34b4", "comment": "Malware payload", "value": "cf69c58a4e35b7290af44ec658edc3582655f84d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626713195, "uuid": "e80a12b7-feb5-4556-b30f-de026734a450", "comment": "Malware payload", "value": "ff5f028fcd2f41561727eae0e86e818333b95079fb290afa792a40f7e28260421be6094e4aaae3254f16502534abe5cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626713195, "uuid": "a73292d0-9c90-42ac-b736-742f7c4e911a", "value": "T16ED49D67B380457BD3D7B939EC9F8A71AA257DC32839300A33F56F080BB97512569B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626713195, "uuid": "d1465813-b753-4588-9806-1b8ad97d423a", "value": "b626bb107e2a13327eafb21c1e74d47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626713195, "uuid": "ec87a976-aebc-4478-91c3-4b9f0a9188fb", "value": "12288:JV0wOEyuOv3iii4DMXqsYLbRSsb7/Ssdpk6dz:JyFuOt3WOLNSy764z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626713195, "uuid": "5b9ad632-d6f1-413c-ab8f-832082af18f2", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626713195, "uuid": "7247fb9d-9d7b-4e48-84ff-b3cd4c74a9dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626713195, "uuid": "b79e97d3-ced1-4a13-8c5b-5efbb2ef4a5e", "value": "SecuriteInfo.com.W32.AIDetect.malware2.14010.3968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3396e384-e855-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1626673820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673820, "uuid": "a8078c4e-c3c3-409f-bc0b-e88a702d3d15", "comment": "Malware payload (CobaltStrike)", "value": "2abdfeb9090ff090ae9db0a5559e09c7", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673820, "uuid": "d05fab14-5364-47ca-a39f-ca660f3f02dc", "comment": "Malware payload (CobaltStrike)", "value": "2cb4d628278053eba42c82d58fb894c230451ffe70d519ff79c5f1cc76f32fd9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673820, "uuid": "cbd541d0-ff0f-4f79-add9-ca7464b49cb4", "comment": "Malware payload (CobaltStrike)", "value": "4925d41d6db6e3f47250be8cdc21bb1548c7261a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673820, "uuid": "ea4f62db-0a66-44ea-89a5-0d657efab1ee", "comment": "Malware payload (CobaltStrike)", "value": "35916f4852a52ebf9632f975457d17a32234ec7b7c6224964e6f4591b5c4d1643f002962a8f38bc38e624c450d3ca58d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673820, "uuid": "731ba8d9-290b-4c07-a3d1-bfd7f3e48763", "value": "T1FFB44A0AFB6444A6D063D139C9638A86E7B17C894B60838F4361E77F2F337A19D39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673820, "uuid": "04f4e532-5d6c-4935-8e2f-9a70fd8d0226", "value": "00be8b4e049a09cb45ddd7816620212c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673820, "uuid": "3d291276-e078-4e95-af0b-b5bc7d601055", "value": "12288:9iSHxfoBGUL3suI5knw6Lc7h0zHaPveW7EPH8w:wSH2GeXfnrLsmzHah+8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626673820, "uuid": "ed076068-0dd4-4ad2-8c28-2ba27cb2afa5", "value": 526816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626673820, "uuid": "52c76b57-f75a-441e-8327-27f3c4b9ca01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673820, "uuid": "69412a1e-0596-4a3c-a7fc-b48c01c8c34b", "value": "2abdfeb9090ff090ae9db0a5559e09c7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4572f511-e86d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626684157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684157, "uuid": "845f5a03-b5a2-492f-909c-07fd7a29150b", "comment": "Malware payload (RedLineStealer)", "value": "637862922ea040811a79adf327863e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684157, "uuid": "9e7a7737-8e5e-4f74-ac4a-fe85ddfc60af", "comment": "Malware payload (RedLineStealer)", "value": "2cbe0812081f1c8676e8fb96d9e4e08e6ac092c38982586030bd7302ed2b9a2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684157, "uuid": "4ea51a10-60bf-4087-8a7f-03f6cac7ee57", "comment": "Malware payload (RedLineStealer)", "value": "cd9f3fa9a64e1f1283121c0d02ec4ecde47a4de5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684157, "uuid": "eed6a0d9-3dfc-4d20-b6fc-ae5a402b7554", "comment": "Malware payload (RedLineStealer)", "value": "b029cdad90c60c385c0441fa40d2b991ab059b393a359ab98fd43a6cda2c791d972e3ac3fad7d2a2d041068a30b1bb09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684157, "uuid": "68a49b96-a1aa-43ee-b329-626ff34933db", "value": "T14B84442868BFC01985E3EEA52DDCA8FBD89A55E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684157, "uuid": "046fd456-dc09-446b-bd1a-a6d24681c077", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684157, "uuid": "bdaad064-f90f-4216-9b69-81807ba830ba", "value": "6144:12majpDepziHeFNr079fOlTk8ebKEGssn1:12matDepztFNr079fOlTk8ebKEPs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626684157, "uuid": "22e7e903-3c5a-4c5a-a946-d0d9dbeb6ddd", "value": 397704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626684157, "uuid": "79f23145-b9ee-4f08-af94-c473aafb8c63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684157, "uuid": "64ac7392-e1c7-4540-b83d-288f3917d156", "value": "637862922ea040811a79adf327863e15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da39cd68-e858-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626675388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675388, "uuid": "d738f78c-2d4a-448c-a1cd-331407295f93", "comment": "Malware payload", "value": "040cca91f06819461187ad57faa81f30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675388, "uuid": "640fdaca-9ecf-45af-a9e6-09a9c827c4d9", "comment": "Malware payload", "value": "2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675388, "uuid": "7f2b06d2-b399-4407-930d-7b907972f7cd", "comment": "Malware payload", "value": "51b4261aa8c7a475ca9223d4dfddc19a2720096f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675388, "uuid": "532eaedd-f96c-444b-9633-0413ae11f31a", "comment": "Malware payload", "value": "021f41ce24d140d0d6dd32063b4c73a3da5d8ad720e1827170464e4be21b41ac38111d023c187b2264d2f5c7e8df7972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675388, "uuid": "7bb00161-d28d-4f5e-9de1-869f2daf8b02", "value": "T1D215F1263227A118DC3887F95C69C1B02BBE6C29563DC7782AC4ED7F7DB36781AD0581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675388, "uuid": "e1f821ae-59d4-44af-a1dc-082f7522235b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675388, "uuid": "a51fd4c7-d081-4a2c-b794-dc159f7871ac", "value": "12288:ybL3+yvUIZbVlBPI2VBPicnA6dLviSv8PLpSaeFzLyeSXmOpgfm3Q+:yb5vDBlBPIOBPtnfdLaSEzpwzyXpqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675388, "uuid": "38bec678-dd4a-4253-9a02-5f65d9740843", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675388, "uuid": "afa9fc6c-eba1-4775-9510-7c61d4454292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675388, "uuid": "10dfb67f-0c70-46fd-bb8e-e5cd7e735de5", "value": "Delivery reciept .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed97a67c-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626708921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708921, "uuid": "c4b2037d-6808-47f0-8586-623b8a7b7fe1", "comment": "Malware payload (AveMariaRAT)", "value": "03c3dcb65eac90148838972f83b3d127", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708921, "uuid": "872c6b0e-6b5e-420a-b1ef-8cada5bd8d9c", "comment": "Malware payload (AveMariaRAT)", "value": "2d1e7b0b691c806b94f685f348dbe5bb4857edf0408f363314fe97535f4723a1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708921, "uuid": "cc8492d9-d133-4ea3-93dd-57a8ac3bee92", "comment": "Malware payload (AveMariaRAT)", "value": "3444fa4d8a0109e4ed791af052b237f1c3c7e88d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708921, "uuid": "c9766a1d-354a-4904-838e-7cc6100584e8", "comment": "Malware payload (AveMariaRAT)", "value": "5c59fa94ec6197eb07054507b764c3238d888b0a1877765b0a0fa62e70ba1dc28a04412e1c4530a7e8323263c2da093a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708921, "uuid": "35eb66bb-62b6-487a-8f00-be46f391a8ee", "value": "T1B215E0300810D595D95B0EFD48B63BCA1EA1DD73C3008EF4556B3DADF9A66808BE92DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708921, "uuid": "6edb7f21-0501-471e-9041-0e5b7f490b51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708921, "uuid": "c85292c7-4f1e-4b28-b985-48560b4e90e4", "value": "12288:2c9+MO8FsF87bhQxUKKKVxeyPjdyl+7bDHX2bPgPP/S4F6Ts0NI:V9+MOQW87bhQxtVUyPjkk7PG0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708921, "uuid": "b2a7e8b7-14a9-459d-bce9-28e90e320216", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708921, "uuid": "465989ea-8473-45c3-864a-1e06b53b0dcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708921, "uuid": "fb29cffa-7cda-4b3c-bbe5-7278b5783d2b", "value": "03c3dcb65eac90148838972f83b3d127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2ca98c-e858-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626675416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675416, "uuid": "229abee7-11e9-4238-8dd7-a754cc9f070e", "comment": "Malware payload (Formbook)", "value": "2193e13c130f121e243d436eb8adce0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675416, "uuid": "47652e24-c35c-4e7c-a9db-9b940de0863f", "comment": "Malware payload (Formbook)", "value": "2d3642f2c997cdd1a84d283738cd6d09f321f681dbc26fab6cca262d59401e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675416, "uuid": "ae42cfa5-5fca-437b-bdf4-6e036e5d2aa0", "comment": "Malware payload (Formbook)", "value": "60b6a9e3e7a123aa3af31940651b096df70e2161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675416, "uuid": "7ebc0189-a9a4-4a7f-a1c7-ec7eb8ac8c27", "comment": "Malware payload (Formbook)", "value": "0229337f29744a186d2ebbb4923fd0e2c9dc4f1063f13843f34947965273171df8e0ffc6ce92722d4cbbb4276a0ef292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675416, "uuid": "f654b8cb-bd0f-4956-9368-d30650b76fde", "value": "T11E15F1666227A144DC3887F50C39C5B12BBE7C29663DC67C2AC8BD3F7D732A85AE0541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675416, "uuid": "a575f934-99c7-4098-866a-3c34124f7f9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675416, "uuid": "760d59d4-2ce5-43ae-b3db-c193c659a378", "value": "24576:8vDBlBPIOBPsVCu7VjTrEgCbM5SjX6/r:EpPDPsVxjTRetDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675416, "uuid": "0bb97b5e-d632-4792-a0a3-87293e38c50b", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675416, "uuid": "092caf03-4562-4e35-b769-33854769c877", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675416, "uuid": "e59b5a95-88a5-4503-99f7-131458920139", "value": "9QLRUJtvxrU1w8s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd65605-e855-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626674055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674055, "uuid": "52f619a6-1f94-48b8-8742-95c1e2605e52", "comment": "Malware payload (Formbook)", "value": "7098068c07032900ff073b55a8ad8e0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674055, "uuid": "a4de2720-4e36-4b51-bc78-1e2289f1fadf", "comment": "Malware payload (Formbook)", "value": "2d7aac32ea8a8329262ead70ec2f030c1a4061e4edafdf03e605bb9ce606836e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674055, "uuid": "e6510d59-f817-40b3-beef-8cabddc6b2d2", "comment": "Malware payload (Formbook)", "value": "5bdda0bc06b935689f29d55b297d0523d82c6bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674055, "uuid": "45ec571d-50ea-44de-b013-ee130cea328e", "comment": "Malware payload (Formbook)", "value": "9ebf5660474f43d9a59a8c8a144110f8e05f203a846e6d8f560f738fa948f15b6b5da7fbba12a24a1998a1b28bf503fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674055, "uuid": "7a9618d0-5ece-47f3-846d-5e19bc664ac1", "value": "T12A25AF9C710075CEC8378B738865DC71B6912C3A5727D90B58DB7EAB7B7E5838E018A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674055, "uuid": "36ab54b0-3694-423f-b833-990c69f1bd1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674055, "uuid": "fbbb540a-53af-4488-a0d5-fbe986f4edf9", "value": "12288:WA72Z5kzykTvNYf3ACtYKWBAZcQEuanCJ4ZTuWnCT2EypSTU0KfOgzUhr2X0GSGl:WAaZ5k7TvqfwCqiZ9149O21FCWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626674055, "uuid": "27fe1df1-8bba-40b5-a696-5554061c31b5", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626674055, "uuid": "e3cb5f51-9238-4b99-9786-b4ccacfe5a4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674055, "uuid": "97c88f0a-0e46-4865-876a-79abaa246605", "value": "USD $.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2527cc72-e891-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626699565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699565, "uuid": "5be39a22-86a4-4f3f-ad42-97926e5988be", "comment": "Malware payload", "value": "af27e975705dd7973a1e49e782ad05cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699565, "uuid": "02368c05-3db1-4f38-973a-7ef0e47a1178", "comment": "Malware payload", "value": "2db2cc193feadebfc2a1847f97ba91070840b51cc9729a3208cf288afa71f19a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699565, "uuid": "4b84dffa-f190-478c-9837-a0d71ec3e574", "comment": "Malware payload", "value": "a9651c701f2436a9981d3af532500e25ca8244fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699565, "uuid": "08c2899d-9114-4cb6-8d3c-3464662607a4", "comment": "Malware payload", "value": "a7b3191f89c75effef1d0dda850a374cb7487c16bad66a1503c6c40dbdacdfd28b515593c7b6d17066bf8184f1d4ac8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699565, "uuid": "d8cd5896-38c3-42fe-be2d-cd6593ef7c01", "value": "T1AC2633903C52C933C35B167596F886B3796E7C158CF47B2531D23B9AEBB2492A53E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699565, "uuid": "333cc546-61fa-4691-9401-7f8359ccb6fb", "value": "3b4066478c5a089b20225c908d399a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699565, "uuid": "28eeef4d-80f8-48bf-a0f0-18ee0c6ffc8d", "value": "98304:05fsMDmAwgoNUFDGe4mhQKDO39wndOP3:05xDMe1bzDO39Adc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626699565, "uuid": "3726ba6c-c1ff-466f-a66f-4e63e3ef7d89", "value": 4569088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626699565, "uuid": "5dfbfb2e-ae55-49a3-a9f5-2a7a7bdd7585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699565, "uuid": "1e6e2dcc-ef71-47bd-bf96-bdc7fca72c72", "value": "Your-File-Is-Ready-To-Download-PLND.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f56e89-e8d5-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1626728745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728745, "uuid": "3da83772-9d75-4518-bb74-c0bc49cadc82", "comment": "Malware payload (Vjw0rm)", "value": "b12f18bbf06a2ef14d44e718e59c10c9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728745, "uuid": "56901eac-d26c-4f0e-916c-8808820ebee0", "comment": "Malware payload (Vjw0rm)", "value": "2e59b22f26362321a0e7e3e5608108eaa4a78c31f2c09990ec8d468e38061326", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728745, "uuid": "eb58084b-76e7-45b9-92ab-ffa6031220e2", "comment": "Malware payload (Vjw0rm)", "value": "f59ddd62f47020de9e61d9fb06ae9cbe6a51c583", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728745, "uuid": "aef9589a-4247-4604-a979-da6fba615f13", "comment": "Malware payload (Vjw0rm)", "value": "1d0e675a98cf629f67358352e40b608db64f53900a18e480fbc14af12c03172d96de62df739096a9ea685d2570d7ef93", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728745, "uuid": "ac817279-1773-4d98-965d-d9435bf6073e", "value": "T1DF129E80B4C1717565076705485D98859EEBFBB28883FFBEC3E6E9C14E45E8CF861AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728745, "uuid": "55385d4a-7340-4a51-a03e-afcc47932f65", "value": "192:Q4bJhdMBIuKLdkDSiynCSK88GFdPPEs+PFriDxFHU5DZKIRZNCUacEqirk5g:Q421KLd9pCSb9EsqrexFHUBvELz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626728745, "uuid": "cfae85ef-d9a0-4eae-91a4-c12845508fc2", "value": 9581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626728745, "uuid": "ff82d867-9fd2-4278-a2b9-239fdd5084f8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728745, "uuid": "22c660e2-a90b-4d4c-aa4d-5cf0984e2237", "value": "ZW9HA3OKMA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0222f0bf-e85f-11eb-875b-42010a9c0053", "comment": "Malware payload (Sality)", "timestamp": 1626678032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626678032, "uuid": "cb1257bd-21dd-434b-ba98-7ea403ebcb32", "comment": "Malware payload (Sality)", "value": "44b42e92ffe33907c539d1135bb05239", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626678032, "uuid": "b94bc231-b269-46ce-bec3-d2fac07b54f0", "comment": "Malware payload (Sality)", "value": "2f06361e4a81ff059d074de638106e1b9aeba6885819b15391ef25997f537bf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626678032, "uuid": "f93e14fe-1070-4246-bd5b-fcd92c62a18f", "comment": "Malware payload (Sality)", "value": "954f37a3ee58b57f408d09da74f13a5660562d07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626678032, "uuid": "eb8cffbb-9397-46c2-a772-83ccc0dfe7df", "comment": "Malware payload (Sality)", "value": "212730b7111ef5782f12e6bfb1aa54dc6fe1f468eab16713b818e453f77e3c59cf747a1291a1e3ff12699087fd0c64ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626678032, "uuid": "e27f3500-f9fc-4630-885c-ab68d61d824d", "value": "T1C6C42A23E764360AE443043099A9AA7599267C3168095C0BF3C59E1D27B1ED3FDFA72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626678032, "uuid": "85bbdad1-2576-4bb9-8d76-ac93f3357c14", "value": "0ff68b60ed1f934883cb9442e500fac9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626678032, "uuid": "208d1a70-bb7a-4b0e-b317-ece5cda2cb63", "value": "6144:aJOnI2caT+aLwjBbZoTFS8nGzIgPc1iq478mSvL5Fx7b06+Mt6twbZD8c+XRs9L6:ViaT+aLwQ/yX78l+Btth4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626678032, "uuid": "5927c854-bb1e-4169-91d6-42b176eae965", "value": 567432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626678032, "uuid": "5a56e5d6-1be7-4df7-91c8-c342ea210140", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626678032, "uuid": "8b712a52-5f5c-44a4-9002-61d8e889efd1", "value": "44b42e92ffe33907c539d1135bb05239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9813b5c-e8eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626738549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738549, "uuid": "bfed7727-d32c-4a62-aa76-9e3206de0971", "comment": "Malware payload (Smoke Loader)", "value": "2c755ecd62fd5fa9d07ae1de2c44d07a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738549, "uuid": "c301a206-abd4-4d0c-8ed3-f525e7d3c79d", "comment": "Malware payload (Smoke Loader)", "value": "2fb2b5e669b540a281fa0086726881cf0850ed88f07371601299ea0713d38f7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738549, "uuid": "ada525cf-81ce-4122-bbc6-d8223a3ef5f2", "comment": "Malware payload (Smoke Loader)", "value": "41c15f7ee79cf663970711e5075798f80fe2a775", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738549, "uuid": "bece725d-0aad-4575-b17a-862efd383933", "comment": "Malware payload (Smoke Loader)", "value": "a67b272a194504fe8f48bd0d8535f78667c062b6f365c4d548fbd0dcf4b6c975ed62ba39804c99be4a0fc843b09b9b4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738549, "uuid": "50b39b21-1e18-4989-acd7-5a3075a060da", "value": "T15714AE5079E1D872E6B6093058F6C2E52A7FFC226D38454B32843BDF5E712D299AE343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738549, "uuid": "f0911ad7-477c-4c05-a649-b656cc72e1a7", "value": "b0fe27671bb60a5d31189716fdcf7690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738549, "uuid": "57dcc3c1-7cb4-4bda-92a7-42e8d4f37685", "value": "3072:MdzpznUnL902bzaEOuFvnLJDwXlndblNlRsubL1u:CRUL+nyLyXFpPlRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626738549, "uuid": "d5532a43-c97b-4a79-94f9-62b960c584b7", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626738549, "uuid": "77971d18-6108-46c7-ae7a-ec506c883cbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738549, "uuid": "8f0c6cff-0cd8-45d8-b563-d7bafb9de96d", "value": "2c755ecd62fd5fa9d07ae1de2c44d07a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3554ce1-e89f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626705897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705897, "uuid": "c5bdb014-d847-4b98-9aaf-8fd6e53bc963", "comment": "Malware payload", "value": "b4d697751214b029d3619b754271a03c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705897, "uuid": "8aea9d4c-c5b9-45be-b5df-f900a8d9a80c", "comment": "Malware payload", "value": "308964bf6cf544d31c578e30ca1951e21d45c699cfc7f1cadd6ce3e841c1a987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705897, "uuid": "4f7aa53c-2268-4d28-9af1-68af90b926c3", "comment": "Malware payload", "value": "a7b5f22cf76d49062bef8308ed6ef3ab27af14e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705897, "uuid": "3d76ec5d-c4af-4843-b6eb-3493b8b5b6bd", "comment": "Malware payload", "value": "064dc3461b0a1162b5695cb7e8c79650e79bfa60c28a6e1a97385f4fbdff5ac5a5a24fbe8017ac3b4ad612374f42240b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705897, "uuid": "9d60a415-8026-4718-b208-cf0be3de9671", "value": "T124E4F1B8326B9248ED648BF91C75E1F12BBEA529622DC63C0E84C17C7D73B7C1AD0951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705897, "uuid": "890fc6a5-6547-4cbd-9605-2751d0a47ac7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705897, "uuid": "fc843bf2-c862-445e-86fd-34d5368e150c", "value": "12288:krvNyvUIZbVOh8uussFPXcKIW8gOFljQ+QUhWTDiMPmyXe3CYKJiKo:kwvDBOw5Xyu8ljQ+QUhgDluIe3JKJRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626705897, "uuid": "1baf6d46-0ce2-4522-be14-134d1b68c7b1", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626705897, "uuid": "c19fb8bb-b8dd-4ca5-94d8-5b70e8778924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705897, "uuid": "f06bd50f-d014-4752-be16-760c173838aa", "value": "outstanding invoices pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab44289-e8b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626714929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626714929, "uuid": "7725ea4e-56d9-4422-afba-8b9a1b062fde", "comment": "Malware payload (Loki)", "value": "8cf5cb10708d0fea42106a1d31ba4248", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626714929, "uuid": "1690c64c-3b06-4f9a-9b5a-cdb44c9445eb", "comment": "Malware payload (Loki)", "value": "3183ab887365e3e337f1fc65dca5e1e0512be0e9f96e8e5477c2c731f4f838c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626714929, "uuid": "c3a474be-bdde-40cf-9c65-7619579b7d34", "comment": "Malware payload (Loki)", "value": "07675bc81362494b7709c701de36ffae41f0799a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626714929, "uuid": "0a0c11b9-5422-42ba-a0a1-14468a71c045", "comment": "Malware payload (Loki)", "value": "ebc1ed60d9e52fe33b218ed8a6f9e35537c9796ed5546fecdc903257b68396c9fa79a531c1df5198a6de36ed9e5bbc8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626714929, "uuid": "9a7e4ad5-21be-48c2-8721-857fa97d7800", "value": "T1BC24AE1172B0D433D1A71A30D77486A01AFBB8732A70B74F26972B1E5F322E27966357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626714929, "uuid": "a672a715-edb4-486a-a375-16c444139b8d", "value": "a9e1d64c638344b3b1db11785f5872c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626714929, "uuid": "2b4941f5-25d9-471f-80d8-281a19426779", "value": "3072:oD56uaRZZjJZuviIn9LenATwUK9518QUWTVTGhuCQ6VVodrF9E:oVaRxZuaWTfK8WTjb6bojO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626714929, "uuid": "9ec44ca3-2c4f-41ec-9dc6-69b9c9106739", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626714929, "uuid": "a37e876b-7db2-4ba9-933e-cc8988ce3af0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626714929, "uuid": "6268d10b-fc85-4e15-9178-d9077b6656cd", "value": "8cf5cb10708d0fea42106a1d31ba4248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0aafb96-e89c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626704524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704524, "uuid": "0c4700d9-23fd-467a-a465-a182b7ccd048", "comment": "Malware payload", "value": "1fd62a9c092a5ad5acebf28272dd7ba5", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704524, "uuid": "fbe47138-a6ac-4601-8d48-e9bbe6eb7864", "comment": "Malware payload", "value": "327fcaa5098cd49e5340bc8d6f57dd7bf0c4d8709be718147d35b0f3fc69eb8f", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704524, "uuid": "3bb1cb54-d326-4ac2-bffd-35c3dc42fbac", "comment": "Malware payload", "value": "ee7055245ec0bcafa494d7e1893baaaf73ce0a1b", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704524, "uuid": "f66e7655-3e56-44e6-9737-cd5fa8aa3357", "comment": "Malware payload", "value": "6fe985e37a2145c85365d6668e5980c5b411edc492a928b6ecdbb226be29007f8cb64326a0785dbb2caf5bfa85e64d34", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704524, "uuid": "10a4868f-6c71-4c79-914d-d5a5480eab51", "value": "T1E10255AAD12AB5E5204748397A490C09E06A5503AC0488F1FFD52B9BDF613BB5F73DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704524, "uuid": "58d3eb62-82d6-401a-b61d-d7f74a01157a", "value": "192:Vavxgq2XjMlabXTbBl5M4rsvtXot/bx6cktr9tkK5eQ88dWQpH4agVLXhn4cnzst:0v88dWKHHgVLXdAkPgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626704524, "uuid": "b5b7396f-3e1c-4b3d-a61c-46468d691efe", "value": 8531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626704524, "uuid": "42c543b9-2c30-44c9-b442-b320d03214a2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704524, "uuid": "5724a297-4bf7-415f-98ab-ab2c23019519", "value": "stage2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5d5538-e873-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626686746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626686746, "uuid": "05e12136-545d-4451-acc1-d2dec61878bb", "comment": "Malware payload (SnakeKeylogger)", "value": "047b1fff3a3050189e00bce2cef4f183", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626686746, "uuid": "09f78893-1866-4947-9dad-dbe262090c9e", "comment": "Malware payload (SnakeKeylogger)", "value": "341e9ed95698600102055809c1e338f7b2795ef803b31518034ba78d2db0e626", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626686746, "uuid": "6c072119-d054-4d25-bf4d-5b698cc62d30", "comment": "Malware payload (SnakeKeylogger)", "value": "e125c84c0e2e6d2184a30b27cf0edf685a9095d7", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626686746, "uuid": "29217b4d-471a-4249-a203-2039934767a3", "comment": "Malware payload (SnakeKeylogger)", "value": "39dc7d66e6f274f8c1ffd92d4be8d606f616b4f76bb5621f89ff675cedeae2d5c58255c6b514d01440bd10a3bf2174f6", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626686746, "uuid": "95fd8b30-6f45-4022-8127-763aa4e7d8df", "value": "T19EE42314EC56D3CB36A04EB3495512D62EC7C879B1560BFEFEAB53A5E4CABCE0205093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626686746, "uuid": "e6bf494f-79c5-492a-adc9-84d3120644dd", "value": "12288:FiP9VMTCoylipKbGFU8M1l0ZNzgjcJQESDqtgfojmDncJ8hfEQ9+yX9vf:cP9VM7pq8M1luweQ3DW6ojmD5aQ9+yXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626686746, "uuid": "a1fd1394-962b-4a90-8243-ac1b82f607c2", "value": 663599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626686746, "uuid": "abfdac10-9968-41a7-8081-6b767fa04d13", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626686746, "uuid": "51ef6371-5e22-4de0-8ac5-fc29517647f3", "value": "bank swift... Scan pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596c6f33-e865-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626680755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680755, "uuid": "1523a321-acd8-4252-8a57-19187390c2a2", "comment": "Malware payload (Mirai)", "value": "6e7cbe0e303e8de5ce961d828da48bc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680755, "uuid": "3067949c-81a5-4227-be28-4da8165c497b", "comment": "Malware payload (Mirai)", "value": "34cbdf14fa60b600f59bfb168bd05b09e0c34828ea0bc62573e37e6e14451510", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680755, "uuid": "2acb57bc-cb17-43ff-8289-1f99c924dbd3", "comment": "Malware payload (Mirai)", "value": "dff31528ea21f2886b32b4b229f0fc06a22954ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680755, "uuid": "9089fb49-3186-4621-896c-d1d5216c83f1", "comment": "Malware payload (Mirai)", "value": "3e81ec8e10b8ef02cdf1d9548d352097e7b9108d01bd6c9675cc579d775b08bc6c6c567c27000b24d672d3fb21801538", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680755, "uuid": "60b850fb-dd97-42de-9c11-3b65b04ccb22", "value": "T14AC2E125E1453FF2EF2BEEF755A5A8C03BE84F2D97E19A9910910FA19601B741603EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680755, "uuid": "70840ae0-280f-4302-8e2c-f248fad601e4", "value": "768:iSGsB+MlcUz9MJBJeZdpMlxjm4uVcqgw09U:3GjMlcUz/AM4u+qgw09U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680755, "uuid": "3c1020a1-5154-4efe-8581-3d3a27030d7d", "value": 26352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680755, "uuid": "c806d715-a943-4c12-98fb-f2de00a3b026", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680755, "uuid": "69e823f1-26ca-4c3d-aef2-4e5ca9d325b4", "value": "6e7cbe0e303e8de5ce961d828da48bc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84df1f7e-e8a7-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1626709175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709175, "uuid": "ee8112fc-4f4f-47d1-bb07-b3f2fc97ad2d", "comment": "Malware payload (TeamBot)", "value": "30af5222f324e951147ee5798bba6df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709175, "uuid": "2e96bc6b-1d40-474d-8816-a3b82a5ed538", "comment": "Malware payload (TeamBot)", "value": "350ba023b14fb9b5a4068621cbde35492b8b0aa74048a5d5ed2a6028113efc00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709175, "uuid": "c984d0b7-254f-4fde-81e0-451104b7fbf0", "comment": "Malware payload (TeamBot)", "value": "91152986e1a8f3b078bae0b8e9ff7a4e7f072a8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709175, "uuid": "ab850476-18ff-4543-b783-9caba0a9fcb6", "comment": "Malware payload (TeamBot)", "value": "6a31bf811671f8428cf014502ffa00f4bc95fa206b0ddc3fc54ace02086dbe937d61147b8ab990a3d93bcb401d322658", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709175, "uuid": "972114aa-74c3-4a66-ac10-9bba5c1b976c", "value": "T16BF41251B5A8D425D1664B30ECF4C2F8263EBC865D38890F76943BCF6E722D29A6D307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709175, "uuid": "86124478-c4bd-41d1-9557-4665a30c4d36", "value": "b3536084cb50b2be3b69aa695eba88f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709175, "uuid": "0fb8f134-ad81-438c-a6c1-83eba00f87fe", "value": "12288:Wy0JOS5jdJC14eDj0Xo6cANDi+IwtorqAtLi4vtbhrV+XumHpnrF3SlGzyx:crOu3csDxI48+4VhV+JlIQyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709175, "uuid": "2b3f7a8a-8a7a-4606-aae4-35f23ad445e1", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709175, "uuid": "3b0fe5b2-1bbf-444a-9848-115b5b495cd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709175, "uuid": "42082353-8d8c-4f5b-ac55-7b02af5bc3e4", "value": "30af5222f324e951147ee5798bba6df4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f518e44f-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626708933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708933, "uuid": "9f75199b-8a37-49fc-aba9-a4ca0cfd3863", "comment": "Malware payload (ArkeiStealer)", "value": "387092a40a3b71a81cf161f27587ed1d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708933, "uuid": "3139280e-24fa-4318-a353-a974655bddcb", "comment": "Malware payload (ArkeiStealer)", "value": "3559b0d23a700233cfccdaa2f665c37d2501907be780b34da6aece15eec6be72", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708933, "uuid": "0e554b87-cb35-4366-9a7c-d27acb1e654d", "comment": "Malware payload (ArkeiStealer)", "value": "271ae732722a4f7e25551ae79f6484e1d4556cad", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708933, "uuid": "6e85fc5d-b66e-4832-ace6-979f1802cdf3", "comment": "Malware payload (ArkeiStealer)", "value": "a881faffc1dd9aa0c7649505890716a1fb8cd2d6c722992d1a47f1dfe5029d7cb6de4de3a19d1ace589b1232aa3e4c54", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708933, "uuid": "a281c76d-8a96-4014-b453-af9829b77040", "value": "T15CD4F15AF7972A07D76A1E73C1DB007117A7EFC12133E2C27AD5514E1FA2788BD8A188", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708933, "uuid": "203c5ac9-be3c-4c1e-b852-2805d833ae2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708933, "uuid": "b841db5d-514e-4580-89c9-9ca0ee9aa3dd", "value": "12288:g0OAnWeQnYma0Mp01kkC21BW1lGz3I/+lrdB:ggnhQP+Ht21k1AM4rdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708933, "uuid": "a369d8bc-565e-40af-8ae1-faece2624578", "value": 640216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708933, "uuid": "224fb6ce-7be1-4f9a-bf69-b9db293b577f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708933, "uuid": "0996122d-9c51-4124-987c-a7bb7ceef8a9", "value": "387092a40a3b71a81cf161f27587ed1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c36148-e8a8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626709631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709631, "uuid": "e75e9bfa-450d-4b91-9a3f-75eae60967a9", "comment": "Malware payload", "value": "dff2b5576d6374025467f2ee758f0bd7", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709631, "uuid": "0dfe5453-0d66-4bb4-8e14-f22e267741bf", "comment": "Malware payload", "value": "3607470eb89b3325d0e1c15d3034c8d1016c55822acd2684b145d184cfc75a3f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709631, "uuid": "2841d09d-2e81-4458-ae4b-9188c4db8027", "comment": "Malware payload", "value": "aa0a5f0ea146132eb821a4d46641ac2db0bd69ac", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709631, "uuid": "fc9571ee-4d24-4206-828f-e8d83b9e8a47", "comment": "Malware payload", "value": "6a3b063140012533133b705fde4c2f7ce73d2fe2994309107d78d0a55a4269b359d2040ae522eee28078a2bc9a6bb333", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709631, "uuid": "61ed0b3d-0674-4e41-bbc8-1b742ff73c0e", "value": "T10C93123F914ADB65983258BB3C409B13C5B75172448B27EB962C1FB66FC29AFB326104", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709631, "uuid": "d0e23590-452e-48bb-92c6-24104df75198", "value": "1536:KnH7J7UR0HYaoptWczERnnYxXruA4eoczrds4LFL12hMTqSXxTXEIksoxT7FofyL:8HVU2H1orPH5Lo6ry4L6eTFXhEBsUFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709631, "uuid": "e6e3e054-5634-4117-b95c-dfaf05d5aad0", "value": 94029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709631, "uuid": "a333f3aa-5fa4-477e-8d53-e9bbc78630f6", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709631, "uuid": "2d9ef4b6-578d-475b-9a8a-3a875813d5cd", "value": "RICHIESTA DI OFFERTA.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca43fb0f-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626708862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708862, "uuid": "c05f5467-429b-4519-b3b4-c1ce2a36f1ef", "comment": "Malware payload (AgentTesla)", "value": "ce208ccdddfbf4423b6659c108795bdf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708862, "uuid": "a48b48c5-0f40-4afd-824b-82d5b535dc36", "comment": "Malware payload (AgentTesla)", "value": "386eba6b68ddbb34754a2d335a0b0799ce2b6979ac792c51323b8f687853fe89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708862, "uuid": "34d65513-4729-463c-a128-04697e1cb9b1", "comment": "Malware payload (AgentTesla)", "value": "f73c10113f08961856209c503e426ae7dda5311d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708862, "uuid": "1e4f41e3-146b-4b3e-b045-2fac2ce5b786", "comment": "Malware payload (AgentTesla)", "value": "a626d4f5a6e98ec1aeec2151081914748858e2af0eae8db58464b9922f916971d8b1b9dc888e460b6c5d90d6bbc7f77c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708862, "uuid": "809fb337-a91d-4f6f-b0e5-9eeb001cbaa7", "value": "T1C4D24AEA6B9C15F2CBADF631E2D15140677396B3A510DE2F9BCE214319037422BD42EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708862, "uuid": "46ee7b97-6e25-4146-923a-d529e8bc7fd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708862, "uuid": "39a1d875-7332-40dd-b09b-c5e1de71451a", "value": "768:JagqU22/pOlDU8G8CPqS9elBTSHrbKNbG7Gfl/qCAQhQ:H2NlDeSRI3qLqCA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708862, "uuid": "2b06387b-cc8b-4fc0-9347-6fc6379eadf3", "value": 28952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708862, "uuid": "683f27e4-7a3c-4b08-ae34-872e08aeba8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708862, "uuid": "791d3480-56ad-467f-a311-05063ee1282d", "value": "ce208ccdddfbf4423b6659c108795bdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0f1edb-e865-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626680759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680759, "uuid": "4687a458-7f92-485a-b5ad-2cbb4cbba5ab", "comment": "Malware payload (Mirai)", "value": "859b1f0ab34ad5d33d1f408da1017198", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680759, "uuid": "f4f84fe8-3d68-45ff-893b-64dc18cdedfa", "comment": "Malware payload (Mirai)", "value": "389fe99b7e3e22d7fe880c61cbf5d1f1f652bdda009a1887220575efa14db5b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680759, "uuid": "dfe8aac2-c17f-48b4-a7cc-c9612539b166", "comment": "Malware payload (Mirai)", "value": "a1755401aa07c2027c472b6cfe88823767b3f50d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680759, "uuid": "753d99e6-86ac-43c0-ad18-dd41fa7fa584", "comment": "Malware payload (Mirai)", "value": "9fd441a2ae4454a50b6f0cadd0be30fc00f1a16ce59e5c2679f11c6423e0ccf1774caf515e4e8cb40bcdf560ce616f3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680759, "uuid": "f44a3529-c0f1-47cf-ad05-2cd6dce44d5e", "value": "T101C2D020922F8CF3C2A04D3A463AD54BF29E56FC65F76A1F4E10D738B6897044E78796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680759, "uuid": "4e14a945-24e4-40b1-ab4b-15a628af391a", "value": "768:IcUZ8EuqLsNVrwCWGQB1Gm1UphsCvoQ/7y21EVHBzs3Uozq:3UzunrDGB1G1pGCQu7yzSzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680759, "uuid": "e317aa27-6979-42a4-83ad-0e6b53f2ca76", "value": 27468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680759, "uuid": "f8f8c7d0-f2e8-48ee-9f2c-d531da47ec7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680759, "uuid": "4fce6b73-629c-4f90-99e1-a965604d4649", "value": "859b1f0ab34ad5d33d1f408da1017198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0202338-e858-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626675371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675371, "uuid": "302ddb50-bc5c-460a-8589-4897b2de2298", "comment": "Malware payload (NanoCore)", "value": "43b5bced2899386271e3191afb01abae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675371, "uuid": "ebf2f667-fb48-4fd2-8304-7d1b91096c08", "comment": "Malware payload (NanoCore)", "value": "38c1dc9f8fac7a4dfa00c57da4cc63f1b373a1e4a351dcded7cf08ca95320e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675371, "uuid": "5c50ca0d-90e2-4aba-9676-0df31d3f2e87", "comment": "Malware payload (NanoCore)", "value": "5e9a2c6ccee4d88c9d30e02d812034eda99f039a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675371, "uuid": "b5e9a57c-8597-4dbf-bc3d-47a727afcba7", "comment": "Malware payload (NanoCore)", "value": "e568ebc831e1f6eeda46d7a07c76ca9cc4a1deb2c3b11b3e6d5f94f2619191dbfb10af5b70069b796ff347ef24048222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675371, "uuid": "4b8a962a-e728-4047-9515-fcb0a4e77cef", "value": "T17425016AF612B7B4E6435DFDD8A1F14063A57D6BC773AF08634C330B447A6439A328A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675371, "uuid": "0f7a5b3c-763f-412b-b21b-55a2b627df44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675371, "uuid": "5bc764bb-6fb9-47bf-b237-093697ba7338", "value": "24576:6sFjFXeCUjY14YVxrq8g0vLiKnQGoTW2HuckxOTGP:DDeCUE148s87vHQGoTYOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675371, "uuid": "5dd2ac03-f997-4241-b7a1-a11b66de28be", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675371, "uuid": "9a0ab772-374e-4545-80a2-510005222c2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675371, "uuid": "012992e3-5a49-43bd-a345-89e9b978d258", "value": "43B5BCED2899386271E3191AFB01ABAE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981eb18a-e88c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626697611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697611, "uuid": "4398971d-047a-4c74-afc5-d1b01a03e907", "comment": "Malware payload", "value": "351b843f627dad02a1e21178f29b59ab", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697611, "uuid": "906e0e3d-55fb-40f4-8bbb-7e607010bda8", "comment": "Malware payload", "value": "39c1e12e0ada85fa835b623a4698345bf95372bea57a7d3a5070ea1d5d5d825c", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697611, "uuid": "8a8ccf33-ce7d-4735-9307-fffac814f22b", "comment": "Malware payload", "value": "801db68232be9a0d7b89a834a18d0d1ecf4cdeea", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697611, "uuid": "84e0019a-3445-4ff3-8f3d-2c7434b7012c", "comment": "Malware payload", "value": "8da6eacc4638c813c16e975b59a8fada15a88896314bf2020b908cd93bbce6b721a9aed3f9f78ac2f306bce28d78778a", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697611, "uuid": "1faa8f09-fc4d-4e28-b4b0-53d2cb8b0813", "value": "T13A0152EA296184C0C19F381F2D9E5A4074B2933910A9D88CC01EEE4776B4D1C64BF5F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697611, "uuid": "b4c293e6-78a0-4f0e-b7a1-44108ecab7e6", "value": "24:LFo8C9Gv1WKDjMIKHwhWv3VqCAuoMLttCE1Ys:LFnC9GvFj7KHwhEVqCrtAEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626697611, "uuid": "224bf12c-9733-401b-9a3b-29afb96288bc", "value": 846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626697611, "uuid": "f7ba3c0f-bad7-4390-97d1-10cb7c29e7d0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697611, "uuid": "49df1950-f4a2-401d-bc4b-f48079a0e224", "value": "JSdropper.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398706ee-e8ad-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626711625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626711625, "uuid": "76bd519f-fd29-4860-9a64-476321b4067d", "comment": "Malware payload (DCRat)", "value": "8d09a913eda90188353e6d640ab71a63", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626711625, "uuid": "4fa9e79d-3e2d-4d7b-885a-39524cc47870", "comment": "Malware payload (DCRat)", "value": "3aca6d6c95682fe646903a7d11630e679386c41b36dcba61245c1b74d3531efb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626711625, "uuid": "120207b2-1b5d-4d92-bd28-c0a655226489", "comment": "Malware payload (DCRat)", "value": "fccd07d6ffa4fba9678b000b34ae2b2f419c804a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626711625, "uuid": "3f8d0413-5952-4fca-9abe-f1b02719f640", "comment": "Malware payload (DCRat)", "value": "1578232f79040b92cbafb5872af96df138c6bcc8c484f51bf3055ed3ff15829154295808fd42bd46814a7b14dce3a08e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626711625, "uuid": "580dc915-9954-4aa6-bd3d-c3f6c0335055", "value": "T1E2654A027AC4DD21E0691637C9EF842447ACFD023B62CB1B7AAE3B5D65153A35D0E6CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626711625, "uuid": "08fc1662-9413-48f6-ae9a-68bdcff589b7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626711625, "uuid": "9b0fcbeb-9d28-4dd7-b860-c6109e555aee", "value": "24576:U2G/nvxW3Ww0tlYvhk8mtcbjQe0cjg+nufbNfLNsnop+48:UbA30I+W041847", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626711625, "uuid": "a48589fa-d39e-4ede-b4f9-46adea10e378", "value": 1422003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626711625, "uuid": "847c6f29-0740-4cc4-a49b-45ee2a620994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626711625, "uuid": "73ac7e0a-6ea0-4f91-a1fb-eb2ed41e48cd", "value": "8D09A913EDA90188353E6D640AB71A63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc15661-e855-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626674159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674159, "uuid": "9d8a0208-387b-482e-9f58-c21ef63e7fa4", "comment": "Malware payload", "value": "b20d9ced5d063ec28425551a520ac59d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674159, "uuid": "3d010c54-caf6-49a1-b880-66cc4ec46d5f", "comment": "Malware payload", "value": "3ad516ed1d59d2a83e03dd014de474999c1d20885639cd2f77c1108c636636df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674159, "uuid": "a75e9755-3aea-41c4-8e23-aabb8a0d584f", "comment": "Malware payload", "value": "f6bfd3346ed28ef6ed5e45d89f6b1f89d8296b0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674159, "uuid": "74f5202f-dda6-4dca-b8c3-2623e2a6ab13", "comment": "Malware payload", "value": "454ebac9a94c0247b7bc29764a646a230bebb36f32a93c6b6ca91d00c5685a808100e3247db3e48fa39ac32fe37edd91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674159, "uuid": "23344435-be8d-409c-9a61-8b26d8b4955f", "value": "T130059D6C324079CEC4378E338994EC71F6906C664707DA0398D77DABBA7CA979F111A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674159, "uuid": "2bd2f865-ddb2-412d-9fba-f17b0555d8fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674159, "uuid": "2a41783a-fd63-4c35-a666-76acf0415672", "value": "12288:sJzJBoc+ZPzbmhJP8jA+09+Ny6UMZET3jcqd+lHLN3BwspCVad5+v991DqGTR:sjec+ZPzbmf8jFNu4ETQqwtBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626674159, "uuid": "dffb1807-9f33-458b-934e-3405a2ab2791", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626674159, "uuid": "e3196eb6-7582-41fe-973c-943972215df9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674159, "uuid": "8942a0b4-9846-437d-a432-a7a66f61054a", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6190785-e840-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626664992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664992, "uuid": "cfc04979-c367-437c-9be8-f458bafe9125", "comment": "Malware payload (Mirai)", "value": "4e5dea58d0826e70505eb361c8b325fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664992, "uuid": "e7c5d198-6f77-4548-af7a-da04d95e6ceb", "comment": "Malware payload (Mirai)", "value": "3b9e8280105a4afe38b1736d31e038442f24fe7e5c5cdc00dd70b12774c9fa9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664992, "uuid": "91695c41-6d90-42ee-9da4-0e07d379d8ab", "comment": "Malware payload (Mirai)", "value": "02375576dbac3bce91bbc3805d890c8f917e1d29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664992, "uuid": "3df3b3e9-de20-4685-a0c8-b8b097d8c99f", "comment": "Malware payload (Mirai)", "value": "4d8f6b941a2e1be7882ff7a504a88fd4b65d6899b9f6e69e38e8ddf5b2bfac1a6d2a632b66a20e229dd93393f6922219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664992, "uuid": "4c505486-f229-4e03-8fd6-4bd1660fa476", "value": "T11B13F152E8C25829D472D2B02B104DD97F5FFEC99A826BC82E1A92014A44DD46ED4D8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664992, "uuid": "4b92acdc-5646-4b24-ae88-9269347271ad", "value": "768:0c0bpO3BmPUFhdXrnulojB+z7L/K3h1jubDgSz3LU7sKE/5qmiamv+w/ao9+:0c5BrFhNnLN+z7LS3h1jubDgk7nymBm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626664992, "uuid": "6effe34c-3c2f-46f2-b5cf-ba4fa67c6d67", "value": 41672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626664992, "uuid": "4d0fec0f-cabe-4f7a-846f-9ce55d3add17", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664992, "uuid": "3dc8a5dd-e4de-4ba2-a182-aa38c208ba51", "value": "4e5dea58d0826e70505eb361c8b325fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecd8da3-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735874, "uuid": "19d9cd89-9902-4929-b1c8-0ad404d33f21", "comment": "Malware payload (Mirai)", "value": "7fc4f223ad157bedfb2991dbd38b79c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735874, "uuid": "8fa1a346-c4a0-49c1-b723-cbcb54d949e3", "comment": "Malware payload (Mirai)", "value": "3c5cb32e2032ec5b533e81ebbce79f5654f37263703944ce26098304e1d333e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735874, "uuid": "4607b568-00cc-40ea-96f4-1e2b1598bd23", "comment": "Malware payload (Mirai)", "value": "5ec3f4da569b9702191b4bfc2f11987ee78a05cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735874, "uuid": "b36d70a2-d531-4743-8393-f9a82140b6d5", "comment": "Malware payload (Mirai)", "value": "4d3ef863ee012ec663f183acb44c4a5f450baa2366b279ea2dbcd74150025ac6354cdf0429744226e4604db3502d6958", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735874, "uuid": "8abd4090-a0fc-4fb9-82df-596cf240c575", "value": "T1A6233AC4B583F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735874, "uuid": "c84b572d-8c8f-43a3-a2f1-81b51146b9bf", "value": "1536:4LInPCqAAXJLE7cxtdG8NCqBNM7vk9YXPSP0Hoa:FCqxpE7cxtdG0Cqvsvk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735874, "uuid": "4f6a15a3-caeb-47c6-becb-fbdafb29c290", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735874, "uuid": "2b106d31-caa9-4932-b768-249b43066be9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735874, "uuid": "7af474b8-41cb-4802-bcf7-5a7bff32b5bb", "value": "7fc4f223ad157bedfb2991dbd38b79c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50899fe8-e8e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626735286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735286, "uuid": "8a5163d7-3d98-4922-b8f5-198ca21bc681", "comment": "Malware payload", "value": "f2a70cd70e1b15cf34903bcef46e2202", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735286, "uuid": "5c00ebbb-deae-436a-852b-9f94906f0825", "comment": "Malware payload", "value": "3c62996e0dc98bf3e9ebbdcf8c89f47429fa7a0285ddcd665923b70b06d4586a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735286, "uuid": "e7c102a6-6a12-4864-aa3d-eb5a2d71629b", "comment": "Malware payload", "value": "a3136e4e4270d788e500ae984d3d8993e6cf6c91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735286, "uuid": "19beb926-eb88-413c-86de-baa5a4f0145c", "comment": "Malware payload", "value": "4bf06781eef95cd6267673c21017d015090596d2d8da121bb24513772193cf8e1cb5f4518ad92a015ec53f4b4568b17c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735286, "uuid": "0e5af09d-1cec-4346-88ff-4c1343afe255", "value": "T1963523B1B984CA33E0FE5539E8F456C2286FB4655978576E22841EDF2E706D04EBE303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735286, "uuid": "3c694a7a-a2d8-498d-a16c-61f2bd51c96f", "value": "ae2db6c03e6b0c919da78387a2065daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735286, "uuid": "1f5df6f3-a250-4116-a424-f9accbbcdae9", "value": "24576:XoxYuUuoGy4q4T6zSDvSyGx/NLWUaWozKHjxW47ZBnIJFCCQ3y:XoEuXxlDvfGx/faLKnIKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735286, "uuid": "0055dd8a-6be6-492b-b470-aac592a6abad", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735286, "uuid": "57c0c1cf-9aa5-464f-b697-25df9725da87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735286, "uuid": "815a0ccc-d792-4718-bce6-c00c3aaf7406", "value": "f2a70cd70e1b15cf34903bcef46e2202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6daa5d-e834-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626659741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659741, "uuid": "196bfef8-82f2-446d-9b48-e596c6bf174f", "comment": "Malware payload (Gafgyt)", "value": "575ff163998a8da7887e97b2b6047be9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659741, "uuid": "7258690a-a90a-4ceb-90a3-0a0e86ee918e", "comment": "Malware payload (Gafgyt)", "value": "3d84abd3a6772c24ccaa6e31d079651bfae5e9c732457f5ac4a9277f10bc0759", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659741, "uuid": "58c41eb7-2757-4b57-9b62-a1fde74498d6", "comment": "Malware payload (Gafgyt)", "value": "96a9bd8813fdf5c00034254fb82fe6858dc22a20", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659741, "uuid": "5544d2f1-d528-4bc6-bb55-5926a10a62c8", "comment": "Malware payload (Gafgyt)", "value": "d4f174253771748b3a4a5c78b2dcb2abf32660ae7de5c056efc4d9ed294e8b4113efba57ddc1c7d95cbd69cf3e9df55e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659741, "uuid": "de7e0e2b-2c29-4554-8429-66ac24e96ea8", "value": "T165B33B37A661C93AC04351F026EBD5B29C23BDBF0B32219A73947DB56F368C61D98B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659741, "uuid": "fb61c41f-5895-4bd4-8c82-87571421b874", "value": "3072:AFiruPzD3bGFkq5jFfki+qzL0EQIsmVOuf6Km7FnVqfJXFWbNb:A1D3bI5xIqfrWuHm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626659741, "uuid": "4d742622-1a1a-4a15-8e0a-b430aed64bbe", "value": 116055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626659741, "uuid": "657ea73d-099d-40c8-9b6f-7d120fb85e34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659741, "uuid": "b55950fc-9e5f-4639-ab22-95ac7ce5ffb3", "value": "575ff163998a8da7887e97b2b6047be9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49db5efa-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (StormKitty)", "timestamp": 1626708646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708646, "uuid": "98b64bcb-b04e-482a-800f-635f7c0dc3ba", "comment": "Malware payload (StormKitty)", "value": "1ee5c7e3b59f02fef1b0f793d2196afd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708646, "uuid": "e5820eff-1927-44e8-b900-458e420d883d", "comment": "Malware payload (StormKitty)", "value": "3f46e10e5fe376b995e2947d1be21955aa8341f39d80cca737109fcf2cf2bf3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708646, "uuid": "77ef1783-555f-4046-93fa-885b9d13bad0", "comment": "Malware payload (StormKitty)", "value": "3f1a1ce12dec33f946079a532ccda8e0c72f2c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708646, "uuid": "a65a4478-75e2-457f-af89-58d0ca8dacbd", "comment": "Malware payload (StormKitty)", "value": "4770d59197195dd0fcd45e95ebb41bcfb798463b279c0d3dfd64b197376d1b3b2ccf2df2365d1e17931f8ee028cf0bf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708646, "uuid": "b45c8f73-e13c-41de-a084-7f9e32a2bdce", "value": "T15C458C50232B4F58FC7EEB766438000457F5B80BD32ADA0D7DE610DE1A91F968AB6B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708646, "uuid": "f1d4cea7-ad5a-474b-84cb-1e6daab62074", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708646, "uuid": "5588bd29-3e60-46a0-bacb-49ba4c298219", "value": "24576:1kcNn8Y5TrvvDB/mF1BVB/9ogBzVf/ppYbItJ4Rvk7xz:l5TrTcBVl9BTpTrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708646, "uuid": "46d85ea6-fece-4ed2-b8ab-603c9a154902", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708646, "uuid": "683c41af-cf7c-4197-9a25-57ff3c7a11da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708646, "uuid": "b64b9056-efab-4539-8bb8-2bbc5a3bb14f", "value": "1ee5c7e3b59f02fef1b0f793d2196afd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5198f443-e865-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626680742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680742, "uuid": "4b2ddf85-7885-4ef3-9c9a-94590086d76c", "comment": "Malware payload (Mirai)", "value": "d907b71499c3fc05f97d86a6ed305725", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680742, "uuid": "700af5fd-6336-457c-a1b4-1dc02f7b1ced", "comment": "Malware payload (Mirai)", "value": "402048a55a66f13a70c488286878b9990e46626a33e526429e5b5cf19ac88d56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680742, "uuid": "82dd17f5-e13a-4cd6-9b7b-5f9b436e1e7b", "comment": "Malware payload (Mirai)", "value": "9499183399b075aa7c58f7917a09cdd6bfd4a28c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680742, "uuid": "1579c665-800b-4b28-8c02-fd017d74ccea", "comment": "Malware payload (Mirai)", "value": "53ca4afc066444acd80658f248e2664ba59279412716b3a4160141fcdacab7b1f81beb1d5d828dff8035362093c89f73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680742, "uuid": "2ab3f6f4-784d-4b63-be79-5672e39a117c", "value": "T10EE2D030B3114921C9705C3CAD8A5A93D4A1AB7AD5EF254B2E5002B9A9DB007E7B6689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680742, "uuid": "faf78966-7fb3-45b0-87ec-8f2e782402b0", "value": "768:O79IhZJ3+FAvjhbsGCbzNJznWd6j02lm0wxiUnXt89q3UEL71:RJHCXPP02A0wxLFLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680742, "uuid": "c4b10d4c-e333-4cc3-9eb0-c00221720bd0", "value": 31996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680742, "uuid": "9c56b6eb-1ba5-41b5-9e40-91ff18c02220", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680742, "uuid": "c0933d12-75e7-4b1d-9d5e-9d0504891c94", "value": "d907b71499c3fc05f97d86a6ed305725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d219c515-e892-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626700285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700285, "uuid": "a7ace033-f5f7-4723-afbd-927b7cd171c1", "comment": "Malware payload", "value": "59e2fd2ce7f30f5e5bd8300cd86dab47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700285, "uuid": "f66612a5-edc3-4051-b0ab-756da3c0cb91", "comment": "Malware payload", "value": "4072fc745ae1b976bfff8fdfdebdac6db5e33bb4f63507b4d56ab67b98c6db65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700285, "uuid": "aa1081bf-1c77-4e19-883e-f62901a630c8", "comment": "Malware payload", "value": "bbc0545dcfb7e5f2fda1e46f82054b9e4ef2f599", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700285, "uuid": "8773f475-f1c0-4c2e-864d-4fd5c5784f02", "comment": "Malware payload", "value": "0c8fa20ccfc453fd4c4351ac74765aaff1618f62f181a2bef46aaaf7d8190a3dce1c2a422e132c4313bd4a4c58d071f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700285, "uuid": "534a104a-bbcf-43ee-af80-2f084b6cf5e9", "value": "T1A425F122222BA118DC3887F51C28D1B12BBEAC2A566DC63C2DC9BD7F7D7367C5AD0550", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700285, "uuid": "b10126ca-5c39-46dd-ae5d-27d5ea05093a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700285, "uuid": "46ab5a6f-f978-4b91-bfb0-b2fc93a64b06", "value": "24576:agvDBlBPIOBPQZwLPMA9i31bXQRF+4kbI3tua2WSRO:7pPDPHLPql7QRFW2h2xQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626700285, "uuid": "8e9ee79a-dff6-4a29-8778-3be4c6642fe1", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626700285, "uuid": "713a14d4-c8b6-4d21-a945-64a6f25bea31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700285, "uuid": "22ecf873-e6ff-4c1b-ab80-b57cc290fcf1", "value": "REMITANCE 103_03435_210408_BSA_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66769402-e841-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626665315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665315, "uuid": "7cdb7e24-8eeb-41cd-968a-22549d26163f", "comment": "Malware payload (Mirai)", "value": "4b5a8395b2b3e9dd91154b1a77762cbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665315, "uuid": "e212d283-9c15-473f-a580-e86250c52831", "comment": "Malware payload (Mirai)", "value": "4134674f3207a9cf22be11ce44e0abd4eb76291f1e6cf489c1123c3b290040be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665315, "uuid": "02fbd44d-8ad8-412b-9df7-51ae8c00e6a9", "comment": "Malware payload (Mirai)", "value": "7784af449ab5afa7a68768d72151c719fe42c26b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665315, "uuid": "f3366d34-0e0e-4ee1-923e-2a256af69c23", "comment": "Malware payload (Mirai)", "value": "e0dc44605696c2c5549d961468a63ced876cdfd3520b33f2ca3860b0ec093a5e9db7a5c4ae168967581f939f70f0bf30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665315, "uuid": "5eb8424f-220a-4453-b2d9-e3734fdff274", "value": "T121E2D172F56C12A9C32AC33604975CF542DAC79591CD59DAB5820504BDEB028FAAF2CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665315, "uuid": "7c80903f-c062-406a-bdbb-a1a6edb5f5b3", "value": "768:3gdHY51OkSuptzVsfUqsJLj4lR0AvpBNXqdWx5bOlPejk:Qd454atzVr48IdK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626665315, "uuid": "57449ccf-a312-4f4c-901a-e311ee253987", "value": 33964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626665315, "uuid": "dc32992d-54a0-4531-8819-e52f0de23ff5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665315, "uuid": "21b98d8e-1927-43f6-9f35-1bcb11522615", "value": "4b5a8395b2b3e9dd91154b1a77762cbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355fd31b-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626708612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708612, "uuid": "7b548138-5dcb-46fd-a50b-399f91fd8726", "comment": "Malware payload", "value": "8ad11384fc61815a3779fb6ef0fbdc11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708612, "uuid": "cd2f6d27-f095-4195-af85-b4d6c1f949fe", "comment": "Malware payload", "value": "413cdd0ae3d9ba60b132796a63dad08bea31d309157f5497380ad72cb3b0ae27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708612, "uuid": "f5223afe-2340-4f18-b150-869b5dcaf432", "comment": "Malware payload", "value": "43f3a5e2d8def7698d368153ab7cc009370a78c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708612, "uuid": "63e7aab9-e5dc-4b7c-bcc9-ab7c1b0b7e90", "comment": "Malware payload", "value": "561ae1ce8f616aac97361986e3d7d68f66543872a041db5b8f2da831fbeb5aba311c9a6b86c0e6965cdbd7e2724a1a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708612, "uuid": "e3bb9ab2-aadf-49bc-ac1c-297f5e169394", "value": "T10325F1262227A104DC3883F91C65C1B12BFE6C29666DC6782DC8FD7F7EB267C5AD4580", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708612, "uuid": "bbdb6d03-510a-472f-8728-3e8dbef731eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708612, "uuid": "89ab2edf-b96c-47d8-994b-9fcfe000709a", "value": "24576:MvDBlBPIOBPACxrOh8bNwMutCBBAxA5lTIUq9:0pPDPLRU8BOjW5lcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708612, "uuid": "2830b579-8306-4e07-884a-58640cc1a452", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708612, "uuid": "ab8345ed-4c66-4c62-8628-cc37664f3d7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708612, "uuid": "bf3819c6-fe85-45d9-b025-c3a81c0afb22", "value": "8ad11384fc61815a3779fb6ef0fbdc11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d13cb4-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Amadey)", "timestamp": 1626708772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708772, "uuid": "23483b8d-986e-44d9-81af-b29b678c91e4", "comment": "Malware payload (Amadey)", "value": "6738c904ba78a2268a8950152a6c7448", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708772, "uuid": "4ab37dad-7091-4ad5-ac03-661f1feb0be1", "comment": "Malware payload (Amadey)", "value": "42054b960727fbd72bde57e8903881e4239e9500f1160ca298e10a1b438698a8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708772, "uuid": "1e93ddff-15ad-4f2b-a390-5f4605d34495", "comment": "Malware payload (Amadey)", "value": "f2e8d6fdaabbfedd6fca2a7676205756b0c72d3c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708772, "uuid": "28b68182-f85a-4bc1-ba8f-0039844b702f", "comment": "Malware payload (Amadey)", "value": "fb17a2353251dec3e65490f5d16a65f4bf31b1ab95e64eab8e2550d0e063c6e9555e5a11d96de5f1754222d5cb65b9aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708772, "uuid": "96e71f60-1e65-4747-9d21-981e17eb1992", "value": "T12726236353A11182E4D28D398933FD9131F34F5A9AC3FCBC999AB9D536325E4E202D63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708772, "uuid": "08b11c3a-e21a-4490-8051-5c742e7f5b55", "value": "f8df424f905860bc01b3ba767a4c550e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708772, "uuid": "6e9065cd-bcc9-4077-a02c-237661bea967", "value": "98304:evijXqgHXT9Xo/9xOtLIfqFbco+g5f1JGkV7FbTe7:evol5Xo9xOrb3Rff99C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708772, "uuid": "0b4fc842-4b7f-4dcc-94ee-deaff307180f", "value": 4470944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708772, "uuid": "b450d501-d879-4da7-990d-f3d514ad0802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708772, "uuid": "0f2c3fb4-7b98-4eb6-8c8c-5359925ba870", "value": "6738c904ba78a2268a8950152a6c7448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e4969b-e8bc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626718031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718031, "uuid": "f049c536-bbcb-4d9b-a938-c2e655a397f4", "comment": "Malware payload", "value": "aaf8dc97a7d39c46fe5ca367e972edc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718031, "uuid": "49ce3c6f-0cff-4660-a6d9-dcf72236344b", "comment": "Malware payload", "value": "42bb73792ff967562c298fa127e24ac9ee47f11fefae737a12eaa491f46f85f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718031, "uuid": "8ac70a4a-28f9-4736-ab94-5c631beb5b56", "comment": "Malware payload", "value": "51c108c9640344185fddc8c732ec2996b429a10a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718031, "uuid": "8f948da4-a68e-4b8a-91b0-73ca0ad5c091", "comment": "Malware payload", "value": "1585e0a57f603c8eb99f842488c8789adfd3c2b4d97ecba12aa92ac4cf02737db58b4b7cecb355069932bbf9accbeb8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718031, "uuid": "78400c38-8602-46ff-add0-6b1543f6e47f", "value": "T141157C22E3D0543AE67B1A798C0A95F059267D533C68FC967AEE3F0C9F312613D29247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718031, "uuid": "f4af3ceb-db56-4099-a036-3d6ebb0b8d97", "value": "7fce049e3b7a69eaa13655a22e62310f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718031, "uuid": "92c26079-ebaf-420c-a418-bd5e36152659", "value": "24576:6GnYY3RMu58Ru1tipkWybDaU0sSw764z:6Gl0UmsSw76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626718031, "uuid": "e88c9abd-9a92-436d-8e47-4416a129fc43", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626718031, "uuid": "907c7283-5437-4b63-a9b1-23cd33bca09a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718031, "uuid": "77f7d977-c881-4ebc-add1-1106753ba144", "value": "Doc_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c2b742-e8a8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626709624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709624, "uuid": "a17db94b-51db-46e6-b6ad-0ab627c1a7bd", "comment": "Malware payload", "value": "72d9c62e4483519df1303fe0c46d16aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709624, "uuid": "65a103b7-4b95-4d80-a4b5-0e67ba39ca74", "comment": "Malware payload", "value": "42c8ded976a7c9f295888220d4d2fc273535f1fa15e6e25cfceaf454188f7895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709624, "uuid": "7d656240-c1b3-45ea-8355-a9f59720ecaa", "comment": "Malware payload", "value": "12093edc01bcf89eb7a9758d1392592fb273de35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709624, "uuid": "df4d0b12-e589-4e6d-9fb2-538d13699cc8", "comment": "Malware payload", "value": "7cc3287a30342b4bcc3e034a2a419ce21138bdca653d6693fb3af7343719578bbe82c33ae56b43b18076a23f2d6b3122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709624, "uuid": "919a07dd-d11f-4b78-9919-6ed3978b08e4", "value": "T1F434191E7A05E81AF9DAC4B73019E0AB62127C7781454E0B720C7F71D836775AC6BEC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709624, "uuid": "be55404f-b94a-4ba5-b033-348f88a3bc85", "value": "e9f7dd0da1a2a1266893e1ae4ef42b67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709624, "uuid": "e499039e-57c6-4529-bb00-ba74a5e50b92", "value": "3072:c3BepJlZa/E5cv3MRwqmVqY+9uiwBDa1Gh7HJlZapGBR:eiUEUMyqmVrTjDc4HP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709624, "uuid": "7feb30e4-01c3-4a55-badf-e36bcdc0c8e8", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709624, "uuid": "1990e2cd-285b-41aa-b4e9-5ec7aa18e179", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709624, "uuid": "cc1a173b-0231-4936-a0c6-078f996b2e79", "value": "PREVENTIVO RICHIESTO (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cca6bb-e86d-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626684161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684161, "uuid": "8c5d4ada-0045-4b20-b12e-878f32487c4a", "comment": "Malware payload (ArkeiStealer)", "value": "8e9a79a294b21d4c3062ff235eaa941a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684161, "uuid": "a28b02a4-6344-4f51-be9f-1b39a028072b", "comment": "Malware payload (ArkeiStealer)", "value": "4315d3d65c9e358666612573a25b54365c68fa3779dedcfb8bb6b58a76a0bdc7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684161, "uuid": "f67168a6-585c-4879-ae23-bd22dbefaa50", "comment": "Malware payload (ArkeiStealer)", "value": "3548d727aa9a4ae82d81dae058b4da2ac4b78978", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684161, "uuid": "343496fa-1129-4aee-894b-3994f1ca420c", "comment": "Malware payload (ArkeiStealer)", "value": "45d014b2e5b06a55c7001972f63d24a9aec1f682a24dd07801328494a2d2c89964636504b21c103fca8ca3229e265161", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684161, "uuid": "b006e25a-acf6-4ff2-a063-bf1588a59dfd", "value": "T16EF412163581D463D2B58D3048FAC275257EFCAF6D78490B3A8836CF6D712D2A9AD313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684161, "uuid": "369597fc-f1b6-4bed-b0d8-7958116c091b", "value": "b0fe27671bb60a5d31189716fdcf7690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684161, "uuid": "3632d238-aca7-4c22-8931-7a14e7a7b6c6", "value": "12288:8n9QWLSpodiQI7dWZefW2LLNpYutEc+lTeLhb5bzWYObIkqqfipYYyM:89QkS2iVDhDdCaLjbPObHfifyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626684161, "uuid": "f32efab3-13f0-4a15-90b7-04bf0360ef10", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626684161, "uuid": "7412a422-9aba-4567-a1c1-a260ff7517b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684161, "uuid": "7b201b6d-760c-4e58-8292-c3d83cdd17e5", "value": "8e9a79a294b21d4c3062ff235eaa941a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e586669-e835-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626660013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660013, "uuid": "e081d525-9fb5-40fa-a5e5-e50bbec43aeb", "comment": "Malware payload (Gafgyt)", "value": "87f6285d6a0c077ee6d1f175fa52d046", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660013, "uuid": "e9b04fe9-dab7-48a6-8fb7-098e6719b30e", "comment": "Malware payload (Gafgyt)", "value": "442d3698ade3bddcfa4b38baa819112f08f3bb8fcec6524a27df58f74aaf7453", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660013, "uuid": "e0443ffd-9209-417c-9f2e-621cc8afa8c6", "comment": "Malware payload (Gafgyt)", "value": "32ff7898deeb7b9f5254d60639fe0b46c9683ffb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660013, "uuid": "959d59b1-d8b7-43ba-88f8-464cd8994815", "comment": "Malware payload (Gafgyt)", "value": "9ee91ffbe32307b4724b7c38462267e7ae42673c23f014c4ad5c3c114ec9837be4c0547434d30180ac9a82fbea5835ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660013, "uuid": "791954b6-2085-48f2-9991-fe3bf056170c", "value": "T118B30837A61C0B43C09B55F03CB76BF24F69BDA312A621C0A21DFE804B73AB52555F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660013, "uuid": "8e35f76e-1e3f-4c35-8372-3004100ce8c1", "value": "1536:sApTuz2Zmkq0juP/n3Ani7gtqsZzwaMV6tQ6UcY4fmmi4QcuLzqHniPNb:VNRZm5wJqsZzwHTcY4mm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626660013, "uuid": "0a206f1d-a4ea-4efe-b0f3-b2b435f070e4", "value": 116498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626660013, "uuid": "a78da041-9422-41d6-aa2d-baa1ed051bfe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660013, "uuid": "48f7c898-e6a6-4297-8139-370c8a4a6c42", "value": "87f6285d6a0c077ee6d1f175fa52d046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26e1557-e840-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626665013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665013, "uuid": "24518b01-d1a4-418c-9357-3c48ce866f26", "comment": "Malware payload (Mirai)", "value": "7261b58feef5c9a1b3ac184a8675b61c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665013, "uuid": "a984dcbc-a074-4e34-8d90-26e35cc3b8a4", "comment": "Malware payload (Mirai)", "value": "44db62e4cf501db9e73b2f0c1ed841c330e2c35136dd12aacf222d075c1c1085", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665013, "uuid": "30444a6b-f490-4505-9a5f-a3b09fabbd5f", "comment": "Malware payload (Mirai)", "value": "aa142f5e4af5bd30501d52d545e8f84191c2a6eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665013, "uuid": "d5984b22-05c2-4072-a335-45dfe0133bd6", "comment": "Malware payload (Mirai)", "value": "ab56cdf6236d38c5b2bebcc40ac534d59d6ad727173e02d690c3afb680699e01e30b0a827384e6104fd2e08371a16289", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665013, "uuid": "5d1e0012-5055-49a1-880e-9aae1290c5cd", "value": "T182937CD5B4016D2EF80FE179511A0E09BDB1A3901F830F2BF7A6FFA76C620597906D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665013, "uuid": "5643188f-a643-4140-8390-d68677904b72", "value": "1536:StyhycDo6+T/Ylu2n+pzk9NJrCg1qwG2zkeykcQ3i0mW59RM90vr+8hKAISLIVg:aIlu7p4Frj4wG2oeykcQSzMG0jxzIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626665013, "uuid": "678b0b83-b64b-47d2-8e13-d5f6c4c3642a", "value": 92500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626665013, "uuid": "5d7efbe9-5293-4304-b3ea-6cf3ad048cca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665013, "uuid": "f73214b0-03ba-474b-89e1-d5e7d01fa5e7", "value": "7261b58feef5c9a1b3ac184a8675b61c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0ce55e-e88b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626697005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697005, "uuid": "fb7bbf5a-0246-4c05-85b1-2fe40d98f338", "comment": "Malware payload", "value": "aeb1414374701f3e08e62a5310f779de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697005, "uuid": "0df016ca-3135-40f6-b491-d63c6fc543f9", "comment": "Malware payload", "value": "454d7df8582da046d25247ed6d027df56050472192d11086b837533f6f23b819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697005, "uuid": "7886a6f5-de4f-49d7-b51b-63d63fc480c2", "comment": "Malware payload", "value": "22073ae48056abf5e14c5950493dbb27b91f8eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697005, "uuid": "7cf5b1c9-0fbd-4161-8356-e44e2acd747e", "comment": "Malware payload", "value": "31ada1f4839199d20d8ee60c77c7abb38c6e359263ac4a63c8164c1c141aa2aa893e47ae9169dbea630d03d745e0bc0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697005, "uuid": "dac5f90c-6cf0-452f-a963-075c8be23b2c", "value": "T17155BD2875855A5BC2329673C5A4E332FEF10CA66203DD0A1AD7FDA73E72603258DE1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697005, "uuid": "d5d57fad-a7ab-47e6-b2e2-a26aec4b9b0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697005, "uuid": "828be4e3-0164-4224-9d66-1c6669025e09", "value": "24576:89ZhJZKhZ+EIdgwhcpY81Xr5qlNKbx2Evry1/IxGU9uuV21ia:gNKhZ+9hGY81Xrclsbx2Ejy14GUuuI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626697005, "uuid": "847a1e31-d919-45a6-99d6-b3efb6658ccc", "value": 1369600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626697005, "uuid": "aa4090fd-3b28-474b-949e-eabdc398b7a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697005, "uuid": "eb43a39f-a62e-4a78-bfd0-47a9ac548146", "value": "UAE 4512003600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b50585-e855-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1626673828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673828, "uuid": "fdb38b51-4cea-4d18-a8de-44816bdcbc66", "comment": "Malware payload (CobaltStrike)", "value": "d4a8b43f0a149f03c2896efbc4f50e17", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673828, "uuid": "c0c66836-1c70-4503-be0d-4ffa1dd267dd", "comment": "Malware payload (CobaltStrike)", "value": "45e855c9083c164f34e950d5192606f1b5b3893835acd2329374b7d23fd6a8aa", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673828, "uuid": "04e517a3-42b7-472b-b110-34565c78314d", "comment": "Malware payload (CobaltStrike)", "value": "5d836a646a3961fe1545d0a5aba7223edaf9af63", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673828, "uuid": "1ed9524c-1c2d-453a-a17c-fde266fa9b1d", "comment": "Malware payload (CobaltStrike)", "value": "4994a6a1cc7d82c78b6bf8d0bcaf29bcc0dc0edd91afb91fee7faf8150bfe4c09fc107bffbe1aad1e38bb054fc45f70a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673828, "uuid": "d41163fc-c72b-4a49-acf8-d28819e654d7", "value": "T1FD24E0F4F9CE0EB5C496083A57A491688E12C377A9140A4F996C8BDD7E74FFC2939409", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673828, "uuid": "052a4938-3959-4d35-8006-3b83f076995b", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673828, "uuid": "f44b98da-ea50-40bf-9fbb-67ca47512278", "value": "3072:OV0OVLFY/Knp7hpbi5OGahCQlVgh4jsgVkyMK1jOMgUA6e6UI2E2w9fIE4rk6re9:O35IK9Ti5QnlVUayyMK1jVVWbKvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626673828, "uuid": "80e8e160-88a3-4d21-8ec2-ad33d42a9c15", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626673828, "uuid": "dd1c1f7f-6065-49d6-8322-17508561b440", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673828, "uuid": "462e0aa2-720b-4da5-870c-82fc49b3e5dd", "value": "d4a8b43f0a149f03c2896efbc4f50e17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28e2d73-e87c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626690756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690756, "uuid": "4f17fae7-45a9-40d7-b04e-0193fd8a0ff0", "comment": "Malware payload", "value": "597eff6540780213008d384ca831852a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690756, "uuid": "5dae2f2d-49db-44c1-af36-3d282dfc5be2", "comment": "Malware payload", "value": "464e32b273ff94e18247402fec1445dceb07fe8ea16490038fa64b9a23672cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690756, "uuid": "d712952b-b3f6-437d-98f7-3817dcbe52dd", "comment": "Malware payload", "value": "74fcaa7b00efdfc2056eb4651aea03c529d9bf8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690756, "uuid": "531e8507-c791-4ed3-965e-d4ed4d6e3ad9", "comment": "Malware payload", "value": "de5c56709ba823cf4523dd4fd4ec476ff8fc6695d827e09084d4c4efeb6a0179adf7c05dbb49c3b12656c55df068d3f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690756, "uuid": "069fa825-f35f-44b9-ab5e-78a3379f2e6c", "value": "T1E134180E7A40E81AFD96C8B73019E12B62123C7792455E0BB25C7B71D433676A87BEC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690756, "uuid": "7bdfe238-3bbb-434f-b9ae-ed89dcf1ac55", "value": "e9f7dd0da1a2a1266893e1ae4ef42b67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690756, "uuid": "2c86f79f-596d-4b74-9498-88b39acc7bf8", "value": "3072:v3BepJlZa/Qrp8XvPZFbzt2dQXty7gHJlZapGBR:piUQrOfKorHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626690756, "uuid": "1133c94d-373f-48ff-a7a7-a94bdb60c94b", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626690756, "uuid": "c5c9ae41-1e52-4a3e-b8a7-60873e3c6cd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690756, "uuid": "a52f146d-ae3f-4d39-aa3c-13e6d204bd76", "value": "SOCAR Petroleum S.A Romania ordin urgent nr. 21199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799408a1-e8ae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626712162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712162, "uuid": "9bed2196-eb7a-429b-a934-986bd77a3fcb", "comment": "Malware payload", "value": "ca5517f32673b192a9179f020475322f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712162, "uuid": "86efd887-9dbb-434d-883c-0af82ea88da7", "comment": "Malware payload", "value": "479b0847491da475fb408fc341e0697e7e01ec328e1627dd17374e62e3ef563a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712162, "uuid": "0ab1f676-577b-4d93-bbfd-74362d6bcceb", "comment": "Malware payload", "value": "62e7c9356d41fcc687f4b471f1c19855e0f8bd54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712162, "uuid": "c08d5f2b-dae1-4b01-b590-7690be4a2f60", "comment": "Malware payload", "value": "629d84bb6dfe23a2db973f2aeea1b7fedd084f32f4c3fc546f43f69f8c6ad95a79312f9ff78f09e85c37558d98239676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712162, "uuid": "6ceea499-c3f6-499c-a285-541e3984b263", "value": "T151E4F169632BE20CED748BF92C75E1E267BA602A652DC53C1E88D07CBD7377C1AD0542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712162, "uuid": "abebeaec-62fa-4ebb-93dc-74395fe0865b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712162, "uuid": "da4fc592-b929-487a-806f-d20587ca8b4d", "value": "12288:HarGyvUIZbV00ccz+h4HYaYQ6K6gjvs7WBWMBOheFd3P9ejiq9WN:+VvDB00ccq1aY9KHs7WBW4OwF7Gid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626712162, "uuid": "ebd6a9fe-5f35-4a13-adbc-38aa13168e35", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626712162, "uuid": "0a565e83-a281-4ff9-bfbb-2d45c499e68e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712162, "uuid": "90348f73-2135-46eb-b5c0-8667e2b96536", "value": "Jose Luis Ezeiza.cv7-19-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da49e52-e88a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626696519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696519, "uuid": "4eeaddad-4128-42ca-a5da-02d81e4aa40b", "comment": "Malware payload", "value": "3e9bb4780693f9415c4e31cc7d578c25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696519, "uuid": "2b672ad1-76b6-42c8-9f16-7370b3201b51", "comment": "Malware payload", "value": "48c48701e841f502a2b6740f73e15c20a1bc0d4b840c9f889f93638ac388d162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696519, "uuid": "cf719bd9-ec36-4e08-8653-1a9b93603241", "comment": "Malware payload", "value": "d5ff041f46cac74282526b54f089bad812dbec63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696519, "uuid": "b6d8530d-2e7a-4efa-a6d9-c186813eb9b7", "comment": "Malware payload", "value": "89aa076105b4357b1a104839628f644fa080de4c0fbf2513229aaf932344ea17ed5b8611ba9ac9a7997d9b3dc556f214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696519, "uuid": "edda0d44-d353-48bc-a29f-036d5915c802", "value": "T11035513EDB558B63E2B2D631AA790300F698108373318D5757D32A4E752EA12B8E7F5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696519, "uuid": "4035f6ba-f355-44ad-912e-aef399c74881", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696519, "uuid": "4dfba150-018b-4f3f-a7aa-13bd7fb06478", "value": "12288:F2yXB0iYx3MIQDvE9UoCdnqJ+/CmddtGJNC8l3JQmMU7M8GG0y1YN:FWiY2vDvDoIMuCmzt4jpJQmMCM0B1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696519, "uuid": "195aeb02-35ce-40a3-b5c9-e19c50c80619", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696519, "uuid": "ecb0399a-4b12-4a03-bbab-5357144e04bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696519, "uuid": "ad8d35a3-fb56-42f9-8f32-a115329705ec", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e437e78d-e878-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626689148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689148, "uuid": "b368376f-824a-453f-a3d5-ca67eea25a11", "comment": "Malware payload (RedLineStealer)", "value": "836e16ce486f0cbabcddccb107c1d7d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689148, "uuid": "94e81807-f667-4f80-bc5f-67cfcc430d17", "comment": "Malware payload (RedLineStealer)", "value": "49109a49df93b6624b2ddbc0f64038ae42b16fee070844d19c1a5c27d4b7764d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689148, "uuid": "627d3dcd-0e1c-41ad-b354-439ab436a577", "comment": "Malware payload (RedLineStealer)", "value": "0fb1afd001cf9f6b5d812d9047d216c205d8e9be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689148, "uuid": "64f594bf-3e0a-4d30-ba4f-4fb902daaa53", "comment": "Malware payload (RedLineStealer)", "value": "1ee478c2afa33543eb0c70d76652c44f947b58fd9a45c070b9fb536fd0451c865e64dfacb91ab7c6d40ed43dbf82a6b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689148, "uuid": "cff14ea5-c054-4f78-ab95-f9639c33181a", "value": "T11E44CF6CA7850A5DCB79093EC0E1A32C077ABD615E47D31B608035FA2E1579BBDE1B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689148, "uuid": "c9be1681-dbc7-4bea-978e-4ac03a91842e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689148, "uuid": "c532b914-0464-4a39-be39-9d394237d1d7", "value": "6144:kyjJS6P54MmyS57R3+z1eTsObF5OZjl55RZvLit0y6f:k8XP5dSDOhOB5+J5PZjiB6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626689148, "uuid": "c5771afb-c717-47c9-9d30-2a2ca217ad48", "value": 263368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626689148, "uuid": "bb103cfb-39b1-4fee-a33c-fef8cef72dcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689148, "uuid": "9b68c68f-1e85-438c-91f2-06bb80cb0a55", "value": "0fb1afd001cf9f6b5d812d9047d216c205d8e9be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b3cff3-e858-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626675051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675051, "uuid": "1dccdfed-df36-4939-beb1-1a29ede6452e", "comment": "Malware payload (Mirai)", "value": "65e38e575fc71c557372b16b3b1ca1ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675051, "uuid": "46b35fda-90cc-4fa5-8d88-964224ac3775", "comment": "Malware payload (Mirai)", "value": "499dda9be4eafdee4c77c1899a2596f9a53dd2985ddc8e4b9ad317a342513b03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675051, "uuid": "db8d208c-f264-4fcb-b08c-a66a5b829835", "comment": "Malware payload (Mirai)", "value": "437b268d27f82ec056719a519926935fee5c1bb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675051, "uuid": "f38b3e22-e057-466e-bee7-acb4b9eac386", "comment": "Malware payload (Mirai)", "value": "6cd4811da65654c6df71770604352a1240ab3cfde66675a615eb6e1f8ce632336e084ead19dd3c590fa2b44ba8b491f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675051, "uuid": "cb52c02b-22df-4247-8674-232f6272f0fd", "value": "T16B33E840BD829A07CAC8437BFA4E538C372573C8E3DE7217DD266F51B7CAA1B095A461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675051, "uuid": "5b0be590-a710-4883-befe-ed7786bf02fb", "value": "1536:WhHJC+UkpBqQFOr6mUPwfaZDJga8ZJ8ZwbZn:WhHJ1UVwOrMPDZDR8ZJYwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675051, "uuid": "a892b11a-cdf1-403d-8eba-dd347e99e03e", "value": 52380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675051, "uuid": "d97ba0e5-93aa-4711-b55a-08b4e0625028", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675051, "uuid": "b92ee1e0-1800-4fc6-b211-b3f7ee899f89", "value": "65e38e575fc71c557372b16b3b1ca1ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3faa05-e855-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626673831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673831, "uuid": "8735b86e-1ecb-48a1-ba10-515a7512f15d", "comment": "Malware payload", "value": "4497250fbefe661ba2d4bf809e89f625", "object_relation": "md5", "Tag": [ { "name": "ico", "colour": "#BFE6A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673831, "uuid": "e18b347e-41dc-460d-9c9d-ee8f2fc6842b", "comment": "Malware payload", "value": "4ca7e9f57bb78f94ff89fc6abd80d730286e294ad59f66743e70a9e9b354b675", "object_relation": "sha256", "Tag": [ { "name": "ico", "colour": "#BFE6A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673831, "uuid": "6d23c01f-bf5f-4eee-8110-c76ab272c57b", "comment": "Malware payload", "value": "2828dad32977fed1a6308c816cbf6385c0bdd401", "object_relation": "sha1", "Tag": [ { "name": "ico", "colour": "#BFE6A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673831, "uuid": "e0ff28d2-23e5-4304-a23e-847a16cf2b00", "comment": "Malware payload", "value": "12def8f1ca4c1a4d2ca45dfb15812d16aed499856816905f1d52fcecf3250f3c0e7b71975e7eb3a59f5748395ccf4111", "object_relation": "sha3-384", "Tag": [ { "name": "ico", "colour": "#BFE6A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673831, "uuid": "389c89c1-ca45-4f1d-a56a-67bec1ac0d30", "value": "T14563B0D63446408AE86369F26E4EDA3021E93DDD55E9C30C35D7BF1EAAF3305006B76A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673831, "uuid": "e6df145f-51f0-4722-a378-43b1e4721f0e", "value": "384:kc+ov4TJqJbnP0x0KDMZ0f+Ua0kD7bOOOkUSfQpcp8:V+oAqFAfDjA7bOOO/pcp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626673831, "uuid": "c8b95aaf-b3dd-46c5-b174-0b72b4a4471e", "value": 67646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626673831, "uuid": "af8051f5-e6cb-4920-9d07-46c6c85fb16f", "value": "image/vnd.microsoft.icon", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673831, "uuid": "1d7264dd-8e40-4d95-bad9-c60854c3e999", "value": "PURCHASE ORDER.ico", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea380e2-e8a8-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626709755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709755, "uuid": "d57355b9-f465-4c4b-b4f5-353a795f14da", "comment": "Malware payload (Smoke Loader)", "value": "bc5d860da754c16a5e214a03b96d970b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709755, "uuid": "da289fef-520f-4cc8-97cf-135ad5f15f7c", "comment": "Malware payload (Smoke Loader)", "value": "4f183ddf0f30a4fa93a5968d948921683c56c29ff44b037442e38a6de4925289", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709755, "uuid": "5dd348d5-efef-49f0-85e1-23bf5692c34d", "comment": "Malware payload (Smoke Loader)", "value": "d372a22cb23e4eac860ee4963114455e96efd1ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709755, "uuid": "680419cb-0b7e-4366-8eab-71c69f2f11ee", "comment": "Malware payload (Smoke Loader)", "value": "b3ace298015cd43207154db276c80d4ce4a0e1be1d9114b1f860cb910a93b41429bf84b689d50c1fd14b9226f9f90ca4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709755, "uuid": "67147721-dfb3-49b0-9f0c-6a80c412755f", "value": "T188E44A116C10E03DFAD251F2E751DBEEA99DA770830D37D32392AE87E0157E99372886", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709755, "uuid": "c3469d41-397b-4de3-9fb3-79b1219f29b2", "value": "f7541c650a90ffb09d75144909039d18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709755, "uuid": "75b4f48b-7d26-468b-b7ba-c64c36eac14e", "value": "6144:KQDO9Oij4M29MJN+IQPK/+q3iSP2Re8J2M:KQDO9Oij729ENfQC/Gkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709755, "uuid": "2e4c3f9a-0d69-495d-9a13-4776de8a3062", "value": 662096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709755, "uuid": "38dc395a-2030-4978-9388-62e6f98a6283", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709755, "uuid": "ba3e3bef-ed18-4e0b-abe7-ab16771f1ee2", "value": "bc5d860da754c16a5e214a03b96d970b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde0db60-e86f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626685245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685245, "uuid": "b92893ed-fa59-479f-9d46-fc825e068062", "comment": "Malware payload", "value": "bdbc972b35f56a3d6ee884adafe8bf8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685245, "uuid": "e065760e-5fb5-44c7-8a53-c8048bc54142", "comment": "Malware payload", "value": "4fd784c26daf0b1877d7ffd53710b7312d89c8af0f3e640c1584d238e7e68949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685245, "uuid": "60e26716-fb7f-452a-bef4-6d2bb1a5db2f", "comment": "Malware payload", "value": "0d64630e7013645bfa3d9c8191363c7c6b6fd860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685245, "uuid": "a67f3643-0a86-49e7-9c34-8ee9d231286a", "comment": "Malware payload", "value": "59cba6c5d11441cff436b2b28f2ee8341327beafa1a3f3ea19eb873a7a90769272ba748c304d8dd9b811bc7cc8ce86f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685245, "uuid": "f35c7e69-9bb8-41b0-b055-c176f3c01c40", "value": "T1E025E0A6B217A124DC3887F51C35C5B02BAA7C2A5278867C2DCDBD3F3DB35789AD0542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685245, "uuid": "887cd71e-b947-45db-a5dc-06adc71f92af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685245, "uuid": "6535e2c9-c7f9-45bf-9f23-52b4c97d3fca", "value": "24576:RvDBlBPIOBPD4yHR3891voU/pSOXeW0fCC:lpPDPjxMLxDXeW0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626685245, "uuid": "5ce49b5d-447b-4336-aa5f-e6fd391b7d89", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626685245, "uuid": "a8d7c8c4-342e-4c10-a1de-47eb244ad3f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685245, "uuid": "3e42c9b8-afc2-4cc5-8e94-f66a09a0e06b", "value": "DHL DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea457cd-e835-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626660040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660040, "uuid": "efe8093f-702d-49ff-b9db-20cde8421297", "comment": "Malware payload (Gafgyt)", "value": "2608c74c8dfc87dc371172b3845717fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660040, "uuid": "688b8764-a8c9-4242-a653-bc66a4c2796c", "comment": "Malware payload (Gafgyt)", "value": "502024c4a347736723be15e99666ab6aaf7170957bca22020d2ca395228d75ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660040, "uuid": "1bc00d04-d190-46af-bc93-a6334cb8e81f", "comment": "Malware payload (Gafgyt)", "value": "30884b1a5af494a6b8338104291979c98af14897", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660040, "uuid": "1550e13d-eadf-49b3-b95d-14dc2e80606a", "comment": "Malware payload (Gafgyt)", "value": "7598ad697309b5757df81b47f1ea432cfa2510700bfa56283b1921e226dd8f729cf8b1fb008e42bcb2261e630d66ae60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660040, "uuid": "4aa30f05-c5da-4a2d-b148-3689fb8ab1bf", "value": "T19CA30A76E606CAB3C44306F102A7DA6B0D21BEA7193A9E8AF31C3CB09F334C57555B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660040, "uuid": "b614ff7c-2516-41c4-9782-6babc8622d2d", "value": "3072:3qithomYI9lD6HgrZiXBTetmmFVcqq0GnDZT:3ZhDS8ZiXdEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626660040, "uuid": "9395dc13-7878-4552-b9c4-681e5331b97e", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626660040, "uuid": "3f25dc5e-0dde-451e-8deb-380ff3e52a00", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660040, "uuid": "c0102767-278c-4a5b-b2a5-9be19a56fa0b", "value": "2608c74c8dfc87dc371172b3845717fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7015607-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626708802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708802, "uuid": "7d8dcb30-c4d2-4395-a504-4c75d945a6fc", "comment": "Malware payload (AgentTesla)", "value": "37f68678914c4b15b4f1768037d3b3a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708802, "uuid": "e74a60fe-4801-41c5-a0f4-a21fefd80d03", "comment": "Malware payload (AgentTesla)", "value": "51eb7e5e2034ecc3743a2bdf49627342f0cdcaf82384dc09812228618643c51c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708802, "uuid": "447e7b7a-dfd6-44e5-9e84-212d3ac437ac", "comment": "Malware payload (AgentTesla)", "value": "965491743ffd2e23d664724dda21e58a2b64786c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708802, "uuid": "aaf2c207-e4ef-4971-a40f-1c9dde371315", "comment": "Malware payload (AgentTesla)", "value": "cf748d3691a30e84175ac73806084c9707560e0bca97b2fee3f8ed3567a619a4d8e8a6f82ad8b5c7dc0c3730a9b377f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708802, "uuid": "6ec27e26-890e-4234-871d-fc1a0ac9a78d", "value": "T15AE4F164722BE348ED74C7F51C69D1A26BBEA42E266EC6381E44C17CBDB377C1AC0542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708802, "uuid": "00c7b211-ba9e-435f-80ee-0aad0f870c8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708802, "uuid": "7d5dce34-067a-4b39-81d0-778f0d791a69", "value": "12288:0mqyvUIZbVKus2ngE7IgNGC8tI0zaEUhbKeXzCVn9HxWQkiVED:pxvDBK1WIgNVkI0m7VKqzwpxWye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708802, "uuid": "dc65bc83-d6c6-4555-8e1c-fa73740637a4", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708802, "uuid": "708d2d56-b460-43c6-a470-1bc19306c4a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708802, "uuid": "9a78c557-9afd-45b5-9c19-cd2f0002ba35", "value": "37f68678914c4b15b4f1768037d3b3a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2679d84f-e8b8-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626716318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716318, "uuid": "82c6adf9-a4f4-4579-8e50-7a031bbaa941", "comment": "Malware payload (AveMariaRAT)", "value": "28463ecd87dbf6503d58e158785965ac", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716318, "uuid": "506a5ae9-67b9-4594-b386-2e9e50ec9084", "comment": "Malware payload (AveMariaRAT)", "value": "52969fae09c2428c701a8b51a20c1eb07bab1bca79acb21eaa910d764533155d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716318, "uuid": "1bdf055e-69d4-4a83-a20f-cb3d322d7b6b", "comment": "Malware payload (AveMariaRAT)", "value": "12c8088fc0ac36692e9067a1e28c1ef7bf46de46", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716318, "uuid": "35fe9ee6-9661-4b6f-8add-efe3f7648528", "comment": "Malware payload (AveMariaRAT)", "value": "2751e87e07fcf0f5332ea72e20c6f05cccdae16a198b62366c85ccc8853a3229cff521a86c6595fb67be097b6f540e89", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716318, "uuid": "99edc1e2-3c17-4756-92f8-594b05c2c352", "value": "T1B3356AD441CB1AF3F1CD3A541A50F04E572AA64E50914C6A2B2D9FE4BF093FB5F8829B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716318, "uuid": "05b8523e-ff02-4acc-bb97-447b4c442960", "value": "12288:Yc+NeyoDJLR7mWZ2b7B/u43mWZsdzFZRsUj:5RsUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626716318, "uuid": "162581c2-5f9d-4fd8-92b9-baf3cde6ded6", "value": 1067566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626716318, "uuid": "61a8244e-60ae-4458-adba-fcd3d1cc6baa", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716318, "uuid": "eed5992c-5a39-4d19-be9a-f10ec39bed81", "value": "Transferencia de fondos .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423f2084-e8bc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626718082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718082, "uuid": "c4f3904d-b31a-4a20-84fe-6870a5039310", "comment": "Malware payload", "value": "99551779549809d289d12efa5ac43e4e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718082, "uuid": "91b1357f-e927-4855-a18f-35d4997ec2fb", "comment": "Malware payload", "value": "53074094addc55786936f3d67d7fe36554a7c4f4f96c06252ae768707295dbec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718082, "uuid": "d007bcfc-7955-49fc-9bdf-e373976c7d09", "comment": "Malware payload", "value": "66b5b7aa0264b12e24f37388330a60991de3146a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718082, "uuid": "ac1d578e-46d0-4952-a9cb-db9c73b1792b", "comment": "Malware payload", "value": "debac48c422bb65b311f5e6e1b44c160d0f8e7cb6d54399c993751308709b5f8571800fc743db5b5940305c97ec1ff5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718082, "uuid": "ba671417-1b49-47d8-8234-abbd8550a7ae", "value": "T171F2E1AD52401DCEC8987C3D05AA86F32192A59173B60E43672590C8B4AED9E7C5F2BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718082, "uuid": "48a45a22-0dbe-46db-9cf9-21389a6baeae", "value": "768:RQI4+orqJGPvcK/kmG+1mAaElNZuw3/9WmEyhqbaWB:6FKJGsgkm/mABlNZ//cmnhqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626718082, "uuid": "07a512a1-7fc1-4168-b24c-7ff7a54bb35f", "value": 36532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626718082, "uuid": "ffd27a6e-de30-4333-a1e4-8a417e97d8f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718082, "uuid": "d8087184-7f23-496a-aec8-8525aa19f3d6", "value": "popsmoke.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e7aac2-e897-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626702150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702150, "uuid": "1c24d118-f930-42fd-8cb7-c47a4f72d1a3", "comment": "Malware payload", "value": "cfff52134702167b22ed784ed830c35b", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702150, "uuid": "cf48954c-8353-41d3-86b4-c9e465c14f7f", "comment": "Malware payload", "value": "53df0154e59c3f9a6d1355c10d22c7febe7cc978651b7f397947bbe65a617522", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702150, "uuid": "762f6943-b0e2-4525-b235-b4da9bde413a", "comment": "Malware payload", "value": "ccbd0cb697343e81d48c094761b7f8275220cc9a", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702150, "uuid": "dc976375-ac68-4f8e-8721-9892ddc0a41e", "comment": "Malware payload", "value": "54516b7342d764c747facab64f11bc9994150f328fd4451bc0f79d7bff59f9cfeff82e7f43c8f7c51191e184b5fe5450", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626702150, "uuid": "3bfeec7b-d3e9-4dd9-9323-ab8b5d1415b4", "value": "T136D56D21B729953ED1B24E3A06B7B75D1D3EB32456339B2E02D409F88E15AC3487672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626702150, "uuid": "751db9ae-b6c0-422d-9ae2-fba9d5506c96", "value": "8121efc37705630d33ae1712b4ee6fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626702150, "uuid": "c3f13cde-e1dd-48c7-b29b-a2acda8868cf", "value": "49152:vzwYrVN9dIt/aMpx2QuJY/ipIysqewLkMa:8YrVN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626702150, "uuid": "a473ad52-4ff9-4de5-b879-b996ac2d376b", "value": 2810880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626702150, "uuid": "35275f9d-1de9-4b21-9c05-6ee7f7a394f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626702150, "uuid": "486394bb-5b77-4ac0-9d33-116413036f80", "value": "ctfmon.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c93c28f-e835-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626660064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660064, "uuid": "61c27f67-1182-4a93-80b8-fb23fde21ada", "comment": "Malware payload (Gafgyt)", "value": "38323d0a2241873cd31b756d4d2eea9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660064, "uuid": "f6e07da7-8ada-4b0c-a75e-264fb6a8a707", "comment": "Malware payload (Gafgyt)", "value": "546540e9d3f2a7ff7d3d63471af84b1484582ccf8d3cb3e7d9bcb28e6b79a7bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660064, "uuid": "1298554b-a2e9-4830-b367-782fb6e5186b", "comment": "Malware payload (Gafgyt)", "value": "b8475faa4e5144b67a457926040c8074e95a324f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660064, "uuid": "b90c2cf1-29ce-4f6b-958f-01f0a000af6a", "comment": "Malware payload (Gafgyt)", "value": "319a3296a7e605191c813f36e96d980e147f3ee36a13ac6ce0e5f7c1c4bc05953c8fd87a8649deee4a271165da32e1ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660064, "uuid": "4bc9d060-e2c8-4eb4-8e15-b2bf2c31ee15", "value": "T1D4E3963A7E11AFBEE168827107F29F70CF9529D326A19381E36CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660064, "uuid": "fb9bee37-1f39-420f-acdf-fe510e421789", "value": "3072:1Hi00Sa7CA/y7zZohaBMNz00rnmrThPaLEnvPrNb:NiSyhNz0EnmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626660064, "uuid": "e1ad60c1-0a7c-478a-a9e9-81f4f7f2b0f2", "value": 155392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626660064, "uuid": "84ab85c4-4eb1-4fc6-9620-aeea1315c501", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660064, "uuid": "425e9188-3f57-4251-82c0-6ddc7dfb9014", "value": "38323d0a2241873cd31b756d4d2eea9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285ae658-e8a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626706872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706872, "uuid": "7948e130-6157-4e89-be67-021e665d5c70", "comment": "Malware payload (Mirai)", "value": "e957309c9cb381574c622b2d2a6798c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706872, "uuid": "087988f7-6e48-41b4-a36a-62bbeb486a8a", "comment": "Malware payload (Mirai)", "value": "54dfe49f5b114030c318eb1be2d86bdcfac3e10d730b08631028f992fc92c9d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706872, "uuid": "914efe17-166a-44b3-b2c6-d32470af5629", "comment": "Malware payload (Mirai)", "value": "3589d0f624deb034ad2ac15cb1f1f0f0fde10908", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706872, "uuid": "6c3d72ac-1f69-4800-ad9b-d1d735cca857", "comment": "Malware payload (Mirai)", "value": "5e418e262e4270e7c45abefab8e7587f4df08bec2b78de0ab58e58cfc5fcb743df0ceac63630422b6e82fd90e4d5a6a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626706872, "uuid": "f4dadef7-5e54-495e-bcf8-8f24ccd080f6", "value": "T15964D08AED41AF25F8C516BAFE1F034973738BACE3DB7111E620972036DA55B4B3A144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626706872, "uuid": "b9569651-f18a-4e03-b43b-1349fb208301", "value": "6144:7O/QJHZweEL/NOjCHm7FZZnch5wKSDP99zBa77oNsKqqfPqOJ:78QpZsKCaihDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626706872, "uuid": "472877c8-1325-4ee8-beca-861ea133d587", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626706872, "uuid": "4001132b-773a-4862-923e-2821fbce8a7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626706872, "uuid": "32c08149-e4dd-4cdf-8e7d-aaa5070dd075", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be10c85-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626708676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708676, "uuid": "7d953cf1-4e7c-4a68-8049-b3c3325c4e12", "comment": "Malware payload (Smoke Loader)", "value": "7456214bc55be7cc872f065ebe8af1b1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708676, "uuid": "364f757d-3eb7-4f70-9cf1-3badea92ab86", "comment": "Malware payload (Smoke Loader)", "value": "553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708676, "uuid": "46c8f0a3-dc95-4c60-8722-2e2f0b24c14f", "comment": "Malware payload (Smoke Loader)", "value": "94fcad942bc030f7c8e0f7665ab995a47db7a06c", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708676, "uuid": "8ea3b763-1df6-4a6a-b386-153e0f20dead", "comment": "Malware payload (Smoke Loader)", "value": "e6d0a79a437f99e014cf287cf4ec8f1629f253d76ee4d3de18edfbe11b3cec2cb71e95890d9cf8aa5776622a6d325cc0", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708676, "uuid": "3e30ea8a-5506-437a-9c28-0157be23885e", "value": "T162F38D1075E1D472DDF24A3058F4C2A16E3FBC626D74810B7A953ADBAE712C27AAD313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708676, "uuid": "309f3b31-2b6c-4c81-869b-bd9bfdf17bf9", "value": "1cdb58c3690bead970c88431e979e839", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708676, "uuid": "82fa6dce-d47f-4f05-84cb-29510204907a", "value": "3072:/xE5hLnu1pr2I1ILH7rXALJDwX7DRwbL1u:5E3b6N1ILbkLyXhOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708676, "uuid": "c56bcab0-31ff-43ca-83dd-c581f9a0cfd3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708676, "uuid": "e6d34e96-837b-4371-8e74-3fed2e459f6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708676, "uuid": "a72c8607-07f8-4f9d-affb-f3577fb567bb", "value": "7456214bc55be7cc872f065ebe8af1b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f4d378-e8b9-11eb-875b-42010a9c0053", "comment": "Malware payload (Cybergate)", "timestamp": 1626716988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716988, "uuid": "10424262-349b-48ed-b877-75a0b01f0eae", "comment": "Malware payload (Cybergate)", "value": "02d37ed4bc3422b573fce8265a434d1b", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716988, "uuid": "d0f39bec-d58b-485a-a936-5ea03b3c2ce0", "comment": "Malware payload (Cybergate)", "value": "571a708504cf085b54eaed702a6c95b3189426dc20c78e42a3f1e1096d6bf044", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716988, "uuid": "25028728-9a03-4e3f-9fe7-b2dd971eb646", "comment": "Malware payload (Cybergate)", "value": "57c2ff77566afcfbf5d75c5912a22a19656afa29", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716988, "uuid": "485f1a22-2d36-4957-bd05-a4955ce88fc9", "comment": "Malware payload (Cybergate)", "value": "fd28939819c5b9e03e394a03e0613d9ec8fe82df62beb7002cf0c8b9768dff815bfc5c0d1e839231a6804f0b53eb6209", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716988, "uuid": "6e78d432-6031-4f84-9d7d-4a9c095c14ce", "value": "T119C423AB95C8BBAAF1E24C350715D8E0506D7547A6A4D3506F07CBE68ABACF0F02570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716988, "uuid": "b46dcee8-f808-4bfe-be32-fb902467a9b4", "value": "cba5bd52b3e624400ffe41eb22644b79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716988, "uuid": "0b845d3f-d4eb-495b-a20e-eb2d05e85336", "value": "12288:epLNX61Sz03E02kEHLNeYl0AshrWbFJeV7IdaneHKDuUbtH:4BX4S0ESEHQYeAeypJeV68eqLhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626716988, "uuid": "f91540a2-c2e4-427e-b38e-6c0f8945b3dd", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626716988, "uuid": "404199ec-8dd8-43c6-8728-86ab78270631", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716988, "uuid": "97c0a0da-bf9c-48c7-8421-013d7a27ba71", "value": "Gerador De Cash 2020 PB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f63b31-e877-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1626688556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688556, "uuid": "51d1aecd-7c93-4494-9aa3-53d07d5b8e0e", "comment": "Malware payload (AZORult)", "value": "a5ce2653f5f74c7ba7901f79cf9932a5", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688556, "uuid": "513109fa-a485-4e8f-a74c-d2620ef696f4", "comment": "Malware payload (AZORult)", "value": "571de4698edff95c328d3521b11e800a3b9659ad55281dd7729b2ce2210ac931", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688556, "uuid": "c0d91697-b38c-4e04-afa6-1326a4b56f72", "comment": "Malware payload (AZORult)", "value": "a6e4e0070694b6779627643c18850b9a16d047ee", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688556, "uuid": "3a246888-072f-44cc-96cf-7e7e98eff327", "comment": "Malware payload (AZORult)", "value": "f3b983338ab8c22f7d1b1ea60bfd97ed6cc135db2bf58570de714b70c2fa6e6d9286f3fc61f46de4dd78d7c8a083cba8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688556, "uuid": "a0a2e669-53b0-43e5-97b1-22e4c939aea4", "value": "T139363363031A0142D4E5CC3B8D2BBE91B6F7535A8A43BCB4A8BB3DC524568F5F613993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688556, "uuid": "d08e21c8-fbf3-4441-a8ec-3748d5109f8a", "value": "76cb8609f244452639492f814868d4e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688556, "uuid": "f6934419-0fa3-46ae-afd9-22f8ea1b7c94", "value": "98304:ZaLdPPWUuSulRxza/H1V1cn+mS9G8Nh8nwlvttFf+ExNkaDhe:aduSuvM/VV1o+mS9dNhfl3HmOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626688556, "uuid": "ea3c55d4-8ca0-497d-b1be-2c5099786b5c", "value": 4980224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626688556, "uuid": "41e9945c-7605-45d7-a22e-3091345e8269", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688556, "uuid": "aa68d745-f351-402c-9276-9ce8c93fbea6", "value": "A5CE2653F5F74C7BA7901F79CF9932A5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcc4135-e8bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626717806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717806, "uuid": "49d5e975-0aa6-4441-b1d5-57af029a4e33", "comment": "Malware payload", "value": "47a5e618c809f1f37bccced9d3536deb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717806, "uuid": "db656a63-3f6b-4cac-ade8-54707382919a", "comment": "Malware payload", "value": "57bb59a2c491b89b3321428121ba1b5e88daca5a8e379fde41afc73e9679d752", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717806, "uuid": "12c29fc3-cf79-48c4-a54f-0fa6e9bab258", "comment": "Malware payload", "value": "da3a6f5851537edffcc29e9bf4282d552090ce6e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717806, "uuid": "50a8d4e8-d427-47a6-b079-f476c235471b", "comment": "Malware payload", "value": "a08526131abd5fb0625fb8b442c92ab97db2a75bf9865a720992b19bb854a777b72e3edb64b56a996ac9c48824462073", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626717806, "uuid": "b30e5762-b19a-4a5e-bfd9-65c90e646eaf", "value": "T1E3E4F6D441CB56F2F1CD3A441A50F08E473AB64A60914C6A276D9FB4BF093FB5F8829B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626717806, "uuid": "ced4b6b1-f715-414c-85de-5d797ea1dbd9", "value": "3072:9rBrB2BrBOX+yIQDd+4bNQLHepY7/TmTlPfHQvac3+ADclrU1wPT6VMHvfCjzZj4:bVcVOO+ADcB/LxUC2LEcudzFD1RDAUwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626717806, "uuid": "1f3a3299-1b8f-45e5-88ea-ae92414be5d6", "value": 678173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626717806, "uuid": "79491dbf-47ba-4757-b234-c0d386ff3173", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626717806, "uuid": "526dae28-2787-4283-93ed-6e6e9aad53bb", "value": "RFQ_1220274_SH0601201.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea9fc26-e86e-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626684817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684817, "uuid": "f1f9dd3a-a829-4e51-afb4-67ee37dd3d9f", "comment": "Malware payload (ArkeiStealer)", "value": "ff2e4cca98f654a0d87ccb16ca83b916", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684817, "uuid": "201f1e35-39de-4421-8972-b4cff9ce476c", "comment": "Malware payload (ArkeiStealer)", "value": "581684eed64322ad48a61a06b57e73b343c2dabb51248b33a943d0282677546f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684817, "uuid": "cdc36118-42f1-4f62-ab45-23c3c833aa44", "comment": "Malware payload (ArkeiStealer)", "value": "56579266ecbedcbe65ce1beb9174eccc2dc4c07d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684817, "uuid": "67c16320-d975-4735-b771-86c97eb5750a", "comment": "Malware payload (ArkeiStealer)", "value": "17961b16a845880aa435cde3076197b4f85e07b6b8e4bac388d62223fe0384454565fc90a73b98ca74c655e24cba6319", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684817, "uuid": "9ba6b12a-24f0-49bb-b1ed-33814e65b131", "value": "T1F6C40129771B8E16C79D1672C1F7A2310BB2EB9A2973C70A3DD822441F437F96E50A49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684817, "uuid": "51468b18-6391-475d-b5b9-ae9945f84451", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684817, "uuid": "e42f8a87-f950-4154-9fa5-43a24ed2e0e7", "value": "12288:ajRI/E2dUL8za0Mp01kkC21BW1lGz3I/+lruVb9B:NrO0+Ht21k1AM4rud9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626684817, "uuid": "d509e706-d0cc-42ab-bdfb-70116860265b", "value": 563960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626684817, "uuid": "8041c195-2a8f-4a64-aa15-5ebe113983be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684817, "uuid": "29851683-3f2c-402e-a7cc-c62b1c44d427", "value": "ff2e4cca98f654a0d87ccb16ca83b916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07b5f4e-e88a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626696873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696873, "uuid": "27c19112-c55e-49fa-b72b-a9b264d8c478", "comment": "Malware payload", "value": "6f604a598bd5f7c618f07959e7747c32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696873, "uuid": "d6837fc0-6577-4c8a-bbfb-4e31387d01c2", "comment": "Malware payload", "value": "58f7a66ca4791061e9dda68df178fcb40d75da724838ff0b096a64cbc417789d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696873, "uuid": "b1b26dfd-0a24-4002-83ba-1312d4b6a804", "comment": "Malware payload", "value": "66dfa16014acab4a87024dc3b930b71142eb8a8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696873, "uuid": "24e5c5f2-c02f-4e88-ae78-cdf97171f0d5", "comment": "Malware payload", "value": "2efff05d036539afeed1ea26bbe2a8d77d2ef4c2aeeba316867e3e9b8e11e3d7fb3ac43774ef9cd71fe93f8144c55d1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696873, "uuid": "a3b4ffc4-884b-493e-bdb1-d9ffe215d1f0", "value": "T1DDB4E02633087B9FC53EDB7940551C6047E0A223E317E75BADA751EA498DEC68B33293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696873, "uuid": "ab101fd1-3c13-4784-a676-5d5bf6ff96cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696873, "uuid": "bc64b36e-ef86-41f2-bb8b-72fd7d746f94", "value": "12288:azvfDMxjvBgaV8zOOTehqqQXXa5u6npWrpO4dGOEl:qvfDMxVFr0XqQXKsQpuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696873, "uuid": "79d04ce2-3df7-4ccf-acaf-1079ed6e4434", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696873, "uuid": "bfe3d34f-84a4-4ff9-a782-3900f7b3176b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696873, "uuid": "2b01efed-1bbd-4fbb-8ec5-3a271d80f168", "value": "PO#78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ffce22-e852-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1626672460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626672460, "uuid": "e9416605-d026-42db-b505-d906a04bef48", "comment": "Malware payload (CobaltStrike)", "value": "c826a43b3cdb08fc06ddfa2e223a5710", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626672460, "uuid": "6c54db83-0b3e-4900-b231-a59db81c9b95", "comment": "Malware payload (CobaltStrike)", "value": "5aedcd88018ef8f4a70a04ca259e7f2a087fde8ef98c7bbe21b1d511dd00a731", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626672460, "uuid": "ddd4a7cc-799f-435f-bce9-a11e6a20ed07", "comment": "Malware payload (CobaltStrike)", "value": "d03197c0dc837c65ca73da72c596713f615e043f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626672460, "uuid": "e478343d-95ec-46e7-a5c9-606b855a6b79", "comment": "Malware payload (CobaltStrike)", "value": "4d16a2d0e22027d090df0bd21fecd959cd3b821d511d6da21447d5d5fe1bb12ad286f33d61f2ff3f69d97b37664e90ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626672460, "uuid": "82f9d64b-0ac4-40c0-9bba-55bc48c0630a", "value": "T120522A75EA0378F2FD1A897014EBB6FFAEB3E1238C205C96CF94D841582347A591764E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626672460, "uuid": "c40ecdcd-53e3-47ca-a48b-03de2abc1974", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626672460, "uuid": "80f90c02-5771-4cc1-9327-426d8c024c91", "value": "384:AF+kGKqbOCdWIVBff+xzJZNJWOzzzXfCXAn:AF+kqRVpfgWifiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626672460, "uuid": "7d73954f-7e0e-46b1-b4e1-d12be4700a7e", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626672460, "uuid": "28aedb69-405f-4a1a-b2d4-b1884ab8be6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626672460, "uuid": "47bb3d2c-eecf-499a-b467-cf618093c16e", "value": "c826a43b3cdb08fc06ddfa2e223a5710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7dd1ce-e8a4-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1626707949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707949, "uuid": "7b5fbd59-d4de-4f03-90a6-ab4c993f7b8e", "comment": "Malware payload (BazaLoader)", "value": "8f216511aa115a119ee15a10d067e8f2", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707949, "uuid": "8de813bc-5bee-4fa4-b8ab-39ad7f6a1914", "comment": "Malware payload (BazaLoader)", "value": "5afed1ccccb12db0f6da9f25c43d10b4e63995881b65526004cd6f6a390c792d", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707949, "uuid": "c17d6d8b-21ae-4104-a8fe-e1460bbd30f4", "comment": "Malware payload (BazaLoader)", "value": "dcd717e5262762b11d1ffe2465c4bce71bf44d18", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707949, "uuid": "57a3ddc0-a3c0-4e40-99ca-64423f5a22a8", "comment": "Malware payload (BazaLoader)", "value": "642e210e8cc984ef0abf9f2f0753b5b62dcd03c3c56a8d538bc5399456dc885504ba02ab1ae9543ebc584a9d222dc3fa", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707949, "uuid": "ade32872-b8ee-486d-b1f8-720aacd30e8c", "value": "T1F3354A157DE124BAC13EE132889693A136327C6947323BD71F8166B91AB4FF47A3D324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707949, "uuid": "b3e0c216-fa32-465e-a905-dfa5570de442", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707949, "uuid": "589f7929-2ad3-46a0-a09c-f89ca49ba54d", "value": "12288:FnZXf44ytVS7r/5HD76bHb2mX9K2QgXoILaFdCaBSPZC1XZga5D:9ZXqQFD7KHlK21oIgIyXya5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626707949, "uuid": "83a7edcd-a5e0-42e6-85b1-a62dd34e9f03", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626707949, "uuid": "b1972ad7-055d-485d-ac27-bcfaa1fc7302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707949, "uuid": "e365f26a-7614-45a2-af85-f3091de0ca8f", "value": "8f216511aa115a119ee15a10d067e8f2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40b5f9f-e88b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626697282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697282, "uuid": "b00d9c08-ecd6-4012-b571-17327297f0ee", "comment": "Malware payload", "value": "9baf1548251195c3b13844e8eb484b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697282, "uuid": "65ddbc7d-e2db-4ce9-bb73-9682bd355c14", "comment": "Malware payload", "value": "5b5fe66b86bc9f8ba31670dff6d2699d76d7c7ee63597f9e26f25c029582a71e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697282, "uuid": "a655de80-07f8-40c3-a39b-0f298c873bc0", "comment": "Malware payload", "value": "911438d6bcc2e9421cbcdcd6bcf5e770652c661a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697282, "uuid": "0534916c-0d0f-40f1-a53b-b9bff9656429", "comment": "Malware payload", "value": "18310ffddd952720a04a73bea43a6883097df646141c534340e2e844c6badbd5dad8ddda92f4f7de157b44205a63e4e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697282, "uuid": "7b9b1373-ef76-4c82-a4b3-c1e523661e17", "value": "T13FF47CAC324076CEC4278E338994EC71F6902C66570BDA0358E77DABBA7D657DF110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697282, "uuid": "f7e44b32-e832-42a9-81e1-cbdff854370d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697282, "uuid": "2ac3da10-c227-4af7-a76d-cf6ce086108d", "value": "12288:a9h/ZlDPdk6hrPZyGBqrDNd1R6qLKRGRVhcargHtrIN0rrM:8Zl7d4tDNdqqLKcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626697282, "uuid": "0844de79-c648-4010-86e8-8609c4d0abaa", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626697282, "uuid": "36f66c44-a7a2-4731-a44d-90e39d8dac27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697282, "uuid": "b1078ff3-d922-45dd-92d8-70954a9bc5cd", "value": "TNT Shiping Document.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790f24a7-e88d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626697988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697988, "uuid": "b8f4b728-2a1e-4245-a01d-d988106b722f", "comment": "Malware payload", "value": "7f96e5b62f43ae4581dd06b504983b74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vertex", "colour": "#300150", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697988, "uuid": "ac5075ad-2f6a-42d8-9acf-e7c766433bc7", "comment": "Malware payload", "value": "5c10cf9b9eb40cb03ff0f2af7e6ed3ce2807b47d2aebbd5586e485f50e7def60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vertex", "colour": "#300150", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697988, "uuid": "498e5f02-bf0b-4a00-a485-c4678accb10d", "comment": "Malware payload", "value": "8cf4e4af01e6bafe016d25c84f215cc27906d646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vertex", "colour": "#300150", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697988, "uuid": "96eb1e62-1f3d-4cb3-8134-6671fdb9773f", "comment": "Malware payload", "value": "fc6f21a609ccd2222886566a1f00786b37f2ce36f1125380ebebac46d02f1248e0f67749cf09fff94687881533fa9d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vertex", "colour": "#300150", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697988, "uuid": "a2068d7e-afce-445c-8ff8-11f5e06af790", "value": "T1A5C4D7C6E1B3608ED3A3B0B80F0165964A471C765F119AF5AF35AA6B11F37E1CA97303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697988, "uuid": "9819675c-5204-4a3d-b76d-9152f4fe3c43", "value": "cbbd434c93e8b0df7ff08b32e1c6c6b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697988, "uuid": "3fa1d08e-3bf2-45d5-8811-8155cc451a8a", "value": "12288:o3cj+RY9NRfbVPAg+l6awhIYNr4LJ6E0Xo50Fo:osj+y9NRDhAtlCHe0YOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626697988, "uuid": "2c290db8-333c-4568-8af8-cbe254b34a7b", "value": 568424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626697988, "uuid": "a6549543-6009-414c-aa8d-11e0efd20e53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697988, "uuid": "caeb8e04-7303-41aa-99df-dc07f47b967e", "value": "mixazed_20210719-125328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7a9cd4-e86f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626685005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685005, "uuid": "dc44cebe-5e6d-4c1d-935f-95e3fd70031b", "comment": "Malware payload", "value": "334eaf9d3c65ab489fdec2f7a88c1184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685005, "uuid": "0bcd610d-5792-471c-9b79-383fe00b2f5f", "comment": "Malware payload", "value": "5ee9f4addc6c85c45a7a66f9b61c4d7977f21d8ce1aadf667508f4623b317572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685005, "uuid": "c777af8e-faed-488f-a4a4-2951fc57d850", "comment": "Malware payload", "value": "bb984fd9c577af95d366878f637ea35cef01e873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685005, "uuid": "6d616e1b-186e-4194-9517-07dfc9af3859", "comment": "Malware payload", "value": "1595431f4dc990f8f3b0b99119c359cf7cf153eead56285aec0149d4b272a569a15b7b59ce050335c41e8f1b5a36bc2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685005, "uuid": "70ef794b-5f07-4b61-981a-14e25a75499b", "value": "T15F4618E35AD2A25AC296C4F5C215B62F876F79F74E14E5C2C6F921B88933C803D24F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685005, "uuid": "d474743a-293f-4588-83a5-10a2fd3b7696", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685005, "uuid": "60aad3c0-b845-44d9-a25d-59e3c26becad", "value": "49152:CzgO7fXhU65RQBopE7u6PcKIuTEE4D7XdWs7ki9FeGQY8kd59+94+mzUKhXGemju:CXzfsBopE7u6PcXZDhWhSHdb+K+m3XGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626685005, "uuid": "dc64ac9c-1cb0-4be9-97ec-666e983b7f6e", "value": 5660832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626685005, "uuid": "ddf3f82c-9db6-4878-a30f-cf8e760d3bad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685005, "uuid": "6f9d85b2-958c-4d13-b9e6-1e775a22298d", "value": "334eaf9d3c65ab489fdec2f7a88c1184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcd0f2a-e8ba-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626717484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717484, "uuid": "e95ea197-d1ac-4299-a826-fccc9a7d6c93", "comment": "Malware payload (AveMariaRAT)", "value": "3347d22680185efb3cd73d55b55a5c6d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717484, "uuid": "f7d1b0ab-85ca-41a2-b16e-1d31eb785d90", "comment": "Malware payload (AveMariaRAT)", "value": "5f815bd7f39cccb4b92bea3d36861d6844eeea3307e86b237d794c660d1305c3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717484, "uuid": "bffa2b99-267c-455c-b9c6-9702ccae6212", "comment": "Malware payload (AveMariaRAT)", "value": "36f0afde99cdabe38dbe7c281b61c17b1ca41372", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626717484, "uuid": "e98fefba-fece-448a-8ec8-9e8c0960ea94", "comment": "Malware payload (AveMariaRAT)", "value": "1ff2dbf4c2c77abf290e23d8aa9f0b207bea5819f96f7852542db97d39284bc5bc65824c2bdf01716aa9735def95a584", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626717484, "uuid": "5d6c58ef-575a-476a-a305-56eceefda9f5", "value": "T118356AD441CB1AF3F1CD3A541A50F04E572AA64E50914C6A2B2D9FE4BF093FB5F8829B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626717484, "uuid": "75b2938a-ebd7-4608-a086-8389b8b41cdf", "value": "12288:aFUHRrrdCB/LEp5BFc4c+NnEpGdzFZRsUj:aFkRsUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626717484, "uuid": "5ca7cc04-0fcd-45e2-bb9c-c08ed61788aa", "value": 1067548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626717484, "uuid": "b00d577c-bf96-4bdf-a6ff-4b5e986fc74c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626717484, "uuid": "c8217398-2639-4c31-af2f-251364236597", "value": "INVOICE 00082925.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865072d5-e8af-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626712613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712613, "uuid": "fe548839-b7d7-484f-84e7-208106796985", "comment": "Malware payload (SnakeKeylogger)", "value": "8b695b4169427dcd32d2f384934dece1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712613, "uuid": "82bbb7ad-1e3c-44ee-9356-723990d8271b", "comment": "Malware payload (SnakeKeylogger)", "value": "5fb2d0f98ed386069283bf30b84dc9da845b0e6e02a1411e017f90b88aea0658", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712613, "uuid": "a9367d1a-fb74-403e-9f9e-447f31e64ef2", "comment": "Malware payload (SnakeKeylogger)", "value": "509d0e2d4a90ab4bfd5a33733c8077d551d2e7a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712613, "uuid": "9746a8f3-8f50-4616-b347-8f8df9b36d9b", "comment": "Malware payload (SnakeKeylogger)", "value": "ad3280a159fb84ce86ff8bf45742ca8cfe7c8d5db9ae206d5b71a5ad5ff2fdb40044ef47a238e7c593bddcc03c308f2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712613, "uuid": "42b47fcf-62ec-409c-8e53-af24e6ced00e", "value": "T151F4F1353B81BB4FC52A8E7988524C1097E0F6734307F38B5DD226ED528EAA9CF71592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712613, "uuid": "a91440d5-58ab-4784-b16c-9baa97679c0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712613, "uuid": "26709f20-c0bb-4001-adff-cfe74c3b416d", "value": "12288:baJDJQ60jiijQzRrhzj4iEg5jKud2IdPYURFqqgp5MR/9GGXPvOzb1nb:bgFQVjVjQzlRsiEkdgURFqqi5Odqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626712613, "uuid": "de9d34c1-7f6e-4e29-bee6-fb5c74a87c6e", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626712613, "uuid": "e1835627-22de-4b9a-ab48-c2029b238a13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712613, "uuid": "9c20460a-a1e6-4ba6-ae3b-bb641f81afe8", "value": "8b695b4169427dcd32d2f384934dece1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a038afa1-e88b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626697195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697195, "uuid": "5d94bcbb-08bb-4b52-9085-efba6230d44a", "comment": "Malware payload (Loki)", "value": "21e6f4fefdf70039a9160ca04a388389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697195, "uuid": "219c930f-4908-4807-9136-dc82f3675d33", "comment": "Malware payload (Loki)", "value": "62742e4698b352658390b6b4f5088ddebb673503d5a4151f19c2face25932210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697195, "uuid": "bf91e2ea-450d-401d-8147-c6e1a1f0a46f", "comment": "Malware payload (Loki)", "value": "8c12b3bafd5afeb9966bd91ae87e94d73b321ba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697195, "uuid": "c60f4b48-3131-4e0a-959a-afd9b1353257", "comment": "Malware payload (Loki)", "value": "23d2503a7b7cfbaf5beb5e3cd4f06dd60c7cb7a9fce0b6ddfb6bbedc9982a8f8f18473a4198f56af966f85027778f759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697195, "uuid": "f1e8f6cb-8487-4edc-8a80-746269ff22cc", "value": "T11CB3BF6D132E9B72F722843446CA99E17CCE89B44DBF686F1B47483EF0960C58154BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697195, "uuid": "32c80d52-5789-4697-87a5-286a11aab474", "value": "8b9c7c9498a635f685c3b4d13969793b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697195, "uuid": "477ef404-f060-4e49-a904-88c937094ddd", "value": "1536:NyzNTZ3prSTLViyif4haUyVW/Gscyf8yQFd0OHDl2XDRa4YscNAhOBuH5s/GcCau:N2Z3prSXgVW+ta6dzD0l9oAhOBuOuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626697195, "uuid": "7ce0b15b-eba9-43c4-b13b-25a515f4e3ca", "value": 117855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626697195, "uuid": "2d1f00be-4fed-4937-98dc-03222cd80ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697195, "uuid": "9abbd80a-45b5-40b1-bb3e-85bb128ad611", "value": "DHL Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001aad72-e859-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626675451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675451, "uuid": "c07be4e8-8c7e-4c79-93d8-c85333800a9d", "comment": "Malware payload (AgentTesla)", "value": "a21da0e885370006c1f67effe0b81fd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675451, "uuid": "7af23464-2e0e-41bd-81b8-e2ae1d395f38", "comment": "Malware payload (AgentTesla)", "value": "63911c3c9ef35552aa2cf56af6154fa3ddc883e1fbc741d07ed179b9b2d98c55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675451, "uuid": "9c7b1aa7-b62f-45fb-aa10-0dc79c3a75de", "comment": "Malware payload (AgentTesla)", "value": "f7be9a8a3f22049929bef40d920546681930afdc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675451, "uuid": "d7e3232a-7177-4956-bd8b-0881e1d2ebe9", "comment": "Malware payload (AgentTesla)", "value": "f21fd0f84c6385ae0c205382ee7e7899a317105bcde3247eaab81e3d05f3f1411e5bc021f159196f60960efafe285a99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675451, "uuid": "beb7c2a8-ad59-473b-ba6c-a3b414c92482", "value": "T132059D5C3240798EC4378E338994EC71F6906C66570BDA0358D77DABBABCA97DF110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675451, "uuid": "6ead12ba-881e-4c96-b50b-c43b0c489b66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675451, "uuid": "ec79efa6-72b8-48c9-af0e-48bde78e5d7e", "value": "12288:NorltqDjzZQQ6SuZXXiEI82ycI+qug1CEb45i3RiJwNAyo7sepyNPuH7ELXtGhEN:Nc/CzZP6SQXK82ycsugQ5hww7suysHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675451, "uuid": "b7725c01-9fe6-4bab-abf4-160932b0c8b6", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675451, "uuid": "4c24c8ea-2122-4e27-bdff-1a3bff5b7677", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675451, "uuid": "c239663a-3f07-4038-9f44-2534b5f79714", "value": "Swift copy of payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7036f71-e8eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626738545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738545, "uuid": "5658c59c-cc3b-4ee1-9c20-8f2235754a39", "comment": "Malware payload (Mirai)", "value": "67e7338d87c794e6374f86752fe44a54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738545, "uuid": "341b9824-4049-42fe-b1e7-97ea53ca3c30", "comment": "Malware payload (Mirai)", "value": "64d921670c2bf6983dc7150b3dc2931c7a2632c49977c797634a771bcf1c1202", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738545, "uuid": "bbff5786-e220-4fc1-aeea-c1a747a242fa", "comment": "Malware payload (Mirai)", "value": "ab45592671ccd0a6329a66112e4a62b5f1573e9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738545, "uuid": "95b39f8c-2c18-4003-8ce8-b1b4bb3e82c4", "comment": "Malware payload (Mirai)", "value": "19d6480394b27c357800fac44f59a45680e69d2a62b1397243cd708658e2d19a9e7d7cbc628e31ea681c513c6ec1fd93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738545, "uuid": "130eea01-8715-4af7-8669-9670f2511670", "value": "T154C32A4AEB808B03C4D62775BADF425633239B54E3DB33069918AFB43F867A94E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738545, "uuid": "6b31b8d0-fa94-4b06-809a-e5001e6c220a", "value": "3072:BihyjwkzTrQw8JoYEBe5olCE6MM/9tX7w:BiUjwSfQw8JoYUeCCEVM/9t7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626738545, "uuid": "fa720924-78e6-46cd-a0f9-a68b84f0913b", "value": 120323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626738545, "uuid": "3e223b2d-db1f-4123-a030-b8359fa0baeb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738545, "uuid": "f4d9f457-9846-4b00-9e47-305e85a70be1", "value": "67e7338d87c794e6374f86752fe44a54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38086cdc-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626708616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708616, "uuid": "015eac8b-a930-4667-9472-f9a8cc11a472", "comment": "Malware payload (AveMariaRAT)", "value": "40cc8249b0f31d6e1c0065aab24007b1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708616, "uuid": "13256f1b-1aa0-47b0-ba90-99a96bb04075", "comment": "Malware payload (AveMariaRAT)", "value": "662fbe23c87844a881ca233876ff75ee05ddf2ac0a1b5546fb5bc7603474860a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708616, "uuid": "58cf57eb-cea5-4546-a9ca-eb052b4abb6e", "comment": "Malware payload (AveMariaRAT)", "value": "f73e02ad09976ade8985ec833c5743dc387c9687", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708616, "uuid": "f2df4a98-c17e-406a-b6b8-ac287a4e6c03", "comment": "Malware payload (AveMariaRAT)", "value": "100482bd614d87937d023a8856ad087b6f3d243f4f7489d6331725943d5ec715d2fd818b4027acc54fb1045feac8c209", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708616, "uuid": "6dc71155-040a-4aab-9d88-9a4623fb4cef", "value": "T1760512340891D4CDC99F423D44B71FCAEFA01E77C2808FF62670719DEAA7B858A5A9D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708616, "uuid": "d36a3174-c2d2-4a91-8fa8-0dcdad84275c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708616, "uuid": "7bb491d5-f3c8-4dc9-8a5d-7d0e14b043a4", "value": "24576:CP+MOQW87bhQxtVU8F6G2iY7SVxf9v1nv:CP+rQQxtVUIbfrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708616, "uuid": "4f544b4c-089b-483f-ba65-e46c83bd7053", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708616, "uuid": "4c7d257e-cee8-440e-8373-e4dac438f078", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708616, "uuid": "cdb619e7-ebac-462e-82e0-87dcb53cacab", "value": "40cc8249b0f31d6e1c0065aab24007b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabcd334-e88a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626696863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696863, "uuid": "ad2442d7-e30d-4943-949a-66d28daadb40", "comment": "Malware payload (Formbook)", "value": "401dd1e7907e4e7f7cc2c5bbb958df9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696863, "uuid": "1c19bdbd-8375-4473-997d-520a2a9b58c3", "comment": "Malware payload (Formbook)", "value": "6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696863, "uuid": "cf7889db-bbde-4f79-8ee2-b1beb635ac5f", "comment": "Malware payload (Formbook)", "value": "39b943e797c7a932f4a65a7d8f90bea31e0d7c05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696863, "uuid": "d84a1af1-3335-4549-89e2-4a0135f585d9", "comment": "Malware payload (Formbook)", "value": "ef040816ebaccf3e8125934b818a599b4a4cdc842fc1de8d9512c9aac0b0573e75ac1d6ca3d2fee2cd16c97dd477c2a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696863, "uuid": "d5ae56e5-5469-43d2-b48d-cc495438483d", "value": "T1F8D4E179732BA218DCB4C7F91C69D5B277BBA129262EC27C1E88C13CB87277C16D0552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696863, "uuid": "4c508ca9-0274-418b-963d-49c9a11458aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696863, "uuid": "7ba60945-6c07-4233-879a-8661a1c6218b", "value": "12288:FD6yvUIZbV7BUhPaPrhQRvvnRF5zPO0L2CrpEBSfW:1hvDB70Pa8vvVPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696863, "uuid": "67715ad3-7c5e-4879-9c2d-bba6b8e164ed", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696863, "uuid": "c15abec5-8eab-4051-95a9-2c64cf44cb00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696863, "uuid": "ecdd3108-c068-44ae-b4cb-0b492d243ac5", "value": "shipping documents 19th july 2021 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd5f66e-e8a5-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1626708329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708329, "uuid": "3ec0e686-1076-406b-8efc-9d4cc2fb1486", "comment": "Malware payload (BitRAT)", "value": "9882d9bb0a03a191d8ba9b4bc9c254c5", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708329, "uuid": "a7ad2457-dc25-4b46-8e11-de26dad83739", "comment": "Malware payload (BitRAT)", "value": "685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708329, "uuid": "d27f1497-1bed-445a-bb54-e77ec5d8b1c0", "comment": "Malware payload (BitRAT)", "value": "23bbe2b78cfb4d2c1232fb48bda0dc1ea30222d6", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708329, "uuid": "80d1515d-2cfa-47db-862b-5feb0ac54e01", "comment": "Malware payload (BitRAT)", "value": "45497e65ccf3063e33eae118dc6bb2f04dee02d0bd90ba7f12e7166a25ea31017736a7611032525abbcce8eb492e5344", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708329, "uuid": "168434bb-526c-4162-a299-952eadf8ed1d", "value": "T1D0B5FF5F2E1A6041C57CBD72C9B7F7370E13D4141386812B62B9EAEACCEE2940E6651F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708329, "uuid": "84305a63-860e-438a-a2ff-8d4264c3bd13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708329, "uuid": "0195781b-8ddd-4e45-9113-00065240aa6b", "value": "49152:AknKa6MMOFqbdx14d2RjbWk0nUt0LrOmJwHL0leN3vkPZ:j4OAxxK2R+UaEQ8kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708329, "uuid": "116b3630-3961-4323-b46c-8c1d47029a1a", "value": 2353152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708329, "uuid": "61eaf6b2-b49b-407b-8d31-05ccf7ffd5ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708329, "uuid": "95051fa6-a05c-4bea-b511-f317fd9b194f", "value": "9882D9BB0A03A191D8BA9B4BC9C254C5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36743cc-e8d2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626727748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626727748, "uuid": "fa0e2f21-2e63-474a-8a25-0f4c06d4a5fd", "comment": "Malware payload", "value": "1735796a48ffa604112d7e14856a594c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626727748, "uuid": "0dba9e98-c3c9-4ba0-b037-d3e667c18ea1", "comment": "Malware payload", "value": "69a43a40f02660c2065fe3b76861dab28cc292301c180f1eafbf6c3f7b57afe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626727748, "uuid": "60cd4756-5560-4192-aa82-7a9b0f3852a3", "comment": "Malware payload", "value": "ee60792f75050256e850d3e4330327e0c51c951c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626727748, "uuid": "33fe7a78-9d9c-4a29-875c-7d851b434828", "comment": "Malware payload", "value": "e545a52540fe057a14be3dc92ed801d9c7cbaa23d32560fed478fb2e57db72199b86db49d267f3dd94cad42e9996e30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626727748, "uuid": "c568949b-d6b7-4ac7-8710-f7fff4601292", "value": "T191359C2C2303AF8DFC3C8B755859260493F48213D356FE9A7DDA61EC6A11E528FEB116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626727748, "uuid": "9c5283d5-847c-43a8-aa73-d45806b67c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626727748, "uuid": "43688c22-0e1c-4ec5-ab5b-4a69d1e529bb", "value": "12288:e7jEyrA/NyvUIZbVmEMdMZfK/fSdQv8gpcffCaz9gUgqS5B7BPcsfemS6iKyaCqN:8jEyrAYvDBmBj/fSOv8gp6gFZ7BPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626727748, "uuid": "a47e5483-12d5-4842-817d-b08330205595", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626727748, "uuid": "e5bdae44-2bd5-47fc-9b21-a29633cd39cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626727748, "uuid": "a9fee603-d7c7-4503-a08d-e187efd67c15", "value": "URGENT REQUEST FOR QUOTATION.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74f264f-e88b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626697314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697314, "uuid": "ad9257dd-b858-4d54-ac18-e57468b44a4e", "comment": "Malware payload (AgentTesla)", "value": "8edea84854ac21f8a056f647d010fd0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697314, "uuid": "c9fbb4a4-c632-438a-8ba6-7233d945a0b5", "comment": "Malware payload (AgentTesla)", "value": "6ca42fe27fbffcc87eb0995f36e945d8e62e0c06ea606be6a32382eb557970b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697314, "uuid": "888a1831-5f77-40f8-b754-b1d8e42d9b54", "comment": "Malware payload (AgentTesla)", "value": "3f328de3b2df09e90ef319fe0dacc7dfb585a831", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697314, "uuid": "5be16554-7750-47aa-b206-11fde67bdcac", "comment": "Malware payload (AgentTesla)", "value": "41ba5d0f62d652e211b89b7b91894989c508cc8d6c95bd27ac1137ae04500f3e833bc0b7a3aec1a9cdf77b3ccfe33cd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697314, "uuid": "90e382e1-a7a6-4ae1-ac70-2c40b2dc81d0", "value": "T1D3158EA1F24B7DA4EC6602F64C379D31205BADA95478C628246D7E3A7FB335634E1C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697314, "uuid": "2a496a33-83af-4aed-9951-3ccbb81999ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697314, "uuid": "725f5e72-a376-44e3-bc45-7ac819316bee", "value": "12288:o7zhNdyvUIZbV/O1bJGOD0CInmWC4H9bz97tk5J6f0uZzn9zF:o7MvDB/l00CInCwvBO6NZz9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626697314, "uuid": "8b497c13-07f6-44a0-9bbc-d888603ae456", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626697314, "uuid": "ef08776b-6bb9-41d6-b0dc-182102883c14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697314, "uuid": "aa412e19-6e43-473d-b60d-2772d666271e", "value": "Request for price.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974e6d37-e855-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626673987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673987, "uuid": "5daf906c-b639-440f-8fe4-62e2ef6f5990", "comment": "Malware payload", "value": "fd049d2d63a5c8a04a1955f9d3b4acd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673987, "uuid": "1313b746-d255-4efd-a8c6-dfaa5f70c3fa", "comment": "Malware payload", "value": "6d27f2de1e4f2126e11f0031826c02e815d5462d7789b642f59603c5ec5d616f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673987, "uuid": "d3ac3e8d-a86a-462b-a3dd-ca4d09bf3454", "comment": "Malware payload", "value": "3c8bb918ca5dd9ba37dec92512b0a09a16257c37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673987, "uuid": "4c322ec9-7a58-4ae6-94dd-d5071d87ad98", "comment": "Malware payload", "value": "5309458d32594ebcfc583f6becb4c9bd06ce098eb44adc883a4aae00a3a66207bf1979ae5b1188aafb3ec4734c5c63cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673987, "uuid": "729b2a73-394d-4bcc-a9d9-d3712a3080b7", "value": "T1EFC239E96B9844F6C96CF532F1A24001AB33A2B7A511CD1FA1CD61474D13B52ABC47AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673987, "uuid": "b9480666-440f-402d-a2b0-3e2c23dbd5fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673987, "uuid": "35c33ccb-cb95-4e13-aa09-b3295013f1a2", "value": "768:MagWheOtqaQ0yjBh5OJbGkGflk2ZN/CUhh+c:JtqaQFt2WZNJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626673987, "uuid": "16fb3143-f455-45b9-8a69-3d66aadbb12b", "value": 28040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626673987, "uuid": "feaf1442-275a-436e-b21f-6c2b1577842f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673987, "uuid": "94c25988-59d8-4af2-9ecf-906184e53c3d", "value": "3278_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eff6417-e8c7-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1626722748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626722748, "uuid": "2608590c-cfff-402a-8c18-aa6f259626d4", "comment": "Malware payload (Adwind)", "value": "a4a5060b5ecca405641bb1f3ac0052fd", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626722748, "uuid": "fefd3623-66d2-4679-a6e0-8b76456cf5e6", "comment": "Malware payload (Adwind)", "value": "6db4bb653b7dc11b7cda176c18697d9b2a758b2e1de9b83e3804dce2fbc8ba97", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626722748, "uuid": "a0f9482e-b5cd-4fc3-aa9c-c8b29edc5dc7", "comment": "Malware payload (Adwind)", "value": "0a304bae725613656099f5f8399a41ad6c1c744f", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626722748, "uuid": "f1d82827-34f2-45e4-8293-3fc16a873abc", "comment": "Malware payload (Adwind)", "value": "102cc009d3f09a7f0e4092b2a7ad821c8f6394fe67a504582e788372794f8ddef4c7ad79efb6c14fd1f893ed6c712069", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626722748, "uuid": "5c0c24d9-12e0-41dc-bab8-111e0121c9cc", "value": "T14CE4237842609594B4C85D7AAACBF59DCE3DFE19D239C384F4BB8B412B29301486ED7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626722748, "uuid": "fa8d4abe-b1b3-4674-8ae0-0438eab39e4e", "value": "12288:uV72D/VITQlIwTqiz3fN7wYNrvwCJ8hGtA9MHqs7j:uVq/VITkGi7fNTsU8L9MKs7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626722748, "uuid": "3194d73e-c438-4998-af23-02fc4a0e041c", "value": 666192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626722748, "uuid": "1b68840c-60e9-4ab7-96c3-288d8754575b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626722748, "uuid": "6a2941c8-b778-4e7d-97b7-9bba1d810577", "value": "PO20171118-COGRAL SPA.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de697bb0-e8eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626738531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738531, "uuid": "9c471a81-7ec6-4fce-8124-72a47acaa031", "comment": "Malware payload (Mirai)", "value": "203140de0ec1ff78271e551e60270f01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738531, "uuid": "03bfadc5-e9a1-4ca8-8db6-608264f4fd6a", "comment": "Malware payload (Mirai)", "value": "6e3169034250f0d65c66ba66d099ea8936ca9ea1689f5e436b38d723d9d9a4e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738531, "uuid": "db66abb8-ad91-41fc-a077-aa75514bb07f", "comment": "Malware payload (Mirai)", "value": "07f2eb980cd60438ddb7a8a166e51917b712cfe6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738531, "uuid": "3369528a-3cde-4dc1-b4a1-2fb5999f84dd", "comment": "Malware payload (Mirai)", "value": "ee1af18fe33d90468d7f1e89e06d8c35597711e76e9ad66cb61974ae573e5d9d8b166a4dc2d49f1698805d38e73504af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738531, "uuid": "f8c806f7-0416-4ed2-94c9-450eef87f147", "value": "T1DC43F65AB991CF11D4C4227ABA1E218E33135768E3DF73239E15AF2077CA86B0E7B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738531, "uuid": "272a6e71-3398-4e31-84d8-1e761302b600", "value": "1536:7tnaBcsHX+ZebZQfp7xjjzcIViPMVVuTl:M2VOmhqMVVuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626738531, "uuid": "7d6c5954-43aa-4092-aa33-7edb8eea90a1", "value": 58672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626738531, "uuid": "431a13ac-82a2-4525-8eb3-22727e1ba68f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738531, "uuid": "17373937-a25d-4531-bc0e-f3ed1752f1c1", "value": "203140de0ec1ff78271e551e60270f01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c413ebd2-e841-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1626665472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665472, "uuid": "ec74f1f0-024c-4218-8260-751d0c5ebec8", "comment": "Malware payload (OskiStealer)", "value": "cd14115cec372391a81eb0aabc96a0c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665472, "uuid": "84028048-a250-45e7-a700-a0695b47f1cf", "comment": "Malware payload (OskiStealer)", "value": "6ed656625a63324a34cc766b7a73f47e2ce9e4f56e9ed9ec84e51b0d33407a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665472, "uuid": "678964f5-f5bd-475c-9334-34c4fe45f09a", "comment": "Malware payload (OskiStealer)", "value": "27dc94d60a2d2041bebb52090537eceef22ef2b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665472, "uuid": "a305a380-9b4a-455b-9e5b-b1f7bc572f68", "comment": "Malware payload (OskiStealer)", "value": "9411c68f7d99af26f374f3b1e89b3b8556ea58c5ff8280da5ad85e973fb8ccc13cc9c366fd7c746674d5ab27e814464d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665472, "uuid": "2da7e95e-4e70-467d-88a2-5f36cf83cb2e", "value": "T1FE146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665472, "uuid": "0106fc9d-29b6-4254-b290-bb23aa5bf3be", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665472, "uuid": "26d3fc64-14fe-423b-a11b-1127c6220d82", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIO1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pN/1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626665472, "uuid": "bfb74d92-a552-496a-8049-a6950e5f7dfe", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626665472, "uuid": "3e08b818-12aa-4193-a1ef-6bf66b07f28c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665472, "uuid": "48213ca0-f759-4179-b69b-851ed72d3e58", "value": "CD14115CEC372391A81EB0AABC96A0C7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d88bff-e8bd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626718461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718461, "uuid": "87c8fded-5571-49a9-a328-f488e672a381", "comment": "Malware payload", "value": "3f327df4753c877cc8c91a952df75fb9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718461, "uuid": "e9c01a99-df91-47ec-9fd7-4cef3f8ad153", "comment": "Malware payload", "value": "6fe8a75ebe8ccdcb36a51231201a8c527cbb85433d51800bfd30d83acab29721", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718461, "uuid": "c637a021-49ee-48c2-af3b-29d8da617c5c", "comment": "Malware payload", "value": "beb8d21cb4ad2e0e1689b38e2858f1a445e837b5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718461, "uuid": "d0eaf001-ae2b-4c41-bf2c-4d0e113d57f4", "comment": "Malware payload", "value": "ba8a62c17b03850af591227ba5e09835f56ee6c196336678511306418a944e8bb843ee13caa3e57ac40ddc96117f087c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718461, "uuid": "5c00cf15-1157-4138-99a2-61a90c1dd3bb", "value": "T1DE356BD441CB1AF3F1CD3A541A50F04E572AA64E50914C6A2B2D9FE4BF093FB5F8829B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718461, "uuid": "10c117c3-7a0e-428b-9845-07d492edfa7b", "value": "12288:PLR7m/BFlHRrrYckuCDI2LaUbrYcku5dzFZRsUj:9RsUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626718461, "uuid": "d5a76c8d-0e52-443c-a412-e175e3d56f5d", "value": 1068141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626718461, "uuid": "5555cbce-0fb5-42c7-935e-4e3b295e6a92", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718461, "uuid": "8ce415cb-666a-40f8-bc97-8f9ead767f90", "value": "Purchase.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1944359c-e895-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626701263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626701263, "uuid": "c9d7faf9-2e60-4a41-a2e5-57da6188db77", "comment": "Malware payload", "value": "6a30baaf46fc33081f84b1cb3d552b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626701263, "uuid": "8e902ebe-8159-4271-9a9a-d3d210b5294b", "comment": "Malware payload", "value": "70d5a71e821c8024fa2d5fb8a389390acc1289b88745fad61b6536cab0bd5191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626701263, "uuid": "118e643e-c852-4242-b682-b57a055f47f3", "comment": "Malware payload", "value": "1a394fa6e1d2cabc575c31dfce4cada7b8b3eb65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626701263, "uuid": "aae204c6-c9f3-4fd3-b3d9-5628af9b893b", "comment": "Malware payload", "value": "2a5bfc730de6b87c4531fe5b30c778ef367b0a4b423ad2d78ea24472ed7b180fb61bbb54b7163adbfd4b1d344547924d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626701263, "uuid": "adde7dc4-620e-4119-a3a4-5987288741c9", "value": "T118347E6AE2E40A95FDBBD5B9CD93C217D7F338091A64C34F17A4CA9A5F43321B218385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626701263, "uuid": "99e651ed-6b10-43da-b115-35e18e222294", "value": "6144:02yfji0Fu6oZMXe67BzvVLe+q+WXxWMbTcQC:0vFu6gwN7BzvVe5/XxWMbPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626701263, "uuid": "d57d24d5-50ee-4d08-bfaf-5133f0da7d48", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626701263, "uuid": "20bb1a1b-e802-43f9-af32-90ee6f41e0b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626701263, "uuid": "0b5c4ab4-3ca1-4835-9e59-b8861dd67fe6", "value": "287e37a0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76d3868-e8c0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626720051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626720051, "uuid": "72e06fc1-0326-4969-a5ca-41f7e8c69903", "comment": "Malware payload (Loki)", "value": "4694d5416ba13f78302f8b34e8503d2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626720051, "uuid": "2e234596-bd38-4d22-834b-0236de4843a5", "comment": "Malware payload (Loki)", "value": "71208a309a50eed153e71f16ef1557e6dd7bc32e5f28fc853d1dd3e5b3893067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626720051, "uuid": "61c48ec1-7ed7-47d4-a8aa-ce4d2f5ff324", "comment": "Malware payload (Loki)", "value": "7dafbe30b112eab6ec9832e3a131307f85be5e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626720051, "uuid": "2c896fa0-7e9a-4635-9638-403b3bd3d889", "comment": "Malware payload (Loki)", "value": "ea222578ed8a55fcdab17228ab80248c1d3e3d9a948846890d97ad6ec1709aab01f6d427962df88fb2f85362c502c4b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626720051, "uuid": "00697ee5-77a0-4b62-a5c1-e037af33c54c", "value": "T184D4AC3804A94A63C632A273C669E701FEF355A23231DD1A939BE6C71F13503699EF1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626720051, "uuid": "a366378a-0408-4521-8c59-89545aa36a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626720051, "uuid": "57d6e3c7-033d-45cc-b18e-72e41004fc6e", "value": "12288:Ofv7wX6ugbt2aUH2r7u4R1aZubDjYmCwGpcPmEzm:avsXjCiHG1akDMLHx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626720051, "uuid": "9d5ba0eb-5c26-4d17-8db4-59cdb92383be", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626720051, "uuid": "cc28aa4d-4fcc-4efd-8947-499e03715e43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626720051, "uuid": "ecfe45c0-a251-4f2d-9988-763c6296333b", "value": "DOC.00342009.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a23635-e8eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626738536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738536, "uuid": "edd80046-2be5-4c10-b7fc-14edc983b3f2", "comment": "Malware payload (Mirai)", "value": "8a69644cd870a6456f8a1eddeb0908ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738536, "uuid": "dcfb5778-8c98-40f9-858a-ff7aeb50536e", "comment": "Malware payload (Mirai)", "value": "71b2b326431cbcf312874e6cdbfe012f60c1721bf20a033c3d025ffefe755a3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738536, "uuid": "0062d7d6-a46c-4bb3-87a1-edce397e0435", "comment": "Malware payload (Mirai)", "value": "a5fc53e58070652e7e7a864e3003400b4df898af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738536, "uuid": "458820e2-1871-4d96-9cb4-be0501c04f8d", "comment": "Malware payload (Mirai)", "value": "1748d049a588b62fe1b49e532861f5357a8a75772e364d508b1ff514f2ed87deb5b0f1b1321f61117b7af1e135c120d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738536, "uuid": "a9147ddb-13a2-463b-9254-8a793031af40", "value": "T1BF53734C2E329FADFBEDC23453B39A25A659379936D1D5C4C29CE6012E7020E342F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738536, "uuid": "4fe2e1a2-86e4-4fb6-ad58-51c876e59f56", "value": "1536:eEnyoGhG3rvAADfWM61pOSL1rv6d6jsnYOtkyIef75:jyfervAAstL1+d6jsnYOqyIWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626738536, "uuid": "a71cf14c-d5af-4558-947b-9636e9217e7f", "value": 63932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626738536, "uuid": "10abd82b-575e-46af-8e4e-188d8e3a5dc5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738536, "uuid": "527bcd3a-e3dc-4aff-a6a8-c47dbdfe1655", "value": "8a69644cd870a6456f8a1eddeb0908ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68de1ad4-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626708698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708698, "uuid": "b031aef5-2d9d-473b-a418-a35e23b73e14", "comment": "Malware payload (AveMariaRAT)", "value": "44020c86a10168041f6ddde52fd3f4d4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708698, "uuid": "5e22a9f6-cb89-4d44-a268-9187970c30ba", "comment": "Malware payload (AveMariaRAT)", "value": "71d384c258d0d2cfbeeda66a1ba67085b347d934a3484e0df3fc06a684085386", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708698, "uuid": "e61ab958-1a51-4578-ae3c-0084a3a4deb0", "comment": "Malware payload (AveMariaRAT)", "value": "0dc9cf42fb0b5670d54307c9eb41cbc43bd66454", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708698, "uuid": "55548cc7-054f-4feb-97fc-1ceef3eb733d", "comment": "Malware payload (AveMariaRAT)", "value": "a8711bd33a3994debdc75c321396c5edf2ba65b17f40346bcd02868757488d499b4c526f31eac8b6d5e4cd7d666a5955", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708698, "uuid": "8e0f7872-691d-43e3-ac73-48da39511fcf", "value": "T115F412350890E8CDDA9F077C04F71BC67FA111B7D2558FF946A8502DDAA3F808A5E9E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708698, "uuid": "4f005fbc-ade9-432e-add6-c39fa74d5e6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708698, "uuid": "b9f9fc85-66e5-4b8c-b24e-44dda1d79e11", "value": "12288:l+MO8FsF87bhQxUKKKVxeJzEN4KvNGm+dXSwhJZSqmMFfcoG0rEtL:l+MOQW87bhQxtVUJzEKeN9+VSwIz1qgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708698, "uuid": "e31141d4-3918-42ba-98c2-7d2d70e5b737", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708698, "uuid": "07b17cab-b1ac-4229-b7cf-c0985fcacc2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708698, "uuid": "ca0b27ea-f2b0-4d2a-8eab-cc47f7a4a665", "value": "44020c86a10168041f6ddde52fd3f4d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d2739a-e8a4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626707868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707868, "uuid": "1c67d2b4-a6d9-42ee-bb06-b823381813c8", "comment": "Malware payload", "value": "7c81e999e91d1d0f772010dfa4c34923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707868, "uuid": "886e9532-adcf-4cea-b059-402b65fa0fde", "comment": "Malware payload", "value": "73a52a4c60d253ccdb79e5d50814d1689a49fd85f9e0a40a0dc57ba7fb54e5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707868, "uuid": "29e3287a-4848-43a7-972f-0c5013c9e091", "comment": "Malware payload", "value": "76caadc92346688b50a408b6c48017563a24844f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707868, "uuid": "b8f92693-c564-443e-89b2-81962bb17d35", "comment": "Malware payload", "value": "c635966b928f0a5e20501afc3f1f88bab6ff5a5fe8fcd20e4b2483f849b407f4025352734b08a08ab1f37b0f66ea4a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707868, "uuid": "416b70af-f429-493d-a2f9-7a8479db1b4c", "value": "T1BD05AF11B9C29076C5A167709F7EF3B65A3D6D3F432A865727C83D332E701816B29B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707868, "uuid": "64e190e4-e57e-4b65-a68d-cdf89a2d7636", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707868, "uuid": "0715e12b-f308-4464-b668-93d7d77282d3", "value": "12288:8BzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4aBgZ7u/8u5DGDt2:ucneJVBvXAvwRJdwvZ5aGzu5DGR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626707868, "uuid": "01c5a6ed-42aa-48f0-9588-f7956c7db844", "value": 855280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626707868, "uuid": "0573ff8e-65db-4a00-ab78-282e3fc794fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707868, "uuid": "f857f807-6c84-4b4f-bdfe-6b3e9454ce72", "value": "rlpqdexq.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9713d430-e86b-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626683435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626683435, "uuid": "1f6c06dd-1edc-4e26-9573-f9b27da6864a", "comment": "Malware payload (RaccoonStealer)", "value": "d62a7579b0d5cd057e8ba02fe4a42aa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626683435, "uuid": "db3e3076-7b54-42a4-9a6c-2d536dd067e3", "comment": "Malware payload (RaccoonStealer)", "value": "73ccf81d0e86eba685edcf4b42f97a036e6d2d5a5e9573d7580c71a74c7c116c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626683435, "uuid": "34e4f74d-7511-4760-ae2d-2dc76752e773", "comment": "Malware payload (RaccoonStealer)", "value": "3e44eb1bf762c0ad5b5078cffdbe138ad6d6199b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626683435, "uuid": "630a843b-a9a2-47de-b27f-00f985445280", "comment": "Malware payload (RaccoonStealer)", "value": "fcdf20bc5e9915215a141bfe6f49649f1252480c3d363db90650a4c91a2dc4b439a3573be3a80f198d2ced60a8e94de4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626683435, "uuid": "b62ed4ac-3ca3-4f4a-9e68-2d641591183d", "value": "T1A5A40111F7E0D532E2B34931ACF5D6942A3F7CA25938610A3AD53AEF1E712C2666D313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626683435, "uuid": "036c727f-36ff-4020-9326-f9dad8e0077e", "value": "c0421ed5a83b160afea7e603167f846a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626683435, "uuid": "523d3baa-b247-43c4-9104-de2468497797", "value": "6144:D68bX43GUOE1ggKbCFVCqOLlJ7JZEkL/ek4uN0S8IDUjg8KKA8ODMBQ20LyX8wo:20XGOPDGFYlZvENk9+E5VbBMBQNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626683435, "uuid": "a1d13da7-53a3-4e80-9695-55fe60ae7c42", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626683435, "uuid": "2b33f07e-0bf6-4e6b-b925-1ef0c2b3a432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626683435, "uuid": "9c8e605d-1df5-4a84-b6cb-f0f90c59c477", "value": "d62a7579b0d5cd057e8ba02fe4a42aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42a8118-e824-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626652963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652963, "uuid": "d0d3a356-b87d-4363-8cf9-31e277bc4707", "comment": "Malware payload", "value": "cffb0e02aa400956a945c76b513f4940", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652963, "uuid": "e41c8a62-8119-4592-85d5-6f363926875b", "comment": "Malware payload", "value": "743b77ef58d332261379256b017179010a8d33fa4a8b5fbb78f977de6dff5028", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652963, "uuid": "29553a60-d071-4dd3-87d5-fb8aecf133fc", "comment": "Malware payload", "value": "97bd5e46749c874dc0e7e707429b165321556544", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652963, "uuid": "10726bf5-9f84-44af-8c8d-693f34143d17", "comment": "Malware payload", "value": "ebcea4373a16bce357eaf24a9a4b8c8113cf6ddf683e4bc0029dc4813ae0e52579574ad531ca7a1f8c05f68a1f4226bf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652963, "uuid": "b9d95425-fc43-406f-a03a-3c2543bbf4f5", "value": "T1DA7529027784DD11D06D163FF9EF541C47B8F9022B62F71B7A9E3399A4263A35E0A1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652963, "uuid": "5ffdc93d-00a7-4ff6-a6d7-1b18ab22317b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652963, "uuid": "e7c5d0ec-c0d0-4843-8218-f2f2bbe06d7c", "value": "24576:22G/nvxW3WFFbhEEjfzJSy3NjnZorvUv2C7/3q1j/eAT+48:2bA3y1dW/xiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626652963, "uuid": "c230bfde-c6cf-4179-937d-588af7577654", "value": 1563282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626652963, "uuid": "3fa84f9e-80fe-4903-89cb-287c3b944f18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652963, "uuid": "3771114f-75df-4bbd-aab6-502cad7d37f1", "value": "Software patch v2.5.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a151066-e835-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626660033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660033, "uuid": "80e041ac-0f1f-4585-8158-91cbef203e56", "comment": "Malware payload (Gafgyt)", "value": "ceb9bd325e6d6e5fabb95168df509ccf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660033, "uuid": "71bfc143-ea5f-48a3-83b5-3b5a1a7ebf9e", "comment": "Malware payload (Gafgyt)", "value": "757281f661a10c502d5e8c87779129ba496c99cbd3e69b1c933917fb32a62f5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660033, "uuid": "31216ac4-576a-43ab-b214-9dcb80b5ef75", "comment": "Malware payload (Gafgyt)", "value": "821ba1ca1202d71515c184ccf2fcb4eaa39616a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660033, "uuid": "2bdc6054-4fb0-4c47-ab5e-cd70abdbb306", "comment": "Malware payload (Gafgyt)", "value": "a868da732759a22c0c851a43731402331d062057d7015887e9534d9a4119b8c0ee84d1e813a2a50c1ecf0affcadde945", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660033, "uuid": "caa1f1d9-9975-4422-9f8f-8cfd29504cb1", "value": "T10AB3F872B800DF66F00A96B604D78B227E30BFA74F6316A2731B39669D371D52867F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660033, "uuid": "49af4513-2fbc-4308-a9dd-21ba26fa8b6a", "value": "3072:an0ANMexFGPOMtW11ZvyGsOGG8Ymm/QcuLB1niDNb:a0ANRFGPOMIRyGrGZYmm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626660033, "uuid": "de3e6aed-f9ca-43ea-86d6-bd75b6b0d989", "value": 117730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626660033, "uuid": "75e410a6-e905-40cf-8760-7241fc4a3cd2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660033, "uuid": "48c3a564-ccc6-474d-a8c9-7400d855086d", "value": "ceb9bd325e6d6e5fabb95168df509ccf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d18e9e-e865-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626680771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680771, "uuid": "07f200ca-3477-4520-8110-0246aafddd45", "comment": "Malware payload (Mirai)", "value": "85813e61fabdabe63d98bc17f01debc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680771, "uuid": "fa8f768e-fbb9-4a3c-8788-8184dd17dc7f", "comment": "Malware payload (Mirai)", "value": "75c5187e44ce5c09d765d83691c9226a496d78a03188d1d2784afd00a02193c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680771, "uuid": "ff2c548a-5c51-4d03-96b0-d8f0cb52df08", "comment": "Malware payload (Mirai)", "value": "a5a41152547246cf3b0a65e65a5f9ccddfebe3b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680771, "uuid": "5c21d80b-c95f-492d-bd7a-55b3cb7360f7", "comment": "Malware payload (Mirai)", "value": "f83ad57cdf920655749439b6a7a15a2d596160e6ea6575ac3081fdeaa24bb2242c8d457d9badf37c74ee0daec816def4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680771, "uuid": "3b3c68c2-f7f5-4b07-bdf6-f4f75d23f7f1", "value": "T1ABB2E158405AC430F7709679D4EEC348B91327B261F2FB22629C5B7893C549B9DFB287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680771, "uuid": "99a3c945-9265-4acf-ad9f-a284fcc4e80c", "value": "384:ety8WeclCtatHf8tpnMT08LExkNdpjQ/v/CAjcMChahymdGUop5h84:p8WZlCBs08LExkNdpU/vv5bs3Uoz+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680771, "uuid": "f654d435-4588-4df1-a823-bb02a2942381", "value": 23824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680771, "uuid": "a693cfc1-a386-4075-a301-5dfd66dcfa38", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680771, "uuid": "dfc3a353-27e2-44d4-a424-a53faeae1f7a", "value": "85813e61fabdabe63d98bc17f01debc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc806ba3-e858-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626675365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675365, "uuid": "a2974323-6c79-4d22-b4b7-c9f7749e48ed", "comment": "Malware payload (Formbook)", "value": "28bf89774d17383070f8357d4ec41884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675365, "uuid": "ed8733ac-28b1-4e96-8a2b-8934ebdbce98", "comment": "Malware payload (Formbook)", "value": "76f60d4f6d788a4d4192336c79945af5233318ca6bd00b200ee46cc679d0d89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675365, "uuid": "25c6449a-072a-4352-9327-2dee2da5881e", "comment": "Malware payload (Formbook)", "value": "722031ac0a94582bf3283e9e7e6af1285bf1959a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675365, "uuid": "55b1c9b7-7f42-4292-b395-a0c69f17e283", "comment": "Malware payload (Formbook)", "value": "b57eb2e575e401078a9911c8aedae50ca62918e461d74d323cf31930cd7a5ca93d43dcfc6dec64f6f419a135931dfc32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675365, "uuid": "c3221f6e-3bc6-4c8f-9e30-4362d5e047e0", "value": "T16804010CA7AF9370C70573B2765CA97F14D28AF4199FBABBF769588421898C00756F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675365, "uuid": "9e1808dc-cebf-4e2a-ae52-046b419c8680", "value": "8b9c7c9498a635f685c3b4d13969793b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675365, "uuid": "6ba1f2c1-625e-4cda-946b-23b4e7a30b21", "value": "3072:vyac0V+fSec9Bl5g8uAx7R4RqkMF/hAQ7WNA1+QGBuE9O86:vKB09L5ge7RSZQ72A1kAEw86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675365, "uuid": "bc836d6a-1b1a-4563-a9c5-760dc294866c", "value": 175715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675365, "uuid": "497afb29-bebc-4845-81bc-2932b1d6a9fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675365, "uuid": "d7419a74-2af2-40c3-a53b-a3af5d728fa7", "value": "soa-032119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720764e7-e8b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626715156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626715156, "uuid": "56b46936-059d-4e1e-812c-777e3b8cfd75", "comment": "Malware payload (Loki)", "value": "8f35517bd68bbe4d0d2362445172763a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626715156, "uuid": "ac440c09-273f-4de3-9758-a74824b7dbcb", "comment": "Malware payload (Loki)", "value": "7746d06b49835e0b431daaa65c560b936ba1598e886a1749496966da2918ce87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626715156, "uuid": "00e278f1-7a15-436f-87c5-5e6a54cddfa2", "comment": "Malware payload (Loki)", "value": "2a9de00b645267ac3c184b62c726f6fad20d0df3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626715156, "uuid": "7a354f8a-40b1-4e59-8f61-9f74ac5ca97b", "comment": "Malware payload (Loki)", "value": "5e3e3ff51a1c659789002b1af8b15592f40f77de92a6b9e8c70f4da8d2adbb8c024eb71999f3d5371ae6f7ec43a98a2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626715156, "uuid": "bba55887-1ca6-47f7-ab18-2294b80379d9", "value": "T10F24BE5079E1E832E6F2493098F1C6A47A7FBC222D38854B76843ACF5E712C16A7D353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626715156, "uuid": "fdd74c8f-1875-49ae-a7ed-43099408f914", "value": "52c37101f2973085af5ed972e3b0d2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626715156, "uuid": "1ead7e6f-da76-45e4-ad1b-099a3049e2ef", "value": "3072:YGaAPVmnXE0Izv16fktB7dUTLJDwX5QlicSlRs1bL1u:MiVmnUTz96f0YLyX5Qlixlwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626715156, "uuid": "09255b1c-aaf3-44d2-b8d3-d3cf13764856", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626715156, "uuid": "ef13827b-2377-41d0-b3c0-34fe02876550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626715156, "uuid": "b56744c6-d528-4a0f-9f37-ae4d008a285e", "value": "8f35517bd68bbe4d0d2362445172763a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87d8f9c-e855-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626674150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674150, "uuid": "6d04b164-9b0f-4c66-80d7-72a18b06b7cf", "comment": "Malware payload", "value": "517101d8ce2cf3ba10490836d572b5e2", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674150, "uuid": "7045e990-b611-401a-afa0-37f1d1ff8319", "comment": "Malware payload", "value": "7794779bd9095578f575a942f6e280101ab9682d4993d93003ec8efd750fb5b0", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674150, "uuid": "6d5a265d-45e0-4b5e-97d9-739b619a994b", "comment": "Malware payload", "value": "66ed8a09934e8ea4c0d2b2fdb11e8d5ec16c2aad", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674150, "uuid": "06bb079c-15f3-416c-89be-519186b9f8e6", "comment": "Malware payload", "value": "3e8fa1879c13cc319456cb978dac0c226607bdded3e3141dc2c703791b1d44cf60260eb98cb3fa9f164d80ae45cddeb6", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674150, "uuid": "619c477b-7fb2-4c1d-8918-6ab4c4ca46bc", "value": "T1F2B4235522F87FAD056C47EDE4B456A08100C0F06DAB84527AB95C3FEAB9EE107325FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674150, "uuid": "3dbdd8e5-f758-4696-aaa2-778683b84eb8", "value": "12288:Y8IR4Z5OrYnd5Gff9Et17r3NWo63WL+dtLp8jVXPeKq4UJWOf:Y8IRwMNEtdNH63WLCLpgVfz4W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626674150, "uuid": "4c9f075a-b8a6-4d69-bd56-d94e7c467ae7", "value": 523185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626674150, "uuid": "be090392-010e-4b97-9d31-daaddce758bd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674150, "uuid": "d51f3b6f-82be-42d4-ba4f-f3c53763c381", "value": "Inv_7623980.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c856c1c-e8ed-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626739091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626739091, "uuid": "b51e8618-cf14-4cd9-b01f-d133883914cf", "comment": "Malware payload", "value": "7906a6dcc1b2231621a9c926db603530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626739091, "uuid": "8f1f3f41-fc2a-4403-a572-ccab1179ea26", "comment": "Malware payload", "value": "7a498b98c890976c8b3e41264b64571e5c3d70c89633d140a824cab5b29443bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626739091, "uuid": "0b805a27-f109-4a9c-ae3f-0fcabc54cc1e", "comment": "Malware payload", "value": "f32d35058a409471487e143b27bcc17b5f493a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626739091, "uuid": "1b31f483-3c81-4ee4-aabd-c8bc56dc6481", "comment": "Malware payload", "value": "181efb66ff1153aba4b72775a81d624c00675c5ce5c89d8a4fd052ca50d7cfa85ec0472dd2a5c45b7816b55d0acb5da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626739091, "uuid": "7fd60b98-7323-4a1c-a2cc-c9696a252906", "value": "T161040205632E4A18E15FE139A67AD17E32ACC1F1268F053327A7DF1D3C391D25878B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626739091, "uuid": "a35fafc2-b5ed-465f-90c0-83750a24039a", "value": "f45f4bccd20f0a7ca0fccc38d235a8f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626739091, "uuid": "e5715b88-85ee-4c80-9c8f-68f87dd6b854", "value": "3072:padqQoQDK1YrRHa3w7Q7wEN/K6OKIlgMnpctwdyqO8l4KqmkaWOuDaPtTjbLb+U2:AoQD99Ha3xQIwdfOpoWPDIaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626739091, "uuid": "7fea6952-aadd-4016-a76b-28fc9aecddda", "value": 176410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626739091, "uuid": "85c0f521-4144-45fc-a92e-c63e0231ce16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626739091, "uuid": "10f1fe5a-572d-4305-bcf0-60010cc425ba", "value": "Audit Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edbf36bb-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626708921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708921, "uuid": "f691952d-8e09-4fee-99c9-418ca8faf4cb", "comment": "Malware payload (AgentTesla)", "value": "01a0c071b2f9fa818fabec39db88e27e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708921, "uuid": "df6d9c10-5e4b-40ce-8fc6-b27e4b760d86", "comment": "Malware payload (AgentTesla)", "value": "7b33311ee48c92be5c7f410193e6ff638f0d687f787f16be01335abd9fb53442", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708921, "uuid": "7f604e4f-8f1c-48fb-bfe5-0d245a877178", "comment": "Malware payload (AgentTesla)", "value": "7769b0c19913662ac542d0297e62c01539a782aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708921, "uuid": "d9dd6b3b-5941-4eb1-a51c-0598127ef949", "comment": "Malware payload (AgentTesla)", "value": "20c2777fd05f4886225d91c9f5a8c78c507ff4cb7014371ce4cdbc662872d2163d8e5530e87d6bb674d6acc5c8db6fc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708921, "uuid": "fa673429-c96d-4935-b24e-3b9ec6ed661b", "value": "T1C285395D3712B78EDC53CE7589B85C60EB91B47A430FE347A4A312D89A0E997EF101E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708921, "uuid": "9488c75f-62e6-4a29-a718-ae04d4bc35ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708921, "uuid": "a3f000d8-5afc-4143-9e31-4e3c5ff37417", "value": "24576:4Avk2CPsZp+biWbGnY01kQvDBuaPmP3eXKthYPyJQlXDr:4b2CjlSFWQIaeuVkQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708921, "uuid": "ef7bdb3d-b5db-4e7e-b249-f0c87af772c0", "value": 1836032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708921, "uuid": "cd54ef79-2389-4396-8d2d-c86a21f1a41c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708921, "uuid": "e8711a26-7376-4c16-9159-29ab81e67f90", "value": "COMPROBA.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e602a861-e8b2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626714062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626714062, "uuid": "0bf49668-e6ec-4725-a662-7c0d3c22c409", "comment": "Malware payload (Mirai)", "value": "764f416dc0ce8d4d6af816c0ae69bdd2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626714062, "uuid": "e54368f7-223f-4809-aafd-3371648f017f", "comment": "Malware payload (Mirai)", "value": "7c2ecf508e32f5aa4a73546f1b7cd0d56fc9ba5f060177129706b52a4529d06f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626714062, "uuid": "267f8dfe-f590-40f5-a4ef-1e673c347b0e", "comment": "Malware payload (Mirai)", "value": "f482283d17c93f37a1fd83f04a9ded3c70071c84", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626714062, "uuid": "859178b9-00dd-400d-b469-58c0c2d62270", "comment": "Malware payload (Mirai)", "value": "690cd992c2caf838b8e6fac989bf736e36d93fb2deccaaba350f99ecc53e477a38f7a073b4a27aefc9a2c07c1b014b09", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626714062, "uuid": "f560d45e-14d6-4376-9ee9-79392a5f89e9", "value": "T1D764029BEA627C4FEE474FF021AB0A4617FCD2DAD38655907368884439FE24293647CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626714062, "uuid": "129bfc0c-030e-4c06-b7d0-7af230dcead7", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coU:7O/QJHZweEL/NOjCHm7FZZnc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626714062, "uuid": "b3b8ef76-3dea-4092-8567-db5e4db577ba", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626714062, "uuid": "de20b48a-08ba-490d-8197-1263430e81ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626714062, "uuid": "78d5f950-14fc-414a-ba57-ce92ea62b6a3", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecfabb8-e8a5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626708493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708493, "uuid": "90e4fecf-cbbc-4dbf-92d5-505dc5b85f0e", "comment": "Malware payload (AgentTesla)", "value": "3a8ba0716c52dc27da96874a036eef97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708493, "uuid": "7b153823-97d6-4085-914e-6054a9532201", "comment": "Malware payload (AgentTesla)", "value": "7d4154d38463901a813efcd591fe9557f4375bc1caf5bbd15dc5d108fcbe43c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708493, "uuid": "52c7ae97-5331-4c51-bb2f-41b4a3eb55c3", "comment": "Malware payload (AgentTesla)", "value": "7b37c63a3c5078b53e9ae737dd58544931d72733", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708493, "uuid": "c185cddb-6a00-4b8f-a436-2c6931e43b8a", "comment": "Malware payload (AgentTesla)", "value": "800b21b7e4cedca1aead5fe751c7201b5c5ada0782f2276664dc7e9efc63f31f86578a495addf692a99372598e731d86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708493, "uuid": "113d4ced-1f50-47f8-a45b-faab610acaef", "value": "T17C35CF5C324079DEC4278E3389A4EC70F6906C66570BE90358E77DABBA7D687CE111E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708493, "uuid": "de28f273-ee0b-48dd-bb4a-80f0ec76002c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708493, "uuid": "99090d98-1989-4bac-91b9-e924c382d2bc", "value": "24576:DOmxZC3eCH/plqRyo1Xl60TjrA0MEskdr5m5p:DzNol+p1M0zVMEsmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708493, "uuid": "1efb6888-59a2-462e-aa9a-5a5bd521e299", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708493, "uuid": "c46ddd4e-2cb6-4368-9886-6067593c357e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708493, "uuid": "98994543-cbda-49bd-a4dd-5daba7af97c1", "value": "New Prices 19th July 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4acc8e9-e892-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626700262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700262, "uuid": "f815f4ff-bc8d-419b-9b12-a4df510651be", "comment": "Malware payload", "value": "d2e0a40064ac60838312c389aa37192b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700262, "uuid": "3fa7a0f7-eb67-45ca-913f-84f55cc185d5", "comment": "Malware payload", "value": "7da903dc2abc47ad0b16a457e013a77e726fa5a984829ba9f226dc984e3a7361", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700262, "uuid": "9ae79988-d596-4d46-a37a-31ba6023d19f", "comment": "Malware payload", "value": "8f49d5fa04b25c34e0a0c51c4f22ba0f8882c737", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700262, "uuid": "61b34c33-66b5-414d-90df-19f9881fa954", "comment": "Malware payload", "value": "210f9518a29d5b49faac6d862dcab345c56c89bafada3dc13aaa1c9be2e5fe80b2d42262d6aa05d8fdbd370088ecc2d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700262, "uuid": "dff1ea7d-ebb4-4d89-936b-c8c279eb4c57", "value": "T155E4F179622BA21CED6887F91CA9D5A177FF642A222DC23C1E84C13DBD7377C1AD0542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700262, "uuid": "42b4e90b-ab99-43ba-90d6-e047c0fe35a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700262, "uuid": "68580d54-10c4-4958-9d4c-6dedc3696c15", "value": "12288:MH4yvUIZbVKQkyQ5dK9je59WIqiX0ekilkMRhLpqQXG5:knvDBKQrHYq3CkMLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626700262, "uuid": "d0d1ed34-ff67-42de-a489-03e41343975f", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626700262, "uuid": "e28c774f-1b9a-4597-b485-6e2f302ae5c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700262, "uuid": "d65429f3-1d37-4b50-9c36-66cc35eabe17", "value": "REMITANCE 103_03435_210408_BSA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d2dbd6-e834-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626659764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659764, "uuid": "c64d5968-3a14-4054-bef6-60777700d917", "comment": "Malware payload (Gafgyt)", "value": "c5f9e484e9de0cd921e971cf156853e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659764, "uuid": "3be8ce6e-1f0e-47f7-83b4-45339ea360ae", "comment": "Malware payload (Gafgyt)", "value": "7e3cb0fe7facad9b077c96726a378ea498e65f3d58d93ab08ce90ce862c1e0e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659764, "uuid": "e06bf6c0-a761-4d9d-ab88-e579fd3fe9ac", "comment": "Malware payload (Gafgyt)", "value": "03b97a1d9036fa37f9d5de4debe09e1b8ee1208d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659764, "uuid": "a7cccfc5-5e01-4ffa-84be-40235d38d0d7", "comment": "Malware payload (Gafgyt)", "value": "db8c12d750555d51c3b5049e7ede990afae745288fa5ed7f032ceba47512f2b84bb6287aa3268a4b2f388526f7686180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659764, "uuid": "bfd6e9d8-9c00-4e99-a728-93cb3d682e32", "value": "T1A3E3A636BB619EB7C80ECE7305A985021C8CD98712D96B6BB2B4E51CE767C4F08D3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659764, "uuid": "533893d0-31eb-41ac-87c7-f9f91312c5c9", "value": "3072:xeyO0EO4qe3+zMph7JFjgmrThPaLEnvPrNb:x/4qm+zMnDjgmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626659764, "uuid": "eb4229fb-2f67-4d6e-b7bb-21db1bd2c935", "value": 155392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626659764, "uuid": "dc3f8dce-2c8f-40f0-9869-00437671d89a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659764, "uuid": "47594ddc-3cdf-4bf1-809e-f2f0602e2e50", "value": "c5f9e484e9de0cd921e971cf156853e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6439b6-e83b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626662855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662855, "uuid": "345a2850-3746-41ea-ba58-0f604877844f", "comment": "Malware payload", "value": "d441af67a4a79bf18cc0be3920d355f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662855, "uuid": "7cba13b0-f3fd-4ed9-8e09-6cc10a88ed7f", "comment": "Malware payload", "value": "7f100848ffb6fdc1e6747787b3fa3669a5fd4d7faa87d5b56c8d5470ab399d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662855, "uuid": "a6042356-79a5-4343-ad98-d1b7f67ad6a6", "comment": "Malware payload", "value": "06480acda01c24b0a6af47f8dbc1f284eb5babd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662855, "uuid": "47698eb7-a4b0-4986-949e-b5c2088dd471", "comment": "Malware payload", "value": "546c1d76751967fdaaa36efbb4fe1ff7038839c7945227c64be724044a630a9e5628c4d531a60bc7043750897cc00bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662855, "uuid": "896962fc-9d6f-40f4-bcf2-f41e584fc3db", "value": "T118158D15B308FB99D25D1E35C41B0D1897E0C92373B6F6DB3CE1A6D045B2B16AA1F2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662855, "uuid": "e773d034-0fa6-4f41-a097-35f40e3a82b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662855, "uuid": "907502c6-7858-4e57-affe-b3f5ac537200", "value": "12288:5acoUmBNQNl4jfnzwZvIg6O24YQ5NaOgKJfcClqJDLlEGOOZuX5DRKEKfeQU7:5adPsNuDzwZvB24RD2LyqJDLOU8DmeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626662855, "uuid": "a4b4736c-12e1-436f-857d-206d28e0e29e", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626662855, "uuid": "da88d770-b11d-463e-8c20-d389cab8941e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662855, "uuid": "26f99240-0859-4656-a53e-5397f5ae9d9b", "value": "SecuriteInfo.com.generic.ml.15285.30302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746fc48f-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626708718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708718, "uuid": "42c96cea-f84d-4eeb-990a-14fe8f2bfbe2", "comment": "Malware payload", "value": "8a558eb0319715272c988f3868731ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708718, "uuid": "b87a9517-59c4-4845-b304-f2b39486ff38", "comment": "Malware payload", "value": "7fdd05a0abd65fd4633796720b1c7f7c55279184c56617ff6ae0cf8d20984985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708718, "uuid": "78028f1c-56a6-4777-959d-f35b2050f3b8", "comment": "Malware payload", "value": "f25c2074a482a65380cb2bb02af131a7d76bdcc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708718, "uuid": "1fe5ef02-d45b-45ac-b56c-1a768bef67dc", "comment": "Malware payload", "value": "1eb64d8f7948dbd2d12d9a61a9e80888a6ca11fdedc2d142c58d9270fd4fe54ac92296e0901e146af14d8a5ef1ca53a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708718, "uuid": "2d1fecd1-c910-4f4f-bcde-539a4fcc17d5", "value": "T103243A7B027D8065D15A9730E8720F0B767ADF240540B18CA0CBB2BADEFD64D9DFA265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708718, "uuid": "1512c187-0695-4aa5-a3e3-b1547ea89779", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708718, "uuid": "ba81f0d2-5bf6-46e2-b077-af5fc9b4f5ff", "value": "3072:k4xczg2xfvVjsaxYxIPkV4DBU+1DwvGFkXj:kicznxfdjXkIPU+pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708718, "uuid": "6254c4c1-a817-4872-aee3-54fb9666462e", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708718, "uuid": "c3297803-38ee-4430-80a0-bf36bda9c750", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708718, "uuid": "a204a9e0-6247-4ea2-840b-468829643283", "value": "8a558eb0319715272c988f3868731ad5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67869566-e8ad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626711702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626711702, "uuid": "e9641012-fe1a-4ae0-a5f0-31d274bb50f4", "comment": "Malware payload (AgentTesla)", "value": "a1cfa5ea683f08c22d414dfd22bc0bb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626711702, "uuid": "3db79a6b-fd4c-4dc7-99db-d3fb43bbde4d", "comment": "Malware payload (AgentTesla)", "value": "80e0023af289a66bdfc1ca1ac40c439e62f3f9bc132a127a13fd8bbb4ee15d85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626711702, "uuid": "58b128fa-35da-4461-a057-8f1a3156ebdc", "comment": "Malware payload (AgentTesla)", "value": "df722c7b21536cf91b32f228bc73d8b694f6a635", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626711702, "uuid": "672ee478-01a1-4e9d-bbfe-afce1e013fb5", "comment": "Malware payload (AgentTesla)", "value": "6a498d2e389fc9658551fc6ee4116506b217812096eea7f3a059e35fc6f9a362119309d2bf947eb4301121e827761772", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626711702, "uuid": "6b66ac2e-eef9-4f0f-8abe-e8558df41e90", "value": "T15925F1213267A604CC3887F95C25C1B17BBE6C2A666CC67D2EC8EC7F7DB26B859D0540", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626711702, "uuid": "d308df9c-09ca-4c8a-9ec3-a7a0cef484b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626711702, "uuid": "dbd5ddc4-4c80-41dc-b6ef-ee3accffde39", "value": "12288:XrjyvUIZbVlBPI2VBP4Vj+yfthWGrgCElpsSXq9McjOjipQCR8sn1QJ:6vDBlBPIOBP4Vj7lhWXq9McjO+pFv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626711702, "uuid": "5d317865-1d4c-4233-9c51-48fa07bccb16", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626711702, "uuid": "8d2d2581-a35b-4619-bb91-570888745e56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626711702, "uuid": "f3ae6cad-11af-4253-9699-a82e11870f71", "value": "PSnWAeGbg17JFlA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c921203f-e8de-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626732911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626732911, "uuid": "7463b6f9-8e21-4870-a92d-77ac4b795eae", "comment": "Malware payload", "value": "bb072cad921aa5ce8b97706ce01bc570", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626732911, "uuid": "e0a7520a-ea4f-4a96-9836-74b3b596e043", "comment": "Malware payload", "value": "817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626732911, "uuid": "c445a33a-7e92-4534-a4d1-b3fd0f0a7532", "comment": "Malware payload", "value": "18bf034906c1341b7817e7361ad27a4425d820bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626732911, "uuid": "035ded0b-0dfd-4e64-971e-fed80f02677d", "comment": "Malware payload", "value": "46e7328ed98e8dff14289feaddbdfd788de6604c9a2f80889cc3e3beb7e0f38580dfc33541ead10c5c39a8be37b90b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626732911, "uuid": "903f19b0-5e73-456c-b765-ab6fe5947d4a", "value": "T165E533E2B6632A29C59367F2251EE56FC534523F4B05DF861FC83849FAA791F9310B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626732911, "uuid": "01812e97-c6f6-404f-b79d-8689f17c0ea7", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626732911, "uuid": "895da4f4-0ff8-4931-af0b-3e61c20d996d", "value": "49152:Eg73KKU5d4itjMbpnyrcC4PDfH1Q57C0AMqkhLeSkjMSCI/TYA2Uj59ogfci9Tk:JRUbRtIbhwoDG57KNG6dTYil6g0i1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626732911, "uuid": "5e85fbfd-1eac-4c2c-9687-406a44f03c52", "value": 3119018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626732911, "uuid": "66c15635-0414-44b0-a9af-682d8ae92f52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626732911, "uuid": "84cb20d5-703e-4d13-970e-676bb46a27e7", "value": "8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5202e520-e8c0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626719827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719827, "uuid": "407b4fec-ac3f-4eee-8d6f-d1f4111a4048", "comment": "Malware payload (RedLineStealer)", "value": "7e432f6ca665df7e873f70efd83cca48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719827, "uuid": "2767dd5e-1379-47b2-9d39-ec7a48bde176", "comment": "Malware payload (RedLineStealer)", "value": "8336f98e2a79db607dedb4505bf9b5dce161ea7d4bc726248ed23f9f008733b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719827, "uuid": "e9c5c1a2-c3eb-4ce4-89e6-a41f50b98b6b", "comment": "Malware payload (RedLineStealer)", "value": "752d8823aabbb1513428349a65b05b56275c31cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719827, "uuid": "3b9ca557-9300-41f6-97bc-2045fa93b60f", "comment": "Malware payload (RedLineStealer)", "value": "416b6f7e1dcddf1030577cd6dabae0a094fa84f1fa23105b95ca5efe257fc6a3faf02f4654dae35ca1e76902e40b4474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719827, "uuid": "e2ab246e-f5e7-49be-a699-78c679cfb745", "value": "T1F0E5339728C50C93E4477630ADBF006B12F08FBE0BD785D64B933D966A69374481AFA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719827, "uuid": "11eb6cb2-dca6-482a-912f-f9050d904ad6", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719827, "uuid": "4427e81b-5b4f-41a0-8b2a-f3c25699a10d", "value": "98304:RimfJ4Ay/NqhclqaP6ndIXcGQkYfR91v9EJ/:RjJ4p/0hOqawcQkuHzEJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626719827, "uuid": "710db7f3-b849-4b81-ae02-549024ec12c7", "value": 3259768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626719827, "uuid": "d1f085e3-d44c-4642-a2df-f89f843cc5e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719827, "uuid": "ba01a759-c24b-4dea-b06a-77f4bcb33c3a", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3cb3f3-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1626708732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708732, "uuid": "49a56567-b014-4e67-af88-564ee83ba213", "comment": "Malware payload (TeamBot)", "value": "b2a93feb45e2d76bdfc83c623a14d5bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708732, "uuid": "b0cc35a2-3cf7-41df-a194-44dadff635b0", "comment": "Malware payload (TeamBot)", "value": "83c46c1972e541b0d3baebec8cbdfe6e6ae7d87643c701eed91ffc844b9168c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708732, "uuid": "cfa2ac23-dd22-43d2-b004-fa276e3a2383", "comment": "Malware payload (TeamBot)", "value": "f39c5e92adb9ba4602d8973cc286ab265f11d137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708732, "uuid": "820123b6-b065-4673-b78f-7c394bc92817", "comment": "Malware payload (TeamBot)", "value": "932a9f28e0737e5dba5c364176fee011413454ba8271b68d7992db351d48eb466a538a3451e3c9cb037f540c7188620e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708732, "uuid": "d679a0fd-5049-4f10-8387-31036e7cd02f", "value": "T159F4121436E0C036D1B68A3954F6C2F4192FBDA31A34417B72563BEB2AB05D269BD373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708732, "uuid": "39140b67-24c6-4d68-bc2e-918396f53433", "value": "d0200a61185e5e47748a9fc60359c3ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708732, "uuid": "b00ee536-28f3-4f87-8d0e-f51424705a3b", "value": "12288:tNrzuqGqzTwFSe8T+rUg3gNUp141Zcr4fOORaR1gA8E74/uIWXSyC:tNunUwFSe86rUg5aZcrIOOs1gAZ7FIW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708732, "uuid": "f97e2f7c-558b-46d7-a087-1e19bf3ad774", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708732, "uuid": "18d2cd6d-373d-413b-ae1f-a1e5a20b1058", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708732, "uuid": "47bf5430-c180-4269-9a24-48b421f0cf10", "value": "b2a93feb45e2d76bdfc83c623a14d5bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b878afe7-e86f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626685209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685209, "uuid": "676df04f-25fd-45d9-b0ec-a696814a1879", "comment": "Malware payload", "value": "95ea943b96693d01b5301e34fc485393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685209, "uuid": "72bc52a6-e7c5-4edf-ba1e-e1b9d3f6975d", "comment": "Malware payload", "value": "842a028d1a0b25b4e443f3df6f4ad724b53826604d6e5963668223e44740033f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685209, "uuid": "5811e3a9-2736-422f-aba3-bf1f673b2661", "comment": "Malware payload", "value": "5cc3bd27ea3b9634c09043095c52da001e986ad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685209, "uuid": "8b5b0e30-80c2-4e0e-8cae-1df0f8f571f0", "comment": "Malware payload", "value": "1cec149727c88adf0a928607ad0d95768442410a72926d64bac3947aa6dae96a529a3c973aee3cae1239f010fac6d053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685209, "uuid": "e232d9b7-bf6f-491b-a3d8-6b153a84b5eb", "value": "T16334191E7604E81AF8A6C8B73419F12B62017C7752451E1B724CBB30D837776A8BBEC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685209, "uuid": "34c02651-028f-4efe-a720-fa5a1ba2264e", "value": "e9f7dd0da1a2a1266893e1ae4ef42b67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685209, "uuid": "e9a5a939-9f16-4905-b001-8b572f423e5a", "value": "3072:q3BepJlZa/g3bgOt/Z9FzqMkE0ZAkK0GtWHJlZapGBR:giUg8OtBYEUAkF9HP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626685209, "uuid": "c60c030d-539c-4251-87a6-fe1b52a2d50a", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626685209, "uuid": "c28ed231-5d77-406e-8278-ab7488b2b1ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685209, "uuid": "5c6c5a1d-61f9-42db-85aa-c40adaae2785", "value": "Justificacion de pago 75. 344,70 Euro de Grupo Santander.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc64de8-e8d7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626729859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626729859, "uuid": "dccc2a4a-77c9-4317-ace2-3befe430a725", "comment": "Malware payload", "value": "6c592736cf6ae24c1d7e5d051234fdbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626729859, "uuid": "8cfd1e43-f994-4927-8e48-96fc41b36f13", "comment": "Malware payload", "value": "846d82f6f9d6b965ef683cd91724d72917263cf21e9f0f7e4ed2cb4f1ceacce8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626729859, "uuid": "f2c13fcf-68c6-47be-8d52-bfbddcfe9a33", "comment": "Malware payload", "value": "dcfddb9aed55a79e38287ddd4e849728d61b67c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626729859, "uuid": "63388eaf-c335-4a5f-a521-5c92f0277966", "comment": "Malware payload", "value": "a90f5080bf23126a048a17295350e8ff644fcebbc66fa5b492fb79fb67f4daa2be9561a2d03bc57f156991f21dde189e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626729859, "uuid": "6436b717-c895-4b65-abdd-8093288abf87", "value": "T1B34522529F0D8718F604F0F065C66A7CFB94FC1168ED8DA708317929E4763AEB3AE194", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626729859, "uuid": "bfc2b9f8-034c-4563-aa35-9ade8dce3940", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626729859, "uuid": "3b83f61e-55b0-4bca-b2c4-5c2a9acf19b0", "value": "24576:d4ojqoSH+GPA60uEJFl88RJpfRRTe6ICjZb17VxceKovgbgfVyF+g:iotk+bJFl885R9NIYd17Va7oIbg9yFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626729859, "uuid": "b3d64047-6487-4121-ad81-62a263e6dc1f", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626729859, "uuid": "62fbfb06-976d-41e0-8025-813f11f6c82b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626729859, "uuid": "d1475443-df73-4b36-914a-a750063aa76f", "value": "6c592736cf6ae24c1d7e5d051234fdbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d8444c-e875-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626687701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626687701, "uuid": "fb40e7b4-a443-4711-95a5-add3ec8a7c2c", "comment": "Malware payload (Formbook)", "value": "8ffb5b1aba6759d623f20a9744de4dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626687701, "uuid": "24780c33-9dac-41db-b435-c86e478197ae", "comment": "Malware payload (Formbook)", "value": "8674688f673421c41dd39734f690c3b1b0aa8aceb5adeb057cf8b21d8f2e41a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626687701, "uuid": "ad447bcc-af16-4817-b449-52f7da0db7ff", "comment": "Malware payload (Formbook)", "value": "969a580a9e874f8e5a38d7fb4db664be1aa35ce5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626687701, "uuid": "0384e0aa-74bc-4e80-9d09-8bf8a334d6ad", "comment": "Malware payload (Formbook)", "value": "8dc9de47dabd93ff497b29e226a96b97575115da666a124ec43d63a343c834b348eeba627b5093200a54d93814b88b1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626687701, "uuid": "d91591b3-0276-4cac-abe0-6b5c2d961d00", "value": "T14615F1263227A254DC3883F55C65D1B13BBEAC1A662DC27829C8FC7F7DB36785AD0190", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626687701, "uuid": "aee46052-f2c0-4925-a542-25d867dd1f1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626687701, "uuid": "3b0c0590-2263-4c2e-933f-16e409f6800f", "value": "12288:PNVCqo8zTyvUIZbVlBPI2VBPpZ9SgkVJNoH6tm8EblyuVYvv/zzbVgnQe:0vDBlBPIOBPHsl7Q6tm7blmv/nbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626687701, "uuid": "f9eacd83-d483-40a5-ba68-d3c32acad964", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626687701, "uuid": "6b7db13e-ef45-4f90-b03a-d22a80c15cc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626687701, "uuid": "29bd8b23-2fc5-473e-af01-90298a2efab2", "value": "\u0442\u04e9\u043b\u0435\u043c \u0442\u0443\u0440\u0430\u043b\u044b \u0435\u0441\u0435\u043f#454326_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a37606-e864-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626680510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680510, "uuid": "079c41f7-df9d-4647-9402-5feeb547479c", "comment": "Malware payload (Mirai)", "value": "f7ee8fa74c86969f77a19b013ba570be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680510, "uuid": "b0a97af3-4765-4c9d-92a4-591592e810cd", "comment": "Malware payload (Mirai)", "value": "88d797496cc4f329655cf886e4949113573eb28cc55d56847bccf92c6276789f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680510, "uuid": "6eeff8ac-a14f-4542-b061-810c6e613e81", "comment": "Malware payload (Mirai)", "value": "5b1400eb92442033aec42f37e24db49f335b752f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680510, "uuid": "61f2ce4d-e8c5-44f5-9626-9792273890a3", "comment": "Malware payload (Mirai)", "value": "714537480f4e1e2848250a0589bdd9153ff8b8c380e2e8255db7df53ed431654cf586a3647d713d061e957cfd2d08a34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680510, "uuid": "c41d729f-0cee-4230-9791-c2388a98b0fa", "value": "T1C1D2E1BFEAE079B5C56D487D1DBD27B85F4860C0A3175F8923214DC2A966B0F3A8F060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680510, "uuid": "9b02b688-ab98-4af0-bd65-c90d3ec8b9b6", "value": "768:/Ogi3LnxfjSTWof0fdM3j6ZOSjE0DiA3wWz:GgUz2DeZg0DiAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680510, "uuid": "2a4484d7-7133-43c4-8142-bb641898a280", "value": 30084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680510, "uuid": "c4c5b45e-6ab0-4b80-8ff7-15ce12f6fee9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680510, "uuid": "34a32fc4-fcf5-4a02-bbc3-91de68e1645e", "value": "f7ee8fa74c86969f77a19b013ba570be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae8907d-e855-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626674047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674047, "uuid": "ffd990d3-56c8-42e8-8496-4abe7245e3f6", "comment": "Malware payload (Formbook)", "value": "8044eda768f2e36fe07cbadb249fd8dc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674047, "uuid": "f5a96d3c-6dcf-4edb-8588-1191885749a4", "comment": "Malware payload (Formbook)", "value": "89d9db548b7e9b6224f6b06b9c81ac28237779a5fd89633ac8ffead161a0bc03", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674047, "uuid": "8a68b8d1-2c03-4610-9b5e-211528136981", "comment": "Malware payload (Formbook)", "value": "878ac4f98589f648c466a3096ea0fc43c10f36ac", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674047, "uuid": "88f33a0c-f2db-4768-afbf-0a66dba8f065", "comment": "Malware payload (Formbook)", "value": "2de24b477ee2978b84b8f6200ac753fc40595e1df6993767a70e1759c43b73b5219d3a8fe75b8f9ce8133233f668ed8c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674047, "uuid": "52ada292-8c35-4af5-b59c-c5a748834b0b", "value": "T17AC4334C1EDD4693A7B0B128B3B2677E29A0C8FC71B32B518B975D9F7CE549AD14220C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674047, "uuid": "748bf4be-ffde-4197-99bc-a4f263291bdb", "value": "12288:s/Qtv+IiUWV7YR1otnjVojiK5D+CywSWXtYn2eRcJBsqnD3WQCCuUM7:sv5VszotnZ8iK5lSWX+0BsqDmSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626674047, "uuid": "2127389f-0479-4d29-9245-171be313dea1", "value": 554346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626674047, "uuid": "fef64d59-ba47-4945-b179-0751f1da55f1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674047, "uuid": "310b1b6f-4d90-43a4-bbd7-9b3d6b098a32", "value": "Soa & Invoice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176cf65f-e8a7-11eb-875b-42010a9c0053", "comment": "Malware payload (StormKitty)", "timestamp": 1626708991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708991, "uuid": "8a6daaa3-84ec-4f4c-a512-3f3e926b2507", "comment": "Malware payload (StormKitty)", "value": "ebd4fef9562cfdcb453c83894ef828a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708991, "uuid": "3cbcd017-f1d0-43df-8d8b-feecc2eee3d1", "comment": "Malware payload (StormKitty)", "value": "8a7a54c2c7952b89a9bd9898ee42e52da9aeb17e41a878f2a5236401f3e14efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708991, "uuid": "9fcac939-e90c-4069-9815-ebae7acd0368", "comment": "Malware payload (StormKitty)", "value": "de87ce6d2d71443f35580fd25d41ffbeb23108f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708991, "uuid": "270a46b2-11ee-4611-9bb9-99e12ee2a1dd", "comment": "Malware payload (StormKitty)", "value": "e8516fe9a8cf7721e9897f5b3a795a11a02c0e5915f60e741fa66dd291be6cdb50f9a375513bd7d20f62e4b1fa2802bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708991, "uuid": "1799e164-ef9c-4914-9cb0-feb78b27f3a1", "value": "T10CF4F175722BA308DD7987F91C76D1F267BAA169222DC63C1E84D03CBC7277C1AD0952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708991, "uuid": "6235053b-8596-4a0e-b313-55e3928ef56d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708991, "uuid": "1f5235c9-47b2-4d9d-a6c9-6a35605b7694", "value": "12288:KuPyvUIZbVEyScUA8S3VjES5tQ8F+9mt9yvVvZor9TPHtrqUrD0N:/6vDBEVcU83bu8F+9miM/pqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708991, "uuid": "bd064a82-eb13-47ca-a783-31ad848e535c", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708991, "uuid": "4b14879b-936d-41ee-b6f8-a3949faf13a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708991, "uuid": "eb3700c2-f7aa-4617-bd62-1ffadbc59e7f", "value": "ebd4fef9562cfdcb453c83894ef828a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee706dc-e8d0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626726640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626726640, "uuid": "35c6557c-8910-4475-8486-0779ec35a0b4", "comment": "Malware payload (Loki)", "value": "2dc266f85a95ebf9a875df00be260fc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626726640, "uuid": "b4b5b049-5a12-4a0e-8bac-6d8dff031434", "comment": "Malware payload (Loki)", "value": "8ad5224e6ae6b35e13dd1d79d7d21f3e8e28847c81cd5dd2ce830958bb042102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626726640, "uuid": "1d942f8b-b47e-458e-bc89-efba9e88c190", "comment": "Malware payload (Loki)", "value": "1065494d3c26263dfb0cc7b21a4b2389166de251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626726640, "uuid": "1cc83176-ee39-4516-9191-34ba094c78e7", "comment": "Malware payload (Loki)", "value": "08ebe8f418b84c3e848ae557ae6ff6959b39b9c0962272e5e0ca83123c604cfe66f0f64d80e6109c270ab77785f18fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626726640, "uuid": "11dca2a8-1b06-4ed7-b69a-e36446154d44", "value": "T1FDB3CF9126ED5383C7FC013F4D09DC371941A2B7949FA4A72B58C726A54D0ABB868EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626726640, "uuid": "15521bf2-7554-4b68-8833-21b4aeb43c1e", "value": "8b9c7c9498a635f685c3b4d13969793b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626726640, "uuid": "5e0238d1-a1b1-4696-8e58-a3aef6d6174e", "value": "1536:mfCmKi7KHroSQBqmCu6x26PtLA8DYzfqO+ImHQexP5jEC/Lb4vdz3C/wOJQxtp5+:2F7KvQBhCkIt6D5mHQCgC/Lb4xChC7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626726640, "uuid": "f52e3856-c0be-4c6c-be0c-391af9da221c", "value": 116932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626726640, "uuid": "0619f5db-9d2f-4dcb-b254-f720812f43bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626726640, "uuid": "64065a21-f25d-4bc7-bd8f-75a315139942", "value": "BAOWU STEEL CO., LTD P.O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ed2199-e840-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626664985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664985, "uuid": "4c4f119a-b8bb-4e81-90da-19f870025fe6", "comment": "Malware payload (Mirai)", "value": "8b8bb2c08cb8c07a5b707941039d5b6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664985, "uuid": "1ae223ac-b296-46e5-81e5-fb1eb2f3ab71", "comment": "Malware payload (Mirai)", "value": "8c7d798b25cd0c002241578b87dcefaa71c38c1489459195f247335fdaab6e98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664985, "uuid": "2aecf4f8-175f-432d-95e7-7033e71b58b4", "comment": "Malware payload (Mirai)", "value": "fef7b603020fae3a102dfea79b6aa00174eba086", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664985, "uuid": "ff9f1ba3-1ce8-4c57-8913-9a38a73017fc", "comment": "Malware payload (Mirai)", "value": "d384bbfb534e41d5c4b475923bbb0684ced3a423a0bfa07134c26302230954e21c926facdcdac80bf684b75f59cc2fd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664985, "uuid": "09b40978-9448-481b-81ca-40b50040d8d2", "value": "T10C03F2D2CA31265CCB439BBC117C17D2BE595BC880ABAC9E7AC745C5C9A8331B31A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664985, "uuid": "bd61c10d-d44c-4d6a-aa99-24c49cfbf007", "value": "768:+oZo7UXRQnJnkwEJ/Q41N4HYW6OULg60iRT5yuiv5q50ZpcV:+JIXCg/dNIW0civ5q50ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626664985, "uuid": "98b4f07d-2fe8-467b-b65c-35ac00809369", "value": 38524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626664985, "uuid": "d679677f-0598-4126-917e-38103676d307", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664985, "uuid": "c1ae25c4-9c54-4f61-9d49-503fc9018a21", "value": "8b8bb2c08cb8c07a5b707941039d5b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb7d62e-e8a7-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626709000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709000, "uuid": "fc765d1c-50ce-4c90-a250-05a09df6f4d5", "comment": "Malware payload (ArkeiStealer)", "value": "4b367c52435f4a834d04797267f84240", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709000, "uuid": "3e3fa6af-ab40-4304-a210-b43723070f02", "comment": "Malware payload (ArkeiStealer)", "value": "8cecb6b01aa0456667f940b42f7e394902c7b4da6f7597c5e9ca8a45f7e646d0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709000, "uuid": "6adb03ef-db34-4186-adeb-f9624458c64a", "comment": "Malware payload (ArkeiStealer)", "value": "0cfe62030093baf55769d3d33f024ffdde5417b3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709000, "uuid": "47bff4c6-abaa-4225-a60c-544998c6a81d", "comment": "Malware payload (ArkeiStealer)", "value": "ef3a61dd1899d4f8f04f2da6f2279fdc2fc80c7a968a2ead99f06af2d5f28617ea23fd1071ff757fe407045c1fdab5a2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709000, "uuid": "2030f8e0-dfe2-4263-8834-5c99539e6b32", "value": "T17AB55B1869BFD01960B3FE916EDCA8FBDADE55E3240D743B109153178B22B81DE8B439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709000, "uuid": "9f9f94ae-62c0-43ae-ba72-b262bc04018a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709000, "uuid": "f714776b-4154-470b-b635-795328c08f29", "value": "24576:J+4b9OeGLFvAx4w2rmmu9CLKMQeBtNyITKOnU8YDFb+0YtbRGU2XG83JqQNhVeu8:JWNmAhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709000, "uuid": "595fab50-be19-442e-9bf7-a34bdfe16d3a", "value": 2294784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709000, "uuid": "c5da805a-27b8-4686-a0e3-dd9b9fe3f924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709000, "uuid": "21cd0b64-65ce-4bd8-8a6e-5dc6a54dd79b", "value": "4b367c52435f4a834d04797267f84240.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0433c5-e833-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626659469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659469, "uuid": "71db659f-86aa-477a-976d-852bb1e675fb", "comment": "Malware payload (Mirai)", "value": "dbdd56c8afb803a62f39dc48207e6bf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659469, "uuid": "81f9ff1f-9f82-4ea4-9ac8-da0aee0b8575", "comment": "Malware payload (Mirai)", "value": "8cfd11df019d3b9aa1b25ce74a40afa596bca6acad944902006cae9936321f3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659469, "uuid": "b8c4229f-34fa-4940-a368-9a7d5874efff", "comment": "Malware payload (Mirai)", "value": "d930bc6fbd6f1dd548e7173218b5410a1aed318a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659469, "uuid": "a3d1d19d-c7db-4665-8606-0f75efe4ae3a", "comment": "Malware payload (Mirai)", "value": "64077b8b1cbc234961be73900b273cabaa368aecfe63dff759735abaf1c3a25dfde4b566992b870b838dcfa7528cac42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659469, "uuid": "da05dd68-330e-4f3a-938b-eaa7a022f245", "value": "T12BF2E1A551C7047EE96E6FB06BAB08D86712FD084BFE0586178E398F31FA4E7026055F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659469, "uuid": "56d7a794-fd19-47b6-8478-472ff5e34a4d", "value": "768:03pMJ/7qB8IFwQ9UgOFiGDTN5cHZA/yfJpVkTpG+9cuHZwemFYs:05MJ/48IFwQ9/O0mN5cHZAcJpVipVaqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626659469, "uuid": "15350808-d156-4ef7-95f8-8ae6daa3b55d", "value": 36224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626659469, "uuid": "ec0c3b09-e8fe-460d-8340-e8f58fcec1a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659469, "uuid": "eb7c608c-d924-4998-8485-cff144291570", "value": "dbdd56c8afb803a62f39dc48207e6bf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16889065-e858-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626675059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675059, "uuid": "f8c9db5f-c533-4f8f-b44f-5b1676902eb6", "comment": "Malware payload (Mirai)", "value": "f5fd335259f7508a1261c6df8d19beb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675059, "uuid": "ee806635-14e6-40c5-a388-642b5d6b2ced", "comment": "Malware payload (Mirai)", "value": "8e0e7a7f4e833fd3654962efe050170bc1b2eca2dfa15e8094aa8b2bcacdfb07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675059, "uuid": "dd3163bf-1a90-4ed8-99bc-3d82d4c43c1c", "comment": "Malware payload (Mirai)", "value": "5a7f039a7d8a5918d01dd5f76f6737af6da992aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675059, "uuid": "0d81c879-c244-4062-b478-bf6cf72790d0", "comment": "Malware payload (Mirai)", "value": "25f8cde58aed2ba3a163911283103d9ce58b03210b82de8068b5578e434e577afe915fe91a1b3d5714190a6b4896a329", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675059, "uuid": "a493ea04-d5bf-4932-ae89-2211da2ffdf9", "value": "T1EE732906FD82AF16D4D813BBFE4E028D33536798E3EE7112DD116B11A7CA92B0E67452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675059, "uuid": "018d040f-e229-47df-b369-be0b0e423925", "value": "1536:22nuFa+cwcQVQUJb4i0b+OpVkWIk9kU/5hOll/RibrXurroZwbZn:qQVwcnUJ10b+OpVkWIk9kUDQMrXKMwb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675059, "uuid": "b959108d-606c-42e7-9632-0b413bad7586", "value": 76028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675059, "uuid": "5344cc62-73a9-43bf-9caf-d1f1dab3f51a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675059, "uuid": "fac9db82-0d43-489d-8fa7-af1f54cbf5d1", "value": "f5fd335259f7508a1261c6df8d19beb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e44ece-e8c1-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1626720449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626720449, "uuid": "acbd1137-e090-4da3-a396-6424a66a017c", "comment": "Malware payload (njrat)", "value": "2308cedb77f66e4a821d57e8ee1e08a5", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626720449, "uuid": "bca52dcf-2d45-4a49-921e-a133d8c76ff5", "comment": "Malware payload (njrat)", "value": "8eb3881ba7d320c0760042529414e8ee87b8bfc648c34d87dd36ed854b0c8b7b", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626720449, "uuid": "76189f22-a200-44a8-a36d-f15fa95c9911", "comment": "Malware payload (njrat)", "value": "42ddaf9aef498e366fecdad6b2acbbe9d9d0d47c", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626720449, "uuid": "ca86d442-5198-4e23-b58b-bce3c9a1f518", "comment": "Malware payload (njrat)", "value": "e055d24ae221a13a8f41bb07b443b42ab16e349da38cf3389caff19e0ab95842585967ade1c5471cc131748419284d0f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626720449, "uuid": "047fa069-c0b1-44ea-ab98-585715cecc9c", "value": "T112E48F31F2808837D97219789C5F92E5982DBE212E34794B3AE62F4C5F3D6C239162D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626720449, "uuid": "ef8c1050-eb39-4995-8b53-5c2b09c27b4d", "value": "6f0fecaae0f40ed3ea31df971b69bcca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626720449, "uuid": "080caeab-df25-4c9e-9715-a54a5186e372", "value": "12288:wX2JVHMRtDaSm3TJvVNvWV5YTsY7tHwbz/htfcoCoK632zb7G/QXiU:2ss2Sm39NNv9wY7tHwbzfIoK6MosiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626720449, "uuid": "99535712-c0a1-489a-bfcf-9ef14dbcd726", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626720449, "uuid": "4eae4cb3-9bf6-4e9a-8938-4fa0cc0c4ded", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626720449, "uuid": "0458e9f4-4081-4a23-a139-afab8253b1f1", "value": "6UT0pBxT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5fbacf-e859-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626675551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675551, "uuid": "c03ec4e1-0778-4bd5-9a9a-6f1921141818", "comment": "Malware payload (AgentTesla)", "value": "b4e8493583aaef55a78d6df2ebbe01fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675551, "uuid": "b3c85fa0-fa09-4448-8c4e-8ef442216f9a", "comment": "Malware payload (AgentTesla)", "value": "8fcd181aee4fcb60aa5769acde96e8154ad99c054b10d195163116df1fb3f8e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675551, "uuid": "471ba728-d122-4529-a70c-1bb27aa80ab4", "comment": "Malware payload (AgentTesla)", "value": "b0d0acc850990aa90d304ad13f3b1285c4b501ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675551, "uuid": "db8b40c8-0a3c-44f8-b266-ab73dffaf430", "comment": "Malware payload (AgentTesla)", "value": "75cfe2e8a3f0f32a06b81c71964e71c415deb5692592046ab71a97ada4440fcaec3466df0852efe0bceee626d23da5bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675551, "uuid": "daa11025-85e4-4f22-9154-c90da301a69e", "value": "T15105D0734394095BD2B810F894011601D2FB918BB193EBB63D942AD971F5BABC7E3D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675551, "uuid": "83b71f8e-b2f0-415d-abc1-fec8d7c527ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675551, "uuid": "9b783667-8dce-4cab-944e-9012e948fbab", "value": "24576:kZAbiIBWg8pSrlmT21AOoNihn1I6FyEvlm:kibog8pSrlk21AOoNiV8Clm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675551, "uuid": "0b12bc81-f346-4725-93a1-7632c189fd07", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675551, "uuid": "022320fa-7aa3-427e-a9d5-7d8ab4586a45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675551, "uuid": "54b96c89-ed54-43b5-ac58-d7de72d7ddee", "value": "ORDER PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256a3705-e8c9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626723617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626723617, "uuid": "db8bf3ad-0218-4a91-bc65-0ef7a4f28c70", "comment": "Malware payload", "value": "315c3439a84941a3da05b9b09752dd5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626723617, "uuid": "624694ec-d89c-4369-838d-8970166e4617", "comment": "Malware payload", "value": "91d079d9371fa53227e4bb2207ba4d3aa4733feee607773b696779c5e87846b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626723617, "uuid": "37257faa-665c-46dc-83a8-364a0617b4bf", "comment": "Malware payload", "value": "ef24cc39f3f75c879d819480831541f12273f9f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626723617, "uuid": "7f153f9c-2e01-461e-becc-9a2080580fdb", "comment": "Malware payload", "value": "2fd2fccdec069fe7d4ae3d5c1de7832651c57b3c9de3314b8ca711dc63e0bf023edb36b6b9be839bd4c64a86b058cea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626723617, "uuid": "2afe7a1a-9bc5-4f6b-bb1d-fc82c9970e97", "value": "T1AA947D3341950A57D2BC5179A0011602AAF90143B292FFB23DE168D971F9BBED7F392B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626723617, "uuid": "88a9ad76-504e-4480-aa87-aa0d1284b3f0", "value": "6144:gFLtM1nJIDQx2L2RCo0iRdd21gloXpSFyLbSp13XsfN1/QH5s1mkbK4f4OxoWts4:EOLIyRn0ivdVlCSFlp1383wsmC4VplY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626723617, "uuid": "61f25427-0315-46c6-91c6-b9986d1dbb09", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626723617, "uuid": "08330be7-1ddb-474e-aff2-ffb4af0fcd28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626723617, "uuid": "68f54089-220c-49e2-b629-1d23762f392c", "value": "SecuriteInfo.com.Trojan.Siggen14.43370.11995.20775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7176d7-e8d5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626728783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728783, "uuid": "fe4662fa-b94c-40a2-9a50-483d615ce067", "comment": "Malware payload", "value": "58c4c4cc0980d98055f48d822e3a58f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728783, "uuid": "7e18a7dd-afb5-4dc6-8564-510b6177d9b0", "comment": "Malware payload", "value": "921e1b6936d8a5e61a483701406091c7419ca3c1de2b898fe3d88b5115ef7d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728783, "uuid": "53364d6f-4fe2-4597-ac49-2ad94d4163a7", "comment": "Malware payload", "value": "c7e47db4676de7340c5186ea28a90ee36865c8b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728783, "uuid": "a28abe1f-4da8-45b9-8832-602dd4d35b1f", "comment": "Malware payload", "value": "c0cc6385b5db5647f9d4fa2356ac2e7cd2196d22955ca7489cc018412df3caf4cd70c4d934032fbea8ef79546fa3e025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728783, "uuid": "fcc17f2b-28ae-4602-8afd-fc4c0cd45516", "value": "T10864379627AC6BE5C90EC7F15C70639A8370D847E1CFBB933C88F6B4184A398A5447D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728783, "uuid": "6cf2695f-5b52-4844-b67d-d3d451e55152", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728783, "uuid": "596aee68-cd7c-4e91-a6d2-2b342afd31ea", "value": "6144:AEloJOVLehD3KZyXUJ0DpPYh10zp2BmVLjm:JKkVShTKgXUkpPYh1Yt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626728783, "uuid": "ab7fbe4b-5f18-4240-ac65-f4fa7a9f856a", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626728783, "uuid": "60181bde-8b21-48d7-94d2-e25d0af5e31f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728783, "uuid": "2d974086-729f-41e5-be6e-e6d415f763d5", "value": "Run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3975c985-e8a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626709048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709048, "uuid": "1d007322-a41d-4f00-8d1f-024d55982447", "comment": "Malware payload (Loki)", "value": "cf940aab721563c8e310b535f0e8a2f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709048, "uuid": "4d1a391c-90c1-4bf6-bd4f-00d8c0d2eab8", "comment": "Malware payload (Loki)", "value": "9286cdcb700843eed6b1b68b4d80597ebf079a1adb35cc136f1f807585a4931c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709048, "uuid": "e34083ff-02c8-4135-9898-068b05094a19", "comment": "Malware payload (Loki)", "value": "2a3ccc74a79b067137f133ca475c844363fc239e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709048, "uuid": "ca41832b-ab2b-41e7-8d71-6cde2998241d", "comment": "Malware payload (Loki)", "value": "d7ba5180563e5200709d89912b3906fa433e2a32a2f89e78c56aa1a3fd365a6f647150ddb56c0de1e032bb2f68ee5183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709048, "uuid": "08586362-9476-4918-8b1d-ead0641ee9ea", "value": "T139C3022937D1C4F7C37606701A71692BDFFA9219089086432BD58F96BB97AD20A1F7C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709048, "uuid": "8f4687e2-9de1-417a-a530-e1b05ad463d3", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709048, "uuid": "8e450607-e3c7-4a52-9769-f1153b54c30f", "value": "3072:iBkfJpRXATwMdFCcGbY+Z1UVu2viHUjyrrMiIdFcpALdqaaA0jRGxf:iqjIKY+ZWu2viHIy/QFcpfaaJtGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709048, "uuid": "5b25c5c7-681c-4b6a-8ed4-9a8c2842e501", "value": 127678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709048, "uuid": "20aebdf9-e88e-4d5c-88e0-800351ef1ccf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709048, "uuid": "54b538de-486e-4313-a59b-3059fe11e924", "value": "cf940aab721563c8e310b535f0e8a2f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93aa3032-e88b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626697174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697174, "uuid": "f86306dc-575a-4b34-94fb-2f52fe18f255", "comment": "Malware payload (AgentTesla)", "value": "d4d3c3af1b87b9fdfeb486205786e607", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697174, "uuid": "b9a8bd10-fc9c-4313-8bf4-6b36c549822d", "comment": "Malware payload (AgentTesla)", "value": "93b456fd1d0f8ba152bd8114eaceae28f186c972d4a22a01ebf2740f4771c5a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697174, "uuid": "661a190a-9ef0-411a-b788-8c4a901a90f7", "comment": "Malware payload (AgentTesla)", "value": "ecf486feed4e380c2ba655643849bbe973e80287", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626697174, "uuid": "9841b08e-11be-4792-8655-80daf0c6a0eb", "comment": "Malware payload (AgentTesla)", "value": "b03aeca7cc116c0ab1b305e3f6b8b0330c6cfc0b61e3c50bfd7534e57c8b7ad60354be454fecae898e265ef79b8a4a55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697174, "uuid": "e95bb7e6-a986-4795-a307-67693360e1b2", "value": "T148358D6BE690FF02F13B4B3DDBA62C0807F8A417AB99DD1ABCE553C91053B61641F486", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697174, "uuid": "11c9a639-9c22-44b4-9ec5-e757008a32a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697174, "uuid": "dce2aabd-2f2d-4ec7-9592-a28bf720c206", "value": "12288:vFQlxLKFk5Kxyehckhu0OXy7KDwiqNRKgzpCF+9A4bHHBL9M0hNB2niw:9QmFk5IHvu0OjwiE1pCF+9AoHHxhPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626697174, "uuid": "6f09aaf0-528f-4070-bbd3-bf5f640c074d", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626697174, "uuid": "7e1df744-bd7a-474f-87f8-85e1d6d0ecd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626697174, "uuid": "bbf66c07-a48d-4c65-a49e-a51eeffbeb99", "value": "Payment Advice Note from 05.07.2021 to 608720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb626cd2-e89d-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1626705052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705052, "uuid": "fbc792a4-3737-40ae-8111-535516a9bbe8", "comment": "Malware payload (RemcosRAT)", "value": "2043ca6e23c1e8f2d31f7ab88376ed65", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705052, "uuid": "930f7dfd-0ecd-4b32-93aa-ea4caa1ea231", "comment": "Malware payload (RemcosRAT)", "value": "93f79e179e242b4b2cb0edfc4499597b0ba9ba7f0f8c7126100ff82fc58175d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705052, "uuid": "e34f45a1-0927-45f2-8b73-e88fe794c987", "comment": "Malware payload (RemcosRAT)", "value": "c1d8c76a469e1ee753d1d7f69f59b20ebdb2b1fe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705052, "uuid": "0aeb374e-f4f2-4812-8aef-321e0395aa7b", "comment": "Malware payload (RemcosRAT)", "value": "6ae9ef1b53feec98ffe9205ce2f20f7d4ec65f5e7f01296f19b5473db8d0f7597145b13c3ac4b8cb10c242c4a0da9d58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705052, "uuid": "4460f0e3-227f-493a-b34b-811403f4b229", "value": "T1D773BF01B0A1C0B3C54A95BD144AC7431F6E76905FF298437BBB87DE6B326E1663E30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705052, "uuid": "24312b2c-92ed-4da5-98fd-4cc93cd0d850", "value": "3f397b0f4f0a50e11cf8301d0c2f95c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705052, "uuid": "f768bce6-e31f-4282-9cb0-ffea74febb9a", "value": "1536:dVc726qltnuJtvEAMp6/CQclcmgmtzo8:dua6ktIEP6qWmgmtz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626705052, "uuid": "75d56f0e-22b4-4e01-9a8b-af2b3279083c", "value": 75924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626705052, "uuid": "5d652b7a-5f1a-47af-b93f-fb814cd37909", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705052, "uuid": "deb48c3c-56d0-4280-93de-797e803f4094", "value": "2043CA6E23C1E8F2D31F7AB88376ED65.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c94b2c9-e86d-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1626684304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684304, "uuid": "ad84bbf7-d700-4eb3-b87f-ffc494e537a2", "comment": "Malware payload (TeamBot)", "value": "31b1fe0aacf5fcbced44e89252d1d4b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684304, "uuid": "f9fd41b4-cb9b-4a76-b6eb-75aac69f78d8", "comment": "Malware payload (TeamBot)", "value": "942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684304, "uuid": "75de9bb8-51b1-40ff-8405-71a16921a4d0", "comment": "Malware payload (TeamBot)", "value": "3d56a02e23bbf2f6b3ac86db262391ccd2d06e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684304, "uuid": "ec8869ec-ea2d-4e50-ae25-57bd73f3b93c", "comment": "Malware payload (TeamBot)", "value": "a08bc28f1bbeb90a4dd8bdc7ee64d93c3a8d103a356f90184481d1a835673acfa00a6803211f74e2cdd46d0db041a8cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684304, "uuid": "b01e5c02-c36e-4b25-81f3-353d30838e1c", "value": "T1A1F4125476E0D432E5A7893068F7C2B1A53FBC26383D815B76C876CB5E312D26A6E313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684304, "uuid": "bb5a051d-f0bc-49be-8fc9-ad088c68530d", "value": "b3536084cb50b2be3b69aa695eba88f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684304, "uuid": "3a0a149b-dfe6-4dc9-b051-d401eafb4c4f", "value": "12288:UhR9WptAc/LnqJc0LYBlaql0OxymXkDptSwUlq1Y4I+hHfyc:u9gtAcWfLYbOcep+Uyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626684304, "uuid": "06c81f2b-197c-4548-a3de-ccf8278887b7", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626684304, "uuid": "a4e35d5d-6bfc-4067-9cb1-305dc4e479c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684304, "uuid": "768fe383-8b26-4e99-b28b-13eeaa029ca6", "value": "31b1fe0aacf5fcbced44e89252d1d4b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85809213-e8c0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626719913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719913, "uuid": "82f0a985-d222-4ab3-a13b-fde2edb952b6", "comment": "Malware payload", "value": "be7229e452d543d682d52e05375d13d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719913, "uuid": "80b399a4-4e64-46f6-ba23-b23d11386d97", "comment": "Malware payload", "value": "942b8385a9a95091a31b18a96cfd171bc8bdf01c22656f6b43545ebda2245b30", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719913, "uuid": "58fbc2c8-0bc1-4a5f-b999-e964685dca16", "comment": "Malware payload", "value": "d4e12aaeaea9e77108b7e51173872efd01345665", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719913, "uuid": "4a160ff6-da70-47cf-83b6-3a502dc79127", "comment": "Malware payload", "value": "2394563d7abbe6108aaca9b7958dab0f2427aedbb960339a31577178e50686fe9280961db7b5a409c819f760c41285ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719913, "uuid": "b270cda9-13dc-4a20-ab8d-cab3b10e079c", "value": "T1DB51ED20B6A1DD4AE8409F364C91D7883731BC40AF12E6833686733F5D372C04912072", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719913, "uuid": "8c9bcf9f-d915-414d-8486-cecd9ffa59c7", "value": "6:j1bxc+CF2DqbXbEGR1/CX22qQ0CJcmXI//UA4EHnC10MmyG81Gj:pbaF2uLbEY/iL0b4I/yEHnC10Mt1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626719913, "uuid": "116d3cf7-e8d0-45a5-a48a-72d83c35a900", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626719913, "uuid": "fea13256-9c60-4f18-92fb-08b4b65f8391", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719913, "uuid": "9611ad4c-5feb-4a0b-906a-74127fd52ec4", "value": "SecuriteInfo.com.Exp.CVE-2017-8570.OLE.35938.6707.7801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd6dd25-e89f-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626705938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705938, "uuid": "e84980ed-0272-48b4-91f0-cf173f84a1a5", "comment": "Malware payload (NanoCore)", "value": "dc9a76f0f2368f354038594390f5bacb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705938, "uuid": "9517fd3b-2d08-4f5b-9ebd-bdf383924f6c", "comment": "Malware payload (NanoCore)", "value": "94ee50369cb1aab1d58423c20b64738c3b9a35d6e3fb5da61afdb42426f021c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705938, "uuid": "f547b6fe-c0cf-484d-a0dd-91dd694c3594", "comment": "Malware payload (NanoCore)", "value": "475bd86847d7ae24a134aad8596e8003381f66b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626705938, "uuid": "178259c3-b91a-4206-a95a-d90a1c2ec674", "comment": "Malware payload (NanoCore)", "value": "a135c84f837a176231c4bee943774f3a8c82dbe32f6a6a51eea7eeec940ecb49606ff1130b0c91a7a69378e6b910543e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705938, "uuid": "202efc96-5d63-406d-b6dd-27b819924d8b", "value": "T1B3351201B7C58872E5732C318E39AB61697D7D202F2CCA6E63D0189DE975191A334FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705938, "uuid": "cedcd75b-b08f-4ed7-902d-a0f283121507", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705938, "uuid": "45134413-8b59-4d12-914a-fcd59475a6a4", "value": "24576:BAOcZpJRnwsFHZy0a7d5uwhCt+ZoD9V48yvVUYG4YKG:bMJHZLZwhCQQ9GXVUYG4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626705938, "uuid": "b54d2f90-8c88-4102-abb9-1ef1d9dfd3e9", "value": 1151726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626705938, "uuid": "cfdae114-820d-4f5f-8459-8567a327f91e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626705938, "uuid": "6245bcf8-ec01-4c9f-a8de-87bc11e4f03c", "value": "Doc.202107028.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0599df9b-e8b8-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626716263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716263, "uuid": "c3dca9b3-d8a2-4858-9ee5-fb43ba11b843", "comment": "Malware payload (GuLoader)", "value": "1a23b8c8e5fa52a917c92207a8316b55", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716263, "uuid": "318fff90-582c-4ee0-89a3-156de0e9659f", "comment": "Malware payload (GuLoader)", "value": "9584a27702d6f6fdecc4589a5c87b529ef2c41ca556ddf9325999a4bdb58fcc3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716263, "uuid": "dfb8efd7-8bb0-4b6d-b48d-6ee100dba3cb", "comment": "Malware payload (GuLoader)", "value": "7b481fe511b2132d2d2dc7cad79aa5ebda0d3388", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716263, "uuid": "c4e2a55c-f363-421f-97a5-16bb789572e9", "comment": "Malware payload (GuLoader)", "value": "244f35027fa0e004432ad6ca9be81251d3df1b19c46c6e182786e7f11e38f09e669cc2f4f9db0243a6b399411e2d4589", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716263, "uuid": "d0d89516-8184-43ab-b7cd-d385572c1a1b", "value": "T14D4512345B472B7CE67EC77FC82B872B2815DD594B8BB6139502362D4CB81E4CB9E602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716263, "uuid": "5e31aa43-f067-438e-8421-d02dd57e16a4", "value": "24576:D892LGrd0Hux7uTn/RtxlAncSrS/w90LeFmTg6xexMzv:gc6rVgnw+DLfBRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626716263, "uuid": "6643fac9-e002-4242-ba8f-02ceaad55d99", "value": 1215488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626716263, "uuid": "218ce6a1-0425-4ec7-9e71-d8005e7ee79d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716263, "uuid": "2f80580f-fafa-49e2-a3b1-836f5b39c1b8", "value": "CMA-CGM BOOKING CONFIRMATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d26913b-e840-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626664977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664977, "uuid": "96e81961-633d-4c72-a675-e73ecaf8c135", "comment": "Malware payload (Mirai)", "value": "fd2c59cf17405563bd652aa478af1fa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664977, "uuid": "c0781b35-1b56-4cff-9361-52749809e65c", "comment": "Malware payload (Mirai)", "value": "95be38ed46050439a696922979bdf2d3eff3b611ec3c701f6f107ce06a19f4e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664977, "uuid": "443eb7ba-1b41-4ed7-8d63-e6b9ede23940", "comment": "Malware payload (Mirai)", "value": "50497d39efbec8f8f7e3da52c305e67d0bb7e2a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664977, "uuid": "1cb0b5e7-63ec-4168-be47-afe8a1ed6f49", "comment": "Malware payload (Mirai)", "value": "8bfc874d4f936e9182615940259020571c85f8e590b173b9ccf57527fa01257d78ab73d300b1e6e1fd43650b8445c49f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664977, "uuid": "f4513e8d-79f4-4682-9372-8e914178798c", "value": "T1BD13F131D7752190EE68E3B1D3D9944BFA2B9F60BB6C4D7EB84182842984E97FB040E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664977, "uuid": "032e9293-8478-4e68-bd54-6733f6fb6818", "value": "768:bAhRvSGZqJa3rM1wc3a0f1Om5k/lNt/dZ2UB/0KxDwVfBsOit7OhoZX6GpYbO07K:MhRwg3svOmoNMos5sJt1KrX7FdS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626664977, "uuid": "59ee1708-abac-4b61-a2fb-814784a0066c", "value": 45236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626664977, "uuid": "8683fbd3-fdec-4132-a4a4-7708c46b858f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664977, "uuid": "dd88d278-2235-45a8-960b-26794232b715", "value": "fd2c59cf17405563bd652aa478af1fa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338c75b2-e878-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626688852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688852, "uuid": "dd25c179-ee7e-4d87-97ef-67251694583d", "comment": "Malware payload (DCRat)", "value": "025822f990579ddd47d94b66072d9c70", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688852, "uuid": "dc3d10d7-a425-45e5-a6c3-5fe3be262095", "comment": "Malware payload (DCRat)", "value": "96151faabe100e36e7b72f1db0608fe92e4fabf89fee6567739f10a0e4147933", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688852, "uuid": "854de4d3-0f21-4c01-a87c-24d942c1551c", "comment": "Malware payload (DCRat)", "value": "d0014eaed4264e22867b69a88888b06f8e6b934c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688852, "uuid": "a1274038-79f8-4511-b0ee-5352170eec23", "comment": "Malware payload (DCRat)", "value": "05ddbcca90e1cf9a30808ffbc0d214ddc13e6ed3aa5683d2f84fd8d6bf8e26472494f3d8b014178fffb1e1f6c5b42b6b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688852, "uuid": "8efaf168-4d13-432f-99d1-971c95b1486f", "value": "T19D5539023684DE01D0691637C9EF482847A8FE423B66D71B7E9E339D625B3A75D0E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688852, "uuid": "bfd64f75-80e5-42b9-b734-30569c4ea13a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688852, "uuid": "eae16aab-382b-46a2-89c2-b511e974a770", "value": "24576:++RhHcmbOv3s8w0hckNgj9kmaNeC5jk+2e+4:+shHPX0ikuBkmaNeCJkrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626688852, "uuid": "e50b7781-894b-4920-a597-fc4e9884f517", "value": 1325568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626688852, "uuid": "574d5462-fc9e-4b6a-8c1d-58f4e31f3b00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688852, "uuid": "dbec8173-4e93-4766-bc3f-4e5639061b2d", "value": "025822F990579DDD47D94B66072D9C70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8fcd6d-e8af-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626712625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712625, "uuid": "688148b7-91f4-490d-948f-96bc38440572", "comment": "Malware payload", "value": "688a5cdda1ae1e75e3e84facfecf3fb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712625, "uuid": "fe37c69e-9491-4a51-aa24-8c4470098dcb", "comment": "Malware payload", "value": "96a59a7f3a3aed504052f94d5808bfc4f42054104c955e3fe244f0b0750b48c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712625, "uuid": "9db3aa03-0a64-47b2-8397-08fff251fb54", "comment": "Malware payload", "value": "399f7b93819e186bef159d0ba9118ecc35983f44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712625, "uuid": "7331a24d-0fce-4494-b7d1-0437faec34a5", "comment": "Malware payload", "value": "a9428c04ccce4100b262588937fa48e26f0dfc38274ff87ead9f4a6cf2edbef49561499adac9ef3c30166a9cca4c109b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712625, "uuid": "b2c95ae3-61e5-42bc-868b-98435491ef24", "value": "T10E0512704810ECE5DDAF033C14B71BC9BFB126B3C2848FFA5658525ED997B818A5A8F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712625, "uuid": "6fdff8f5-3657-4f50-8602-8256a172bb05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712625, "uuid": "02d00c72-c071-49fc-aaca-a7fab1b23226", "value": "24576:9+MOQW87bhQxtVUXYUdHu+2zjC3UuTuAn:9+rQQxtVUTdWXcuAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626712625, "uuid": "a074f956-f7ec-4b33-9978-2812ae7dcc40", "value": 873912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626712625, "uuid": "b45281ad-5234-4339-897b-130a6bc725ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712625, "uuid": "785cd4bb-1934-44df-a191-9adaf3ee37d3", "value": "688a5cdda1ae1e75e3e84facfecf3fb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8b49df-e86e-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626684622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684622, "uuid": "d781efea-f1d4-4214-974e-aeab88706f22", "comment": "Malware payload (ArkeiStealer)", "value": "6382174601bf02a6f9b09303d4c7febf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684622, "uuid": "6097ad73-2013-4169-b72b-f4f46aa91d75", "comment": "Malware payload (ArkeiStealer)", "value": "9706247fdb847874ca3fad6229787e37299be25d938af865a8e5b132bf313b89", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684622, "uuid": "3b42deda-0e01-47a6-a8c8-984b35a3d7db", "comment": "Malware payload (ArkeiStealer)", "value": "6af4c812ba7acc3e5a7237f4dfd7e013915aeda7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684622, "uuid": "afd6a2af-bc64-4d72-bb4a-82b33f056345", "comment": "Malware payload (ArkeiStealer)", "value": "7ab8c2a9e291fcc8587023b10a86777621537d9245ef545176bd4a196b210a788be9667851fe6dbff5c6ae0c886ed31a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684622, "uuid": "591fa7b0-7cfc-4951-8973-fa0357d03ac2", "value": "T14EC4F16FB3519D0FC5D82DF5CEDA80B06A669EB02A62DE0139E6378C1E733D0DD4A245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684622, "uuid": "bdfe5c55-2acd-4b9c-b174-5050e7bda85b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684622, "uuid": "3aacab09-0361-4125-8c48-56ea8a7ab7dc", "value": "12288:bcY0acGwhra0Mp01kkC21BW1lGz3I/+lryCzmeBRt6:bsbr+Ht21k1AM4rRBRt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626684622, "uuid": "ff1dc505-4062-4ac8-8be1-a24fef7f7e7c", "value": 564920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626684622, "uuid": "def5d84a-6478-47bb-8895-87a11237c4ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684622, "uuid": "d699b9b3-57c5-4466-bdc4-7c81054e24f3", "value": "6382174601bf02a6f9b09303d4c7febf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d64268-e8bc-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626718226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718226, "uuid": "53610004-3686-4258-bdf3-33aa7e39de24", "comment": "Malware payload (Loki)", "value": "97ee10e7b9b299b04c83d12eaf6dc5f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718226, "uuid": "61e5e167-6c44-4e63-b492-0d492d2a5389", "comment": "Malware payload (Loki)", "value": "972986247ba2743f765f6b6c801c56e91027b75a59ccad3a2e348a736578bd85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718226, "uuid": "20e6a8c8-34de-4d08-a8e7-c6ffdcdde5bd", "comment": "Malware payload (Loki)", "value": "205236f38a6340509afe842b9d7543c0ec160b16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718226, "uuid": "05f10f76-7412-4924-865d-e9657cfb08eb", "comment": "Malware payload (Loki)", "value": "67f73947fc14446948946fbf8c58758b2a3bdedf297806590307b31b5e1a983bfab32856fe369c871c30a0b977cdcaf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718226, "uuid": "94934a09-86d0-48da-81f2-1c3a9daad2a7", "value": "T10024AD2136F0C432E1A759301839D3B46A3FF8626874994F76963B7F5E312C2A6B6347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718226, "uuid": "8bac1f49-b33a-4e4f-906f-05370af394be", "value": "926fdd18e760e98e8782fe7734fd0e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718226, "uuid": "12ce6b19-bdd0-48d1-bb4d-851e6704983f", "value": "3072:+VxAmzdJAiTxzt3n81yr7PtftrLY/mrP5a+3rXqm7X0z:2CaE0xzt3nukPPrLY/mcAX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626718226, "uuid": "d8801156-e795-4060-8daf-6c7462b4c4ab", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626718226, "uuid": "c1ddfad7-8943-4292-a2c2-d9bd5675e4f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718226, "uuid": "63608cb0-8d84-4406-b245-1fa6976ba894", "value": "97ee10e7b9b299b04c83d12eaf6dc5f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcec0f7-e8a8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626709619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709619, "uuid": "d59f06df-7d1c-4e4f-9af9-836c707c6da1", "comment": "Malware payload", "value": "d213177fc3953681cfbe60bb4c9c2ecc", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709619, "uuid": "069f7e86-22eb-45d1-8afc-c152d334ce9d", "comment": "Malware payload", "value": "9759ba661fc02caab0efe817e971cfd2e98ab41c31bfc2de8c735636b9a73aff", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709619, "uuid": "fca13e3b-e52e-4081-8b5e-7763c861fe67", "comment": "Malware payload", "value": "78eebd02a6d9fd2103c3e3147e32c317ab60a96a", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709619, "uuid": "85c4c411-9d5f-40e2-b58f-e6642d87a9d8", "comment": "Malware payload", "value": "db4fd7dfe3cb924beb8a9cea3a6db4e15446f202f3d60caf73b60df5242c2e72d30aa00f7b683335b09ca7fc86c8d472", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709619, "uuid": "1e842843-762a-4db5-8b9d-354c5d537076", "value": "T1F09302B1712B17762F3A649C2418B5B39997524A1F13ACFC71FBB465E3F4848809F88B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709619, "uuid": "8b8c66b1-b2d2-45cd-a82f-4ddbeaf3563f", "value": "1536:CQQcuuOtbQ3uNGdp+NW1Toxuq8vTUDIy3J0CYSfH0D+ukFa3sCb+aRbsFmOE:CQJWbAdp+NWsFcQP511UKlFMr+aRAmOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709619, "uuid": "1d0a27a1-214c-4674-bdee-27bb77a14dc2", "value": 95468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709619, "uuid": "f509be85-032c-4dd8-b403-4de33e48867b", "value": "application/x-lzh-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709619, "uuid": "ee05af80-bc42-4001-8b25-3e4c8bc29821", "value": "PREVENTIVO RICHIESTO (2).lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c98ed4-e8a7-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626709040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709040, "uuid": "a5fc6504-fd4e-44d5-a60b-d46b39d43b79", "comment": "Malware payload (RaccoonStealer)", "value": "a1800675d4525c4002910c56f62f640a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709040, "uuid": "10960fb1-5541-4bf8-ab5b-da2e08d87183", "comment": "Malware payload (RaccoonStealer)", "value": "9767a7bc59eb352854aa19905169dbd0801d99831322b0d899b58085509700ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709040, "uuid": "63aac7d1-f0e0-4d35-88ed-efbc47290d77", "comment": "Malware payload (RaccoonStealer)", "value": "d48ed33038091a4f6cd295bea98a3701dcae2492", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709040, "uuid": "fc5a52f4-ef81-4889-aa48-932acc124fd0", "comment": "Malware payload (RaccoonStealer)", "value": "68a294f59ee05720b98fc4fcae548377f963eb2583b709e94486e7aa5fe10fd5b31a4ff07471ce36fc997c75bbebc202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709040, "uuid": "e4b5e49d-ee58-4bc3-b128-78d859198f98", "value": "T1F1A40210B8A4D831E9B6453195F1C691677FBC266D38898B77843BCE2F7128256BF307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709040, "uuid": "9d54acd5-7c74-4a2f-a0bf-019119291277", "value": "52c37101f2973085af5ed972e3b0d2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709040, "uuid": "a926541b-5874-44a6-a8de-63b29e888b9d", "value": "6144:+cI0sP1MfJjNqYW7NFCDCv55j5UtIU6SJJRiRtca7fy0NrurELyX3Swrlwo:+4UguTj7vJmT8DZW0NrFynX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709040, "uuid": "3a63cdc3-ad04-4ae9-aca2-f38497cdacb1", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709040, "uuid": "490f8237-bef9-4e7a-977e-23a5f6b0974b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709040, "uuid": "7a6c765b-fc6c-454b-b8b3-838d190ca50d", "value": "a1800675d4525c4002910c56f62f640a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8815ee2e-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626708751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708751, "uuid": "b08319d0-e844-40cd-8705-22dd0fe0123b", "comment": "Malware payload (RaccoonStealer)", "value": "f5d8eb69ee76db4c0f2bae0f1a626a41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708751, "uuid": "497a3a36-c3de-46f0-ac75-29fa8a54ea3f", "comment": "Malware payload (RaccoonStealer)", "value": "9b150336d4abc38eb73c89d41777d33ced5bc6cb5c7549b893422d48c4b5bb41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708751, "uuid": "172c5672-1f72-4036-b705-111b41a5effe", "comment": "Malware payload (RaccoonStealer)", "value": "a3aade249a905afa1c6e207cdb7537cbebdc4783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708751, "uuid": "b666af66-e30e-4492-a065-08651d597b9a", "comment": "Malware payload (RaccoonStealer)", "value": "f03a5c9c35e74591f373e06fea4f55311bb570d558e484ee2361ae38f1eca1f0fef2d8f24a7467a7484a5a1877687b83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708751, "uuid": "9180ebce-ea7c-457a-9689-b6196d893776", "value": "T191A4010475E0C072D2A3453149F5D6997B3FBDA26938450B37983BDB2E713C2AABD31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708751, "uuid": "917c8f77-6906-426c-a360-40d09e15e75b", "value": "d0200a61185e5e47748a9fc60359c3ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708751, "uuid": "b41cc226-0902-46ac-a8ba-99f8b21c9ec3", "value": "6144:Lj+w+nG6Ol8cUR1k5eyabwA01R9WhYD/ht74WGK0QndFAIE2dELyXU5mI8o:LaOVu14eytR9WSn4WGFQv3syk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708751, "uuid": "6647c408-912e-4ffd-82fe-3627d914b321", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708751, "uuid": "7ba578f8-9740-4ae9-9277-040db69bb02d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708751, "uuid": "05a75e1d-ee8a-4cdb-8f77-27db2d09ef2d", "value": "f5d8eb69ee76db4c0f2bae0f1a626a41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7699bfde-e86d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626684240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684240, "uuid": "df8d773b-5032-4791-a528-68c8e35a63a8", "comment": "Malware payload (Formbook)", "value": "12c0a846f4c2eec8f6c87a94cc10f305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684240, "uuid": "7e507de5-5161-40fc-a891-1d1ce4e890d6", "comment": "Malware payload (Formbook)", "value": "9b795b925c16454a770214d5ef56ee695a5f562498d4d276cf160fbc13162c15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684240, "uuid": "56857ee5-cd53-4248-822e-c8bda532a830", "comment": "Malware payload (Formbook)", "value": "11ae1be6e6f99d44c29b4f7da562383e66b59193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684240, "uuid": "6b93f88b-1606-4e28-b0b6-9db79a7de7b2", "comment": "Malware payload (Formbook)", "value": "f60369316ca7fd39649910f8c005d50d704ff19b2e4e3f052534c049d170ca4327e23f7d41230eec6f2028687798e079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684240, "uuid": "db60c5c2-2e39-4435-b84b-ab81c7b94664", "value": "T170C4AF63B3E15433D2332D7E4D5B729A9A3ABE1129299C4AABD40D4C5F397C1382B353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684240, "uuid": "21d0e1f0-886a-4aca-b8b4-7bc2b147840f", "value": "28eccc7fd55aad785bc5357b324e2458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684240, "uuid": "b0fe900f-fe11-4e35-a246-7e3ba7df6dfc", "value": "6144:4zhJJJdTd8zUVHiB93U/77wYvmhHG/FAVF4QbUZkKirK70YEJIzu5Fhya1vidxgp:s7JJczUVHYzhH5zKeIir1KdqOeAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626684240, "uuid": "8a03b5be-d803-4393-8fda-369c6e058337", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626684240, "uuid": "6fb6d703-492c-4fa2-afbc-98b3feba5131", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684240, "uuid": "14f892a4-16ad-4795-889c-6238be46b4a8", "value": "12c0a846f4c2eec8f6c87a94cc10f305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59734592-e8b0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626712967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712967, "uuid": "f253497d-6154-4f27-80e0-0709792b3f3b", "comment": "Malware payload", "value": "6d08ccf9d5accae00c06128b4c6dfc82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712967, "uuid": "70bf454a-0bd0-4192-a603-dff135ab9c34", "comment": "Malware payload", "value": "9c0799155861daeef03f1c786e8bf9eb316c402dced50c904ac5f892902b3724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712967, "uuid": "7c449dfe-45cb-438b-999a-335c3049e112", "comment": "Malware payload", "value": "1816d836498ae7b96146ee4b52f539806de3f8bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712967, "uuid": "edf66107-ef50-4112-9af8-976dee1501d1", "comment": "Malware payload", "value": "bad4d7f592dc5330e619c963ed7ecc6d1162f2bb2343427ad4a07ab3c6ce0b06a3025dc8367305f74b4bba3b7dd51bd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712967, "uuid": "99b6063f-488d-4f67-bf14-28a75fce15f2", "value": "T1E0E4BD3800598A63CA72A577C669E714FEF34A9372318D4A539BE6C71F13503688EF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712967, "uuid": "e2721730-4090-4d35-9994-1cfcc679a5db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712967, "uuid": "a4538b21-5f43-419b-a095-a3b8762defff", "value": "12288:tSwMYVDcubVASG48qVrFgadKJksXbujj9xYbHNzlzqJER1FM2uoZaWVN1:tSw1DpSLjqVrFdKuSbkT6HplmJJFCa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626712967, "uuid": "12026f74-5279-4c28-b530-634e0793036e", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626712967, "uuid": "c849fc61-d224-443d-93ea-ca0edcf356d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712967, "uuid": "84bd5a6e-4863-4739-a981-cf23e782c138", "value": "AWB 728590890733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2adcfc-e8a1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626706769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706769, "uuid": "a503086e-44e2-4eb2-b6e8-c0e167208c9d", "comment": "Malware payload", "value": "d6f0dd366ad3cf716f3442c37072a9a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706769, "uuid": "c4bce3fd-942a-40fe-b9aa-ec7453354a18", "comment": "Malware payload", "value": "9c1b8a048c401c6239f1043e409074793801485ad0ea9a35b7a4e308263e2cdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706769, "uuid": "5c7eef9d-e8fb-42fe-9c9a-72ce3cc760d2", "comment": "Malware payload", "value": "1f87840ea496a5059edf2bd8f699509b48127657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706769, "uuid": "4db01a2a-6d17-42d7-92df-476f88fc0e41", "comment": "Malware payload", "value": "5547a391c4986123adf3173fed721541254d07c37aad4ed30762bdac985214f3c8743aee415d81c95e8bfcb6a6bfb911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626706769, "uuid": "46bca606-0918-4033-8152-1c3cca62deb5", "value": "T18004028E976D366AC7609030944678F75A01E9B4D4FF1A63B32109151E8D3D7C28BB7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626706769, "uuid": "de1dd0ba-c87d-4fc5-88ea-527a7587803f", "value": "8b9c7c9498a635f685c3b4d13969793b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626706769, "uuid": "89d0fa28-50ea-45bf-976e-96b90ee78f8d", "value": "3072:twgdq0ahg6ljNkkyGBGRUF9ruliID5q31oL+iUu8U6jMSpN3DkmcOUq5hx:o0au6XdrIiItqloLOu9Sn3HcOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626706769, "uuid": "8084a96a-72d8-45a2-b78e-b5317d32ab72", "value": 175594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626706769, "uuid": "bad838da-4212-4c55-ac22-0e377a7261e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626706769, "uuid": "c414ea98-e75a-4c3a-83f3-519c5bfb1771", "value": "BANGKOK REG. SHIPMENT SUPPLY CIF BANGKOK 19-21 FULL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370c50c8-e855-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626673825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673825, "uuid": "b8d008ea-9a42-45c4-a7d6-17dccad6c7f2", "comment": "Malware payload", "value": "5bea235b7d2424bdd169dad67107438b", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673825, "uuid": "eb740bbc-65b7-4952-ba0c-b0084799ff21", "comment": "Malware payload", "value": "9ef25322ffdc5ba57e1764a1a62e6f094dc9fb50b724f5ec1c51058f2a998399", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673825, "uuid": "34acfae1-b5e8-40ba-b42d-b5642a9c5a5a", "comment": "Malware payload", "value": "2676e07c86c9bc89069e7b02774bbcfa60a7ab95", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673825, "uuid": "57ded6fe-6da7-4acb-9e06-92ab04b0e83f", "comment": "Malware payload", "value": "a43555c073a71e7be2e893ce3892e66dba8f7466eff18e94c74f8b59e0c0ff74383d14d3ff6bcd480cc6e6ddd46436a6", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673825, "uuid": "d248b128-74e9-4a3b-8e15-5e43890f40da", "value": "T194E1AFD6C5EE8D55ED805255FD3C352E2D22077519E27CAF2BA0A253009A283729587A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673825, "uuid": "e138dc23-4fcb-4c4f-b31c-2ee660a99ec2", "value": "192:Kocku+oIIn03mqY9oFieFZkK2G7EMsaHj:Kocv2InUmkF2dCEnyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626673825, "uuid": "4a1cc353-7341-4e64-be06-d0a84b0212de", "value": 7267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626673825, "uuid": "337bc590-9e0a-4ab4-9815-4c8816341234", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673825, "uuid": "7c5bbbdf-e9d7-41fa-862f-d6c2ebd56e8f", "value": "PURCHASE ORDER.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbde0e5f-e8eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626738526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738526, "uuid": "55ba2d2f-afae-481a-a4a5-3744320f4a10", "comment": "Malware payload (Smoke Loader)", "value": "554fc65693d78f2426307ace6a43a77c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738526, "uuid": "a614b9fd-0305-4d23-8c57-9a61467a6904", "comment": "Malware payload (Smoke Loader)", "value": "9f8bc9f4bf9a07d5f14fe30f18a5423be70b6f7c791d42c7e8d2257d2e1bd397", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738526, "uuid": "d46ca1b9-ff8e-454c-a83b-2652b26d7520", "comment": "Malware payload (Smoke Loader)", "value": "fade98f06c67085f031b3c38b0717348b37c6da0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738526, "uuid": "167f7bbd-e45b-4f50-bb67-809f0b8cc79f", "comment": "Malware payload (Smoke Loader)", "value": "2d6a7066e0139cf67c2aaf2458bbce5e3835ed453c7343dd10d4e749e3a93db9a344f9e78680ff866d63162bf17ad129", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738526, "uuid": "40f73aa6-aa6d-4193-92da-bc45e766e3c8", "value": "T1B914BF5079D1D43AE1B6093058F6C2A96A3FBC626D38450B76803BCF5E712D295BEBC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738526, "uuid": "fa4b5b32-fd12-49ca-bfd1-bea8f5fb7ed1", "value": "b0fe27671bb60a5d31189716fdcf7690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738526, "uuid": "7b0208ba-b5e6-4371-b35d-3f2c396d4baf", "value": "3072:7j4vwpmLGwaCsnTzKD+vXLJDwX5mlRsubL1u:4w+GlCwK4LyX5mlRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626738526, "uuid": "39f42a71-df07-48b8-93c6-e49cb63cec8e", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626738526, "uuid": "ebe3cc2c-7660-47f9-93cc-c9fcac8af3f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738526, "uuid": "97bc034d-3b0c-499f-afd1-49487594d3a8", "value": "554fc65693d78f2426307ace6a43a77c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf54f55c-e88a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626696817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696817, "uuid": "13b6cd8d-6906-428c-bc76-df399054aa3e", "comment": "Malware payload (AgentTesla)", "value": "d8e5aa1965cbd11b4031df178d936bcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696817, "uuid": "afe687d2-87ec-43a3-a7de-e820b237f95d", "comment": "Malware payload (AgentTesla)", "value": "9f9e856046471944aacada7e013a457b6a06991b02499af58025b09f6631f5bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696817, "uuid": "f74115d1-1352-49d7-a57d-6c8b6594a756", "comment": "Malware payload (AgentTesla)", "value": "258528980b2e70ab86d1e20553c21380c11cc818", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696817, "uuid": "d9a2793d-735f-4987-99b0-8c4dd73848d7", "comment": "Malware payload (AgentTesla)", "value": "9668c0cb0a0b556c36caa8c588b7fb21ef23b41343e86e69d1c28d7d52988d37322543b01b9d1d26dff154b6258fb9e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696817, "uuid": "a4f265a4-14c6-41f2-ab73-5f0e3e2d2853", "value": "T18E15F1263227A114DC3483F91C29D1B12BFEAC2A566DC7782DC8AD7F7D736785AD0680", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696817, "uuid": "8c26920d-9067-4b10-87c4-cc220427534a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696817, "uuid": "d010f85a-a58d-4331-96e1-bac4f6efe3dd", "value": "24576:QTvDBlBPIOBP32w9icWb3JWeHNvM6HX9QYi:ipPDP32w9ic0pMCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696817, "uuid": "7e045cd4-9598-409e-b082-aeecdca8ed72", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696817, "uuid": "1adb4a7f-5576-4b0f-b86f-6a8db703d68c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696817, "uuid": "44b61b4a-9fd3-47bb-8705-6b4913ef1229", "value": "RSG-EQ20-2785_Scan_Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adef9498-e8d3-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626728141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728141, "uuid": "7c3c995e-41eb-41b9-bd75-7bb6177da855", "comment": "Malware payload (Loki)", "value": "9cf17c7676e742b77610bc40f4b2a504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728141, "uuid": "99e8f924-9447-4ed5-9058-0402187fdc29", "comment": "Malware payload (Loki)", "value": "a03c15ab25900cc50f462093b4abdf262d51099c0feccb4f51fc2c805373cd3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728141, "uuid": "00dac74a-59ed-4fa4-ad9d-51f5b3bdd12b", "comment": "Malware payload (Loki)", "value": "062b4016f56707ddc37d35e88d4fc408d3af7bbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626728141, "uuid": "eaee9913-8cdd-4d2f-87f6-e04b3417e5fe", "comment": "Malware payload (Loki)", "value": "d11661a99288c949da5e096f131294bdde1767b670c1e6665faa7b5e0429445748566d9a6ddb8ab4121ab156b8c032e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728141, "uuid": "db51e21f-21c0-4076-8ca1-a42621e736fc", "value": "T13CC3DF21A62EE30BE6519D39A0086BF3537B7B749D5F8E27CBC7094B4A534C0E4E9D02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728141, "uuid": "d832b66b-e3dc-425a-91b2-84b9cd281081", "value": "f45f4bccd20f0a7ca0fccc38d235a8f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728141, "uuid": "bdda052a-d099-44e7-a068-7faecd6ed3ac", "value": "3072:UYLzArnRhNFLpwPctJrXzTWkZI2n43S8/vgJRR:hLslh/ocfrj1ZRaPIJRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626728141, "uuid": "d135f0f4-d7ea-4c52-87e6-c44b57bb7331", "value": 118754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626728141, "uuid": "ebb6e3f6-8113-4360-a99e-fc0d16ee0d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626728141, "uuid": "2642af35-7efa-4513-90b7-b3327bfd01b4", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036c1bb0-e88b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626696932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696932, "uuid": "8ba59334-971d-4e35-b793-0ec1d72a44e1", "comment": "Malware payload (Formbook)", "value": "41b2324864f8389319f7af2d004d6b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696932, "uuid": "a76f442f-4b42-4798-80cc-e1a83ab1d2ca", "comment": "Malware payload (Formbook)", "value": "a273d1b904ea821a804171f679decc9ab254848d9b68cfa0b6b87886784a0791", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696932, "uuid": "c2aefa79-1cb7-462f-bfbd-b18e1753d85b", "comment": "Malware payload (Formbook)", "value": "e020ba9838ba8778d4871f45ad56d2f455b24781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696932, "uuid": "930e1819-9a8a-4ac8-a3f5-7950dfd9bb66", "comment": "Malware payload (Formbook)", "value": "63016766b67a6f5d91c28e43e8021d28ae968266c9a51c769711e67f1cf09ac376301db84b220ceb502449d2a0ced6e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696932, "uuid": "2cfbc7da-96b6-4edf-862b-1cafb5fafb6b", "value": "T18215F126322BA104DC3887F55C65C1B13BBEAC1A552DC7782EC8AD7F7DB267C9AD0241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696932, "uuid": "08d71da3-08fd-42b1-a2b3-236e2c7125f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696932, "uuid": "b1933b13-6ac8-43ea-a434-0dd96311e987", "value": "12288:HANeyvUIZbVlBPI2VBPXAb8Ts8klg1L+qkV3MhU3QYG7TkVpZAxBauK3Qe:KvDBlBPIOBPXAwTLCiue7T2Yxsu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696932, "uuid": "f4fa03f7-ae36-4b04-b964-ce45cb571cd7", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696932, "uuid": "077437d7-8d80-4d03-8483-f899c8a1d9a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696932, "uuid": "5cb3ea15-e04c-4730-802f-00c532bef5bb", "value": "Payment Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42b93d4-e889-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626696342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696342, "uuid": "0159689f-908f-4f21-9d21-e3581a692774", "comment": "Malware payload", "value": "89d9d419e67b16dea165ae97811fde73", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazi", "colour": "#B7CBD8", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696342, "uuid": "aeba8d9a-0e62-4b39-b268-38239ad4ce50", "comment": "Malware payload", "value": "a2dc6a02a6ceaae77d825507b056a2558eac2a98595105653d5c6e41f52b78d2", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazi", "colour": "#B7CBD8", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696342, "uuid": "18cf09e0-1d3f-45e4-a887-3b57f7f96d3c", "comment": "Malware payload", "value": "82a9541b6622b8d1e103bb6888749b06dbbb2c83", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazi", "colour": "#B7CBD8", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696342, "uuid": "2be142ca-ba05-4dd1-b625-7517d8c1cb7e", "comment": "Malware payload", "value": "c715b70a74ce19472b669a94fc87b6df417ab434ff8f0c57d13e143172c27846cdaa9e7014ed338d1bae8d9e1f6b3e0d", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazi", "colour": "#B7CBD8", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696342, "uuid": "70bd22da-f68b-4b26-bfa4-c352cda0b9c9", "value": "T1620255AAA017B5EE10774929AA350C09E52B5413A92440F0FFD11B5ADF703AB67F3DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696342, "uuid": "0727396a-d6da-46fe-a360-65298f650cf0", "value": "192:I5a3Tuy2X8Mla0XTb2l5M5rs4tXotobx6c1tr9t1K5K0g3NpG0RWUwi2AHwzrJaZ:Iw3TG0g3rG0RWUw7Sd/u+NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696342, "uuid": "4509ba68-45b7-49eb-a1fb-f4734446ba56", "value": 8989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696342, "uuid": "7ee341e4-b5ed-48c2-8ef4-b0dc73c9e532", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696342, "uuid": "6662b5dd-26d2-4958-a16b-42217a46eb25", "value": "stage2.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982af6d8-e8a8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626709637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709637, "uuid": "5b8d842c-e13c-4b57-a7a6-ab3bafb0c389", "comment": "Malware payload", "value": "73bb5c4b690b8d6df88d6bc18fb3a553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709637, "uuid": "1e8ad792-9d34-4278-b4a1-b171475e371f", "comment": "Malware payload", "value": "a3feb5265e6d02710f04ff618e966e9da9ba8fc8dc5692d6f7633fe0a3037b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709637, "uuid": "bc7f42cc-51af-4e0b-9736-43d6310b852a", "comment": "Malware payload", "value": "60adddd91b6038fc9d819cf6d647ce3be0b11d38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709637, "uuid": "d4554b0a-9d7f-449d-976f-4721fe1c4553", "comment": "Malware payload", "value": "6a0575cce830904e63ee708fe854e4866d0299a660df05d38a20d6f9e0117bc95f59c45e07925d2a09159c682b26657e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709637, "uuid": "8623489e-5dd9-4360-8845-0a38de9acf6f", "value": "T12634E61E7A45F815F896C8B7301AE12FA2123C7752455E1BB21C7B70D4332B6A87BEC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709637, "uuid": "19e8e706-97f4-42f6-8e59-e5e7505525ca", "value": "e9f7dd0da1a2a1266893e1ae4ef42b67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709637, "uuid": "c070c34d-2915-4aa7-9464-5a8f9a3870e5", "value": "3072:+3BepJlZa/xao5JKwI7V4R4iUW/qcijw2HJlZapGBR:EiUIo5JKPgU99vHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709637, "uuid": "ec434f04-fed1-435d-9134-7dbb8361b510", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709637, "uuid": "e58118be-52e0-4619-b8d2-78eaf7695bfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709637, "uuid": "92321c63-57bf-4456-8e84-56f1ee2d7286", "value": "RICHIESTA DI OFFERTA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef52fb55-e8eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626738559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738559, "uuid": "ed136e7a-a683-48c6-9ad8-c48fdf7b4f2b", "comment": "Malware payload (Mirai)", "value": "03d4fa8e4de5b8714aa355f60cf88e0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738559, "uuid": "3c7bb9d0-0fc8-4476-a8fa-89754d4ee6e5", "comment": "Malware payload (Mirai)", "value": "aa9b35234727bb02f98c7cf91e093a2eb9d6915f821d1d525d99f22b1ad1b650", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738559, "uuid": "c83c4a65-4136-4cda-a28f-25e4a55d996a", "comment": "Malware payload (Mirai)", "value": "a690ece6c0a22c4ff34532d531200ee6abda5767", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738559, "uuid": "c7d743bd-802a-4fae-afd7-5db9e5adf2ee", "comment": "Malware payload (Mirai)", "value": "b5c7acbe8c74d5557312452a4fef8e3415ef44907bce6074cf6c4b3596170065397a3f70ec1f95551e9ae80ad861aff1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738559, "uuid": "f88815e3-5066-45c8-b054-82caf31ff6c2", "value": "T15A232996BD91CF02C9D4A277BA1E029D3B166398E2EF33039D156F61738782E0E77146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738559, "uuid": "a6e8dae8-6fac-490d-a2c9-886859ac12b9", "value": "768:wF/gizitgCz6L9/8QZvqPQm2BWECG9RPyWKn3Qp7BNOrGnDNSP51vio:K4izWgDNZa52Bbijh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626738559, "uuid": "2fc26d50-9e47-438c-8454-c014c7c8a9a9", "value": 46480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626738559, "uuid": "3b339aa9-3e77-442f-9c67-68bb72a41b5c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738559, "uuid": "0418b2ff-d8b0-4f14-ac61-4e126486acd0", "value": "03d4fa8e4de5b8714aa355f60cf88e0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89eb0e6-e8c7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626723032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626723032, "uuid": "e6664bd4-84fc-4b10-914c-72885b741797", "comment": "Malware payload (Loki)", "value": "844e3bde81bd6d7da22b8d37edbbead9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626723032, "uuid": "a9cd1e73-8b1f-4268-872c-f4e1645a9928", "comment": "Malware payload (Loki)", "value": "ab58dcfff4c29d6f6f4d6088c46007a8aba87bb950aedda3a6a5bb0c9d688cc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626723032, "uuid": "91e0b993-c0f9-4fe8-92d0-d0538000daf2", "comment": "Malware payload (Loki)", "value": "9c3562872300dc74c1cb0c3afcb4cd5c85bb6608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626723032, "uuid": "488b19ca-01d1-4663-b119-339785d3b08c", "comment": "Malware payload (Loki)", "value": "1b42717b6a04b501c490c41f898e27f36e176eb9cb19ab9e0ddf3804f98a095c073fc6d149c55e6f6e4e393a1d64ad97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626723032, "uuid": "700b8a45-e86b-439d-937a-2f146a7576cc", "value": "T1D505E1223227A114DC3887F55C25D2B12BBEAC2A566DC3792EC8BD7F7DB267C5AD0140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626723032, "uuid": "b8d76c23-90f2-468a-8856-3eded2c10cc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626723032, "uuid": "42c3f0b8-fc33-40be-a4af-2dba04dd9965", "value": "12288:UvOyvUIZbVlBPI2VBPeLcW6se0RUkODL2Hu/Qr:UvDBlBPIOBPQ6l8CCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626723032, "uuid": "374e66cd-f8f6-4340-beca-b1d18d6f7c18", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626723032, "uuid": "8a31dfad-7ac6-4342-a326-56ea38740be4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626723032, "uuid": "5ad722bd-4a1b-44fd-9e9b-f6f7ed8b9470", "value": "PO210719.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21429a7-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626708928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708928, "uuid": "d11a66e0-5fa1-4728-8288-5410b687ca7c", "comment": "Malware payload (RedLineStealer)", "value": "01f11becd5171d04262e3e3d5545ea63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708928, "uuid": "c6e55fd0-1918-4abe-b912-f55748b806e8", "comment": "Malware payload (RedLineStealer)", "value": "ab8c569869fe2fbb65e917a16d9294281bb0d092856a3f114ff1ee4750f599e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708928, "uuid": "b444d13a-d692-422e-bb1f-192c90b60b49", "comment": "Malware payload (RedLineStealer)", "value": "0578d7f0ccba7de5d3c2d377a9ce8a60c3374b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708928, "uuid": "8c12b3f7-5fd1-42a4-bc65-e0d04a96fff9", "comment": "Malware payload (RedLineStealer)", "value": "1002c7d562ebba5dbb7863f739245cd1aa4e99bd56ee533d6026b7304805cad1716ff5ffce2880ab60ba43a1ce2ae805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708928, "uuid": "2b55057f-0dc2-4cdb-9f4e-197efe1b3bda", "value": "T13CC4121074E1CA22E6E2923554F6C6E16A3FFC262969598B33F036DF2F705D2693D312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708928, "uuid": "a05afb0e-845e-47b8-b9d6-f53cb8e64e76", "value": "52c37101f2973085af5ed972e3b0d2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708928, "uuid": "0b0050cf-0244-4e3d-a71a-902925bf91ba", "value": "12288:babr0tmo0vfl+QIhiXTujWjsHEYRxn/JHDttKl+4cfyeVP:b8wtzWYQfTujCYDn/JHvfycP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708928, "uuid": "fa245f83-35c3-4581-ae42-70ead296ee4a", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708928, "uuid": "e10a8161-b5c3-4ac5-9bc5-3f41fb724174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708928, "uuid": "9e3e9b03-67f0-4421-8ca2-bb6b99584cbc", "value": "01f11becd5171d04262e3e3d5545ea63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4337f0b-e828-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626654788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626654788, "uuid": "990107b4-98e8-40b2-8e05-3a72cc48c518", "comment": "Malware payload (Formbook)", "value": "e8e77ca9cec0090a6266b90755bfa07e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626654788, "uuid": "298e10f1-1eba-4cbc-8d0a-addd3683bd52", "comment": "Malware payload (Formbook)", "value": "ab96b6ac9080fe40003b5259931da0e8fae1d5e57d602991d8bb06fa712bdd9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626654788, "uuid": "d135c691-27e0-4d6c-8c55-66ebea725947", "comment": "Malware payload (Formbook)", "value": "d1521b1cbf2f4e596512d2ff566cf6d6b0c31e97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626654788, "uuid": "7a975f6d-e74f-4c69-99b0-40112aff7148", "comment": "Malware payload (Formbook)", "value": "10d03142ff35ccc95a309cadb9e1533cf192e5a1ca852dacbbeaa126454047a2571afb763595ce58d27a80070399f564", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626654788, "uuid": "ab17bb18-51c1-488c-96be-410e508ac68d", "value": "T1FFF4CF7343900F5BD3B810B4D001130296F9869AB1A3EBB67D9428E671F5BE9D7F352A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626654788, "uuid": "d54b55d7-ba52-425a-a87f-5a353d2d5209", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626654788, "uuid": "9998763d-1459-4e4b-b10e-0bafe9c3dac0", "value": "12288:IcZKfPR0ihXfjMVGxH4LE1Oj9pIKLqI3BI6DiaXfBxMVOYfFiqlgWQ/VB:nKfuihvjb4ykICxIwiavBx+VfvlnuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626654788, "uuid": "cc0ff5b7-c62a-4d85-b9c8-7ab7f32d9fbe", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626654788, "uuid": "b90a36ee-ba7d-4de2-9b63-876d1a6f32c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626654788, "uuid": "f6b867ef-140f-47da-89f7-e9a0b6face4c", "value": "e8e77ca9cec0090a6266b90755bfa07e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643a48ce-e859-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626675619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675619, "uuid": "0302ed39-99e3-4fac-b73c-de1a9c774345", "comment": "Malware payload (Formbook)", "value": "6983d9ebc21560ebe2d562d42cf43398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675619, "uuid": "08268312-5eb1-4388-882e-d315ee6a9e40", "comment": "Malware payload (Formbook)", "value": "abb3fcb252b5c9e7aa022a3f16409b3f4b6dee5db0fe553b0cdda5ecc30eefad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675619, "uuid": "60f47203-6f7d-43b8-ba46-cc4c76a281f8", "comment": "Malware payload (Formbook)", "value": "a5bfbef9a05bc24815637eaebcd958d81071d883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675619, "uuid": "7f6faad0-223d-4c16-9206-9fbb4dd31066", "comment": "Malware payload (Formbook)", "value": "b072fbaca0133248d0c19979810f31d2fac42441d0ae1236c3c3290243fcbc71a3aaac54a524cf9bd1547aa993cb6911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675619, "uuid": "a9d52d9c-df5c-40bc-b53e-c9aa2a2019c1", "value": "T1E0D4F1353318BBEED13AD77A94145D2467E0E123D327E21BFC6710EA5989EC28F62193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675619, "uuid": "d9938434-1206-4e4a-b4eb-4f8f90bde169", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675619, "uuid": "b41f6462-a528-4eb0-bc59-42c7c8a49151", "value": "12288:LOSV58SRQLAfKau1d6i5fWYaCQU3iIRZoVqsi0S+3Ukh7LpPLdaMyVXKp4EmKoY:LOSVmSOLAov6mW7CQU3iIRZoVqe3nB0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675619, "uuid": "e1b4a278-c19f-4169-ba3e-efc1372a55ad", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675619, "uuid": "8782d93d-b222-48f0-8fef-9d8d1a916c49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675619, "uuid": "ab87184f-d0a2-4fe1-8256-4f54553d0d1b", "value": "ISF DETAILS pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34095efa-e87a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626689712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689712, "uuid": "d5c98be5-2090-4da1-a35e-154b4e159a9b", "comment": "Malware payload (Mirai)", "value": "7f5adcea847342227a9912867d3700be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689712, "uuid": "14d59c09-a46e-4791-a333-9581bb184af8", "comment": "Malware payload (Mirai)", "value": "ac4aaeca9a14860e12c26bac1987088bdb802f49d82140efe7da2965898bd2bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689712, "uuid": "c000afd7-1df0-467a-9fd6-f066570ed613", "comment": "Malware payload (Mirai)", "value": "ad270f968233dcdfc74a7e4707518d39f99c4954", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689712, "uuid": "85419e17-59c3-4723-9fdd-7650900c2f4b", "comment": "Malware payload (Mirai)", "value": "5ae20e545e56551e473b64b7e8b39bdc7adb2a5c66cc24333ae2d3ba8435a1cdb6350c2750d890b597f78c54e8748311", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689712, "uuid": "248d1f29-f2c0-4df6-85a8-4adeda83d33e", "value": "T172330648E607D1F5DD474D70A05BF97FE7309A22E530EDAAEF85B902EE33A126006719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689712, "uuid": "dfcf1757-739a-4b0d-9d0c-093bd8322e15", "value": "768:jWECYQPUlpCNgPIaJECR6GbyEBQVwPe900dKxzsaXA2v11W/5BQA7i:adsl5PIiR6mvBtPe60dKFM8WRBQA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626689712, "uuid": "b93eaf38-db7c-4941-8665-f4eec02d5855", "value": 51004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626689712, "uuid": "c224a9b9-245e-43cc-9a14-6530a85def4f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689712, "uuid": "3e59ee6c-54be-4376-8510-9b1ebabac937", "value": "7f5adcea847342227a9912867d3700be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75736375-e85a-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1626676078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626676078, "uuid": "b177f1ee-65b5-4e68-ae49-ae51f51ac585", "comment": "Malware payload (ServHelper)", "value": "c8284ad28e4f8bd853604543884a9438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626676078, "uuid": "5c59de55-6670-4865-89a1-b6377363c628", "comment": "Malware payload (ServHelper)", "value": "ac5df971e605c439d1851391f51ae799b24823c47aea5c0ac177f00e5d4cc1f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626676078, "uuid": "bd487ad0-9782-4cc6-9a25-ae2bad26f444", "comment": "Malware payload (ServHelper)", "value": "3d48649f085710bc3a086e53e2e9fb9b435e34cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626676078, "uuid": "5094d40c-97b2-4fdb-a0f9-4b3f70100ae5", "comment": "Malware payload (ServHelper)", "value": "c1411dea1172feb1fc262350dab91e20604e3f89283ea11152a321e6627615f032665435fbd950d96dbd8fec9d3b43ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626676078, "uuid": "f89043cf-00a9-468e-8cb5-98bd2fb7b21e", "value": "T1FE7633517A406D23C458F7328AD6E97C17BEAFDB680B594EF398EE0D91202A5131F3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626676078, "uuid": "f841e6da-1402-4030-9dcc-078caa74e4bb", "value": "a011f8d93026fd9f5e9442faeeff606d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626676078, "uuid": "fb9a6c49-66dd-49cc-81a1-153f2dcc86ec", "value": "98304:xxz/xkgybMmnx/ixxdp4cDicJqs6ale2d9yp6jkLZe6POma31Q63pYdLNTiSScDh:xxBe/VKicBeZKK433yLNT5VvtDG6Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626676078, "uuid": "cd6415d9-d9f8-4024-93b6-79f23cff6e49", "value": 7435556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626676078, "uuid": "de73e3f1-4b8e-4692-9f0d-5c9a236af9d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626676078, "uuid": "e09371af-4ba9-4b1b-929d-33b6e4c156a4", "value": "c8284ad28e4f8bd853604543884a9438.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c966d59-e86d-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626684143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684143, "uuid": "842b2af9-38da-4fe2-9b05-08d5d186fa8b", "comment": "Malware payload (SnakeKeylogger)", "value": "773d9534f88183b2e01b88f663141a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684143, "uuid": "30385c31-871b-4ff6-a890-ee72b66322d4", "comment": "Malware payload (SnakeKeylogger)", "value": "ad060fffb69419f682cc68d3aa4034b04466c11228bd7e93b6c43755e0a237e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684143, "uuid": "b558cacd-957c-429c-aeb4-fa5bf5eea456", "comment": "Malware payload (SnakeKeylogger)", "value": "27ff5aa443d7f4a7dd573fc57dc46414096609b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684143, "uuid": "d6469056-5c4e-4442-9d3d-6da6a79ac6d4", "comment": "Malware payload (SnakeKeylogger)", "value": "1401c9dc25bc5ca73037351858989c688b48d66e6559dad7ebec04af61f63c841ae8a70fabde549e7a95c87c5f78e6db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684143, "uuid": "7addfc4e-3205-499d-b5cc-ebab21dc94cb", "value": "T1ECB4392439EB502AB173EFAA8BE875DADA6FB7333B07645D105103864723A41DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684143, "uuid": "0db08932-dd93-443b-8648-10b9266416a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684143, "uuid": "bc4ab916-9d6a-49d2-8c3a-e33cbbb2daeb", "value": "12288:kJbxpEsxL1/BzK3dNUdbi162OGfEHkN4qZMkjAEoSQ8P4W2Xo:kJbRBo3dBZf3RT4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626684143, "uuid": "334094ac-a21f-4764-9aa2-fbb2dce1dd9a", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626684143, "uuid": "0509783f-51cf-4be3-b215-196458992ba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684143, "uuid": "285318b7-5436-414d-ad5c-47dec479d7e2", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.20210.30401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268c8b08-e84a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626669073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626669073, "uuid": "a2a6be35-cbc5-465e-9e23-bb22f49fb225", "comment": "Malware payload (RedLineStealer)", "value": "ddcd2be64212b10c3cf84496a879b098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626669073, "uuid": "a11a2852-b4b5-4509-ab98-d4424b08b4b0", "comment": "Malware payload (RedLineStealer)", "value": "b013074d220d71877112b61e16927abbbb98ad29aa40609aca1b936332fbe4b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626669073, "uuid": "7f3157c3-4c5a-4f7b-a480-b67bfd54519d", "comment": "Malware payload (RedLineStealer)", "value": "08e50a11be5d12fb97bff058ee94fe59423058c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626669073, "uuid": "b532356e-dfa5-4c04-b04f-951d61859e45", "comment": "Malware payload (RedLineStealer)", "value": "6866674442f25c3a9465ab09e03d62c075e06f388a9a33943dd7a5dca49a66bf5a9f6853aeb0c8b5bb31ca9ff3887d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626669073, "uuid": "6d9eb084-bfc6-4114-b768-8f1efc1f7b3f", "value": "T1BF6733BFC7A4C7A5C68C1C36C90540AC22B98E74F9036C71CEC6F969ACE7597C12958B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626669073, "uuid": "8e4448a4-16e0-4038-b473-f8481a2734af", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626669073, "uuid": "f4d719c8-0669-4088-95c5-ee2a5d24e26e", "value": "786432:x9HKNjaPzZVloeX2uwSvi6OPel+3D2DuVeWwXheEQZK1P/zD:x4NoLlT3wSabelAD2DuV+y4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626669073, "uuid": "13805d10-9d7f-427f-8c09-01e6cdd49369", "value": 30327679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626669073, "uuid": "ae26d7c8-2fd4-49ce-bd14-3e49b7f356db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626669073, "uuid": "64c40933-feda-4b3a-ad20-2155f61c2d52", "value": "DDCD2BE64212B10C3CF84496A879B098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707aa168-e834-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626659748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659748, "uuid": "413d9d81-d1cd-42d2-a6db-2f75545285eb", "comment": "Malware payload (Gafgyt)", "value": "7603e595e0d751616e3d873d83911038", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659748, "uuid": "68de7f54-5d6b-4ff2-80f1-d0ba58fca0bc", "comment": "Malware payload (Gafgyt)", "value": "b05f4bd913488e60ddda4c34a5babf40d4cf2c66e96818e3bc3aaa239fb746fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659748, "uuid": "fc6df075-ee10-4dfd-947c-382643c15987", "comment": "Malware payload (Gafgyt)", "value": "33dc083d80e8028dfb2d4443466c7c82264c8ffa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659748, "uuid": "9cd670b6-d2d2-4979-8813-ffe8945949a4", "comment": "Malware payload (Gafgyt)", "value": "f613decbffc8a891c6daa5c3d4bd02090e0c28ec8fe8a62557f668083f26fdb6239511cba7c520b1708e87c88f612426", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659748, "uuid": "91017f7e-0114-4267-ae53-f6e1bc32be20", "value": "T1D5A3F831A641D973D04305F212A7DF260D32FDBB1A6A9E5AE3293CB0DE360C5B561E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659748, "uuid": "f3e011d2-a42b-4e57-ba48-b24689113b0a", "value": "3072:gV8d1tU5jHZgVQGDglm2lt8HqmmFVcqq0GnDZT:gV+gzyZz2lt8HqmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626659748, "uuid": "8170e65a-1253-4d8a-a7ef-ee9629cb2aba", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626659748, "uuid": "05e5b55c-f874-4eb6-bea6-fe45ec4bcb3c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659748, "uuid": "ac3296f9-333d-40dd-8057-7d58dcdab686", "value": "7603e595e0d751616e3d873d83911038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af216bcd-e879-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626689489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689489, "uuid": "d8cbcf90-7f69-40f9-b3ed-fee36f9831e3", "comment": "Malware payload (Mirai)", "value": "c98373ed6f646ad0a0904c3cda236703", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689489, "uuid": "c58e66d7-45f4-481c-9764-821934aa9925", "comment": "Malware payload (Mirai)", "value": "b06769b93042fbd6875593ee76285db923c8cd7ab547c44d2edcd744b39482b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689489, "uuid": "94ca1952-bcd1-4292-b97f-f87018b3f30a", "comment": "Malware payload (Mirai)", "value": "5689e2b2428257b2c91115d23af9d75e19c104a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689489, "uuid": "c49e8d6e-2713-46e0-b496-f92eeebe31a3", "comment": "Malware payload (Mirai)", "value": "f3c12ac65c370944e01674f07e2926c0c4b9431ac84757b0845e42c5ee53ba7251cf23b5855bb9fede07abadf2414e4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689489, "uuid": "077a2901-5f8a-48b8-aefd-2b5566192045", "value": "T16853744CAFA14EFBE8ABDC3745E9174628CD952622B83FB5B934D428F20A14F15D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689489, "uuid": "d0302325-07fc-4f09-91db-710c42cc80ad", "value": "1536:HeNJV0+8i5qWn3KaztX/AK462jjJ8dOqxD05ZQe+c/:+NJoiAoVeY05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626689489, "uuid": "541524b2-2cc3-4396-acb1-edd1b54aab3a", "value": 63932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626689489, "uuid": "29b2a131-5fdb-45a6-88f8-05b553c84ae3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689489, "uuid": "a72f171c-f1e3-4c6c-8fae-54e155739f4a", "value": "c98373ed6f646ad0a0904c3cda236703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3f7c77-e87b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626690267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690267, "uuid": "61078cc5-9515-4798-acc9-c2a855a5f73c", "comment": "Malware payload (RedLineStealer)", "value": "0adb0e2ac8aa969fb088ee95c4a91536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690267, "uuid": "bb7cbba1-c52e-42b3-bb65-6849efc63667", "comment": "Malware payload (RedLineStealer)", "value": "b06a04969f5856d665a1e837f7aed8b1adfca9e44d06e7d5100b8c3adac4df79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690267, "uuid": "e7223844-03ed-4248-aea6-be0ed2c3c898", "comment": "Malware payload (RedLineStealer)", "value": "8fec87a06466239426a6da7aa90eaadb27e1e400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690267, "uuid": "6409a7fc-4865-4afc-a8a4-59b128057254", "comment": "Malware payload (RedLineStealer)", "value": "589e172ceaa93f8e514cb7cc67c7bea69823fa34e10216f6380640b6d7f803d46be5b9f64434e5122e22b5d685031a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690267, "uuid": "07e5ab6c-eca0-484a-9dfe-b4117f205109", "value": "T1CB64AD1E73E6AE02C9588A358AD3D13613B3DE4A2137C3072EC17E5B3E763D95D452A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690267, "uuid": "58d1b819-877f-4b1d-ba92-4ed6d02bc0a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690267, "uuid": "6f9c8c31-6823-4b84-96e9-b6713377ba51", "value": "6144:5rwSOSu/CmfQnbol39kCUBDyTic+fZuWOuSzY:izD/Cmybobk5BeTic+BuWOuSzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626690267, "uuid": "b86abb2b-6926-4500-8834-91599d3ee00b", "value": 327816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626690267, "uuid": "b4bf9626-ad3c-4c2f-bdf7-af0fa5176c77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690267, "uuid": "98a81a19-9845-4b35-ab01-ef3f2d839ff6", "value": "Minecraft_v4.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f29d71-e840-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626664970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664970, "uuid": "217619d9-df6d-404a-b618-5adee7e258af", "comment": "Malware payload (Mirai)", "value": "417b83574da88fa817667f7faf8ab6c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664970, "uuid": "655114b1-dcbd-46e1-b614-6f78d1a77e16", "comment": "Malware payload (Mirai)", "value": "b1aa2c4b8aea86d296fb53aa4526c3e3d132f6a80b21334e5253fcdcc473a452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664970, "uuid": "f4f832a4-9146-483c-ac0e-6ffdeec49a11", "comment": "Malware payload (Mirai)", "value": "5cfa6051af43ed6762f6e8b7f4497b355b82b9e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626664970, "uuid": "8c15ed27-ee43-4bf1-9d37-fd56709fdabf", "comment": "Malware payload (Mirai)", "value": "80d35fc30fef679a927c713cdf6ca46f60b20b206d246b386e188edacf55127c1b22104f90da6aab80640ad3bb2ec6f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664970, "uuid": "03c6af71-faa4-46fb-aa09-049374d91e8f", "value": "T14913014C6756A19CF0872FB8336B25E36C51E81A1647EA8B044476B33EFDEC19704E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664970, "uuid": "5554bb61-986a-45cd-9db5-8627a6c7dadf", "value": "768:9/XDTtWBoA9XRAq7PwsA2Lu90njFsw9274RzzVdZHPYUZAo6Q:9//saAAq7C2w0nJHu4RzzVdhD2o6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626664970, "uuid": "4cbb8de9-6a3d-491f-97a1-760b2033ea02", "value": 42392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626664970, "uuid": "0a957236-bace-4ba8-87e9-816ef8d18527", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626664970, "uuid": "7b4c2a93-2c80-4ed1-96d0-7f4abea40b6e", "value": "417b83574da88fa817667f7faf8ab6c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da93172-e8a7-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626709028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709028, "uuid": "4d321f2c-d0c2-47ca-9544-9b8024fdb6cc", "comment": "Malware payload (RaccoonStealer)", "value": "146db5fd6c82cec465194d99eae2e539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709028, "uuid": "b3d927fe-69f8-42ba-aba3-582617e84f2d", "comment": "Malware payload (RaccoonStealer)", "value": "b1ba2d7a4b78729cf332357c9d5e5e63b51796bc107fff6a45dd6149a3760365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709028, "uuid": "45b63712-4b3d-4c2a-8588-4bf395f1c311", "comment": "Malware payload (RaccoonStealer)", "value": "0c000a40a487e54750064897f6424bb0297a156b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709028, "uuid": "873d5825-3dd1-4560-b12c-925980900c5e", "comment": "Malware payload (RaccoonStealer)", "value": "b828d203e7e6c5481ac85e5fb9e432484829a7e2394ee05616245764cda89145da9f1b8648711190a1bda5b6183aaadc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709028, "uuid": "b525d95f-a2d1-4cf4-8ca8-258464b97235", "value": "T15FA4F160B9D6C532DAF60532ADF9C2A06A3FBC962D29454B37C43ECF1A713C151AE316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709028, "uuid": "d5be88ff-2dd3-4cff-bfca-c1f447f1d5b0", "value": "52c37101f2973085af5ed972e3b0d2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709028, "uuid": "4f7bdebc-f8af-44ff-a7fc-f48eb38eb1ab", "value": "12288:JiQtFHFFpIdVZG0E5jEMEQhFKLnxu7uyI:JiQflFpI9aE2KzxKuyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709028, "uuid": "48d5d33e-3803-4061-8739-60bcfb8c4364", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709028, "uuid": "0a47dd01-38c3-4846-b335-2d263fdc9bf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709028, "uuid": "d8f959fc-3e80-45f5-ab95-d0a69eb65c00", "value": "146db5fd6c82cec465194d99eae2e539.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a829e2ed-e824-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1626652970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652970, "uuid": "1ff651f8-1b6d-4539-b512-120b553ce68b", "comment": "Malware payload (CoinMiner.XMRig)", "value": "18d05e20731583a22b495d0d1f107c5b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652970, "uuid": "2298573b-e8d1-48e4-b3cb-c71ba09d0fb5", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b1c5fd5c0f6a2760eb638414d9bf9b7536b81f45edbd9d509dd085346c67a6ae", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652970, "uuid": "8bc1bcc0-a919-49a5-92a8-b1f6261c32b8", "comment": "Malware payload (CoinMiner.XMRig)", "value": "2ced0e3577063ca3613b43661e7df5bc1411ab09", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652970, "uuid": "20e271c0-0f32-4e39-8db4-5bb30b8e3ea8", "comment": "Malware payload (CoinMiner.XMRig)", "value": "5faaf63282ad9c22e1b500e921ec035ac05bd269c71a25734bf640d4b5de24adf36bf445565a40d5eda249360b6becac", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652970, "uuid": "08f1a4cc-8fb4-4b60-a27a-0722c718ce18", "value": "T13C44571C375E8B93C75871B00A1595179EE52910E77C4283BFA43ECAEFBE346B10E85A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652970, "uuid": "39a47bc5-b9ae-42db-9793-a80445ff86c2", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652970, "uuid": "a9ea0876-d772-454b-8ecf-365ffb58c453", "value": "3072:Cf1BDZ0kVB67Duw9AMcb6FKglbz5107+i9CUVx/kvBFi4lBV5AfeNNu0NiF:C9X0GT6FKgpF107+iNDG5l5AfeNpNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626652970, "uuid": "6edd85eb-db1d-4b9d-9640-ad34588d8ffc", "value": 262305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626652970, "uuid": "d56dcd75-ad82-49e9-a80a-2a64a51630e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652970, "uuid": "0b3a1091-4bae-464d-a5e6-7db0804dffdd", "value": "Software updated v2.6.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8001b6ff-e8a7-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626709166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709166, "uuid": "4ec2b6b8-4cbd-4778-844c-5d91298bc660", "comment": "Malware payload (DanaBot)", "value": "49f37ba39394d2bf4cc6f3e238e0845f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709166, "uuid": "dbaa0bda-b714-428b-afe6-77ec0d44c205", "comment": "Malware payload (DanaBot)", "value": "b22a99c25c0d0b7c411017e1332f8a5aebc0fa01b508bd57928ea9aa58755172", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709166, "uuid": "f7604732-5498-4ab5-a3e1-6a7f22a712b4", "comment": "Malware payload (DanaBot)", "value": "7bebc7f215c4701faf76c423d7b25d4a4f4b8706", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709166, "uuid": "a20cc0cb-ad9b-4d51-b00e-b40d62926787", "comment": "Malware payload (DanaBot)", "value": "0212cafb502d2ac76ed0490d87fc6e8719e4affd2f51b2d9b30ee5cb5e8cfc36f189e7ce7187d9071928d7f4ab8e1e7d", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709166, "uuid": "b7165f8c-ce79-456e-9f04-35c9e22c664a", "value": "T1C635235074E8D827F0A7493775F1C321BABF3F652938948BB2822BDB4EB069149DD712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709166, "uuid": "2385c328-85d3-4913-83c7-9a2973de645b", "value": "52c37101f2973085af5ed972e3b0d2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709166, "uuid": "cb7ce1e6-64d9-4e8b-93bc-6e8317a17d0d", "value": "24576:xXKko0JcR/AWXRlYfz3hL4H6TaV0DM6Ugb8fTIM10LbOxKMPkl7yA:xXK8ctHRWzRM6bDVR8fTF1Ibb75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709166, "uuid": "ddd20458-dd3e-4650-a522-def254b24a72", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709166, "uuid": "b1a10980-7abd-4b3f-bdf6-1ead0ba556a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709166, "uuid": "24fae360-1870-46f3-8aa3-b72c66d54588", "value": "49f37ba39394d2bf4cc6f3e238e0845f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe127cc-e87c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626690725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690725, "uuid": "49bcb912-edda-4bd8-8564-091398f8a340", "comment": "Malware payload (Formbook)", "value": "0c87a280c26cdeb9d2fddf088c00eec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690725, "uuid": "fe830c97-1515-49a6-aa6a-c0f539cf350b", "comment": "Malware payload (Formbook)", "value": "b28811bb2049d77cf2c66e7f667ab4312d86b4e54e645d68ec9a0746f46e3bf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690725, "uuid": "6c0da577-445c-4c0e-a98f-2312fe47639c", "comment": "Malware payload (Formbook)", "value": "9e3734c6c3fdb250409ec73513b59250cc7fe115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626690725, "uuid": "b35d6027-ed49-4b0a-9cc5-3c743ac17c3a", "comment": "Malware payload (Formbook)", "value": "02096b5f91f004ebc888a32e121f00eee154fe6b9cf375ad944d1f4f3ddb7192cb9026e7695df86ae1def5af3e699c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690725, "uuid": "555e21ca-0dc6-4102-b81c-7b0132ef0dd0", "value": "T1B8D4E169332BA30CED648BF91C79D1A277BEA42A262DC63C1E88D03CBD7277C56D0551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690725, "uuid": "837bfeab-24a5-48db-a754-9824bfc62f3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690725, "uuid": "b29651dd-3c8e-4bc5-a88b-20b7fc8dd251", "value": "12288:9QfyvUIZbVN+8gh3rbTapEtTlOXpYG/vvwKGF9EhYZBa2NHY:CqvDBN+XhCPPvRauYZBae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626690725, "uuid": "9324bfee-f0df-46f2-a754-1f6eaf7f30fe", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626690725, "uuid": "9f19a89b-9cec-45e1-852a-7fa88fc65030", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626690725, "uuid": "c81745a1-cd68-4d85-878a-ae91555fc814", "value": "order no. YOIMM20190832 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fff4260-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735661, "uuid": "8182d798-a5d6-470d-8f65-b751531f83ad", "comment": "Malware payload (Mirai)", "value": "ef5411286724d9e1277c6507378ff22d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735661, "uuid": "4e3fe436-942d-4b59-94d9-e642370006c4", "comment": "Malware payload (Mirai)", "value": "b395481bbe395d94489ab736dae531c4a407069cee87f180d647d2a07277d0c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735661, "uuid": "0b915888-271b-43e4-ac17-3a49d74deef4", "comment": "Malware payload (Mirai)", "value": "b40b979393af5f25ad19fe7d69ee16977e83597c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735661, "uuid": "f5c90312-d44b-4522-8e14-21b4fd67a361", "comment": "Malware payload (Mirai)", "value": "d8f6f2aa5b0bf9bb617045639606e35f24adf1c6a1d427c06898ee0abbe2ea2d22ebf93b47aba85ab62dbff7a266644d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735661, "uuid": "70f1b574-c0c1-4a05-a050-93c502e7ce4e", "value": "T188530985B8819A25C6D113BBFE1F018E3316576CE2DE73129D141F607BCB95F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735661, "uuid": "16fd24fd-cb1d-4f48-be54-1826a8cacbd0", "value": "1536:wdnIYoZXnYkTAcASlquASBAFzVLl1kHQwOcL/IBikcKJKWx:FFnRUcvlqCuhLlUQcKJKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735661, "uuid": "5c89b9d0-6113-4aea-9c2a-af5e1280f233", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735661, "uuid": "f48e434a-013b-45aa-8393-2504061ab4f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735661, "uuid": "97aeca9c-0df2-42cc-b52e-9fd6b624a5d8", "value": "Josho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d24e290-e85e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626677755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626677755, "uuid": "79375d79-041c-4b8d-8fc1-2610ddec3282", "comment": "Malware payload (RedLineStealer)", "value": "057087b5b9102b8ee462b0b448d5225f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626677755, "uuid": "2e5a7fd2-37a7-4f26-85d8-a7c4d23fc5b0", "comment": "Malware payload (RedLineStealer)", "value": "b50b6cd901ab63e6f963851fdb0bf3ef2c39c6177e84cce4754ba770ce6f8edd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626677755, "uuid": "f4580860-7c66-4c55-86ca-35afdba2c4b6", "comment": "Malware payload (RedLineStealer)", "value": "bc723e1a7c2275034725e4281b1e4b523ed336be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626677755, "uuid": "deb0de29-481c-48dd-826b-a87c7b7fcc6f", "comment": "Malware payload (RedLineStealer)", "value": "3f6f20bf9a673e6a069f1b7fa6cdf6a8cae5d4b8344b3d719f986d2c0dfd845f0b1b4c880b44eec3e11bc2ca549ef872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626677755, "uuid": "150516c1-41dd-48ae-8923-8383d901d120", "value": "T1E844E01239A0D832C6E3193464B8CBA56A7BF8331671854F776437BA2F713D195BA30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626677755, "uuid": "b76cd517-b22e-422e-896c-9929234c75af", "value": "dcb225352cb14e820e56d679143111c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626677755, "uuid": "65bdef18-33e0-450f-a667-1426f912dfb0", "value": "6144:neqE+ZJYz42I9vO9X2XNPJlpM89rBOqkGy:fZT2WO9X+pzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626677755, "uuid": "e58cf9bb-309a-49b6-a320-4aa5cfe1b563", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626677755, "uuid": "296dde58-c328-40f4-ac4e-0b863cab22f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626677755, "uuid": "3fbb36fd-41b9-4eb8-8a68-acf56a385915", "value": "057087b5b9102b8ee462b0b448d5225f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19f1aaf-e83b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626662864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662864, "uuid": "5de52a11-cf24-45ac-a1b5-3f954073dcb0", "comment": "Malware payload (AgentTesla)", "value": "1e37f288ea6318255228d19d04760365", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662864, "uuid": "4c42a067-6289-4469-9f1c-9930d10878b5", "comment": "Malware payload (AgentTesla)", "value": "b5d46013c2ad6b7eded0b3ee21406ee75c24bdac58ada6544919729ff532b07e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662864, "uuid": "5060b81a-f929-4bc2-bddf-d732a4c679e7", "comment": "Malware payload (AgentTesla)", "value": "85cbc9681c1c0bab54bac06359ad38a78c149708", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626662864, "uuid": "3b7a131e-96ee-4846-83b1-99e9df5289b9", "comment": "Malware payload (AgentTesla)", "value": "79a2bde8a17bd3bd359e4d7573b1eef8f661ec5daba9bd366f334f94ae62e81c1124ebfca0d82b12f28f1c5292014769", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662864, "uuid": "74009407-4233-4cda-86ae-ec00d098b862", "value": "T17A359EAC714035CEC8238F3389A5EC71B2912C765727D90758DB7D6BBBBE6838E11492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662864, "uuid": "8a0cf611-a95a-45ef-a51b-619bdfabe88d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662864, "uuid": "fabd903d-3dab-48fd-9019-98c7433a1588", "value": "12288:DV22AX5GZm9i7LVnCWMzXt1XlsoS3qKVH0A57BFBLHQ0kueQjTpsFm0dAxl:DVvu5GZm9iEzXt17SakH0Ap5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626662864, "uuid": "939446fe-a773-4a47-a470-e0d34201f3fb", "value": 1078784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626662864, "uuid": "00c90b34-74c0-4911-9763-8ba03a7596fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626662864, "uuid": "12956831-8212-4e67-99e9-2a0acd58f726", "value": "SecuriteInfo.com.Artemis1E37F288EA63.20801.7076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cd2d1f-e890-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626699318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699318, "uuid": "16366e67-2542-48d1-b8bf-4c4758c7bfad", "comment": "Malware payload (NanoCore)", "value": "c076cac87cfb3582c53f4a7244a893d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699318, "uuid": "75ea9ac5-2302-45bf-b5d6-4b0ac52f48bb", "comment": "Malware payload (NanoCore)", "value": "b61490152ba1ab397039a88faf325cb569a02c80050b1c4194839a546719b435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699318, "uuid": "79889edf-3e86-4138-ab06-ab1d750e1520", "comment": "Malware payload (NanoCore)", "value": "3b056e39c3c54719120f88761f086b114e805d40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699318, "uuid": "b93a5b64-d729-478a-b6ff-1ba076684362", "comment": "Malware payload (NanoCore)", "value": "ee465660e8e962aa023a938bb781cc375cc3ad119d82345644b59dc06b754f1b859c5768f9ecc055f20de92a9a4db367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699318, "uuid": "7f36d221-22cc-4d5a-9fc0-0901a382e324", "value": "T11215AEAC324079DEC4378A338994EC71F6902C66570BD90358D73DAFBA7CA979F111A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699318, "uuid": "9b8954e5-9ad4-4304-9007-b43e6686225d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699318, "uuid": "ea49cbe5-2c14-4132-8c08-92f8825fe859", "value": "12288:qnqZB8nyOXr14Wu+Z3eUxTA1OvICYpW1OcbopS8hpfnvDIHOLJaBWfssq/m:qnqZB4yq2W5Z3v5ICKcotTPv0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626699318, "uuid": "2c4c6f8d-0ef9-4964-84f4-b5d24add09bf", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626699318, "uuid": "b51c0b4e-1b8a-4fbe-8dc2-563b2c4f9c34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699318, "uuid": "aef732a6-8176-4bc0-b5b7-601ef44476ae", "value": "c076cac87cfb3582c53f4a7244a893d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0938f334-e8da-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1626730872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626730872, "uuid": "dca8b666-5afe-4b26-90ba-28f6da697c47", "comment": "Malware payload (NetWire)", "value": "24c8b4647f7cdef7524055129030454f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626730872, "uuid": "d50806b1-5200-4ae3-8685-23d530e63c83", "comment": "Malware payload (NetWire)", "value": "b7f42f93e5c2dfcb4620859c74593f1090dcca50dbf14d7665e31832b3ff0313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626730872, "uuid": "df5980f6-e8e6-4eaa-a4b1-0420796295ac", "comment": "Malware payload (NetWire)", "value": "8b5dd2f2d271b5503a865bd6641e7a761ee9c520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626730872, "uuid": "b6ce9107-3454-4f1a-a5c1-c2934d3183cb", "comment": "Malware payload (NetWire)", "value": "d4d167cf5426cdaa76700c8219911c19b0dae098be60ae1de8ea86c9c5e173b7418e211ff106d169253b2a299cd9d570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626730872, "uuid": "f6b25f86-8e86-404d-a4ed-5d44ecf80600", "value": "T1A63733823AE15EA2D05A6C337B75BA015EB97C201F398489DBD84F449FB4453B07E7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626730872, "uuid": "f48a06f0-9651-467e-b8f1-4a3f328bddbc", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626730872, "uuid": "d0d3ba18-7300-478d-b19f-765136be03c2", "value": "393216:gQGG8FeEfdQqWR8BTnCjXqwzyUDVVugHDsJW9nXVnFr:gjFeAQ0BUXNuDJanlnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626730872, "uuid": "118ef010-d906-45b0-b6a7-c79f514ae269", "value": 24117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626730872, "uuid": "174e3f7f-7119-46db-a9e9-cb8f490814f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626730872, "uuid": "1ef89f03-077b-4c71-8d47-ae11e47d61a2", "value": "24C8B4647F7CDEF7524055129030454F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5a26bd-e8eb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626738554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738554, "uuid": "ade88c4d-65d5-47df-870b-5cbfe62f3e7d", "comment": "Malware payload (Mirai)", "value": "97fff01c60e4112b58394ebfeafc6be2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738554, "uuid": "a7c9eddd-a192-487d-9f2c-795e3e867d07", "comment": "Malware payload (Mirai)", "value": "b89642ba672200e9b8646318dc8a78721e4c4531358531d9d4dec2be4f4353e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738554, "uuid": "dc360bfb-277e-4f90-b8f8-9672f9942d85", "comment": "Malware payload (Mirai)", "value": "dca3ab364f9e7d002189f656f1f3ff162ead2d0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626738554, "uuid": "cfe739f8-ece5-4195-80b6-63a0e259d317", "comment": "Malware payload (Mirai)", "value": "de9fa9982933d720912b190311198f9ef271b432f66b1da1f5421be9136f66fe0600e7151e525e57733755a90cee34e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738554, "uuid": "1db69cd7-3db0-49f8-8901-207faf0f9bba", "value": "T15D136C61C9B85C8CE25C46B875389E3D8723DA15AB072EF9425BC766A013ACCF65D3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738554, "uuid": "1ff05047-734f-481e-840a-e6bc3431cabb", "value": "768:E/2JGDxYsn385LsTAaTvxoYKpnfCuRR4ovHsUf6WLC1Q1vi:E/IIS4Yha7b6XvHsBWLC1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626738554, "uuid": "45c08440-f822-4b44-bc29-0bb3a42cd81c", "value": 43216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626738554, "uuid": "d103266f-aa88-4b2b-a602-81317552d269", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626738554, "uuid": "bd0789af-f5bb-4308-81e9-d4099416683c", "value": "97fff01c60e4112b58394ebfeafc6be2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b96a02-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735890, "uuid": "5185674a-8880-4fd9-b36e-50746f565667", "comment": "Malware payload (Mirai)", "value": "c7d24ba7d3708716e84f34a2159275b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735890, "uuid": "68fd8dc4-5aa2-4c49-8073-7550a801b14b", "comment": "Malware payload (Mirai)", "value": "b943c1822babe873b0f8902bbdbca2d8c7c2c55fa55687b3b901fb8a13ededbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735890, "uuid": "22c5dc5e-7f21-4a75-bb08-a968c94dbb18", "comment": "Malware payload (Mirai)", "value": "02f9622a5f929229ce544713ef0b2ed1934f5956", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735890, "uuid": "70ef1f33-e30f-47ae-911f-ae21d50d5521", "comment": "Malware payload (Mirai)", "value": "a19ce26528c83f30ec6ebb9f3807bb3d346a497b6a175645d5a0532fe534ac9ce53e16f15e6c7e5e0e9f429d663ee5db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735890, "uuid": "15fffc66-87f1-42ca-b3ba-a23dfa844500", "value": "T1AD63961A3E218FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735890, "uuid": "56ba03ae-6fde-4062-8bb9-095d7384284b", "value": "1536:AHNFnXDuPq/SyZBp9tsCI0v6bqfg/Kkz73o2x8cW:gNFXDKGrJI0SWYz73o2On", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735890, "uuid": "d2e2b3b7-8fff-4880-ad48-c4eb32437dd3", "value": 69080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735890, "uuid": "0cb3c00f-d172-48a7-a501-f94d7a1883dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735890, "uuid": "80dec152-b55c-48b8-b9ca-f59cb017954f", "value": "c7d24ba7d3708716e84f34a2159275b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5531fe15-e865-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626680748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680748, "uuid": "fefb94ae-bc8d-405f-aed0-7ccd495b8b07", "comment": "Malware payload (Mirai)", "value": "9e78504a291bd023439b4e52c6612c11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680748, "uuid": "181dda62-988b-4270-a377-93ef9998bfbf", "comment": "Malware payload (Mirai)", "value": "b99781f4f04933643df8fd9ab725e4394ab3178b21eb36260b51d9b329786ca9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680748, "uuid": "f17c1e6f-7459-4638-8d91-d9e7a32850cd", "comment": "Malware payload (Mirai)", "value": "cc1ef893d39d6318389baa340419afda215c9129", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680748, "uuid": "a90c0e43-726e-4ca3-93c2-cb6de2249efd", "comment": "Malware payload (Mirai)", "value": "3b499c56b46f4ba1798bcbee0400faa25ac35f36ac7ded40fd59d004b9193028f22753ea44c97ba3e85f1d50dddd7610", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680748, "uuid": "ad8c106b-4bf7-4234-ba55-09b9e59ca031", "value": "T14FC2E0849BBECEA9F4DE0276523C096A609364F3AFEDC190121C9FF5B5C21D81D26CD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680748, "uuid": "d017778a-1f74-4d2c-aa03-cf2a329793df", "value": "768:nlmvZdquj8SvVyu5asfn6QFEsBOqD1+iZ6NfBxC:nlmvWo8Spa46Q5BJhZ+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680748, "uuid": "a6927912-4e51-473c-97d6-50858973da19", "value": 28012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680748, "uuid": "c0047a5a-6df6-4180-9019-8f4ded026840", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680748, "uuid": "11bf07a4-122f-4d37-b03d-e63bd67b3df0", "value": "9e78504a291bd023439b4e52c6612c11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea272e2f-e8b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626716217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716217, "uuid": "cb7db763-2694-4891-badf-79cc0c3a5412", "comment": "Malware payload", "value": "413ca1f198008a2980f7891c059bc188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716217, "uuid": "7dacf67a-9169-402d-9abc-31fc02e14313", "comment": "Malware payload", "value": "b99cc830b4e4b6ea89546d4b963aef00bd69c5e31275690ac82d949f1055f9ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716217, "uuid": "5aaf2f50-9cbb-4793-bc21-685b7380b26c", "comment": "Malware payload", "value": "11cc0010665414d2acfd19846af2bdffb0d9c202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716217, "uuid": "3b7050b8-2a3a-4b1f-8a3b-2b9ce4bf9a37", "comment": "Malware payload", "value": "90c4775b388e89ed86192ac91f43397bf9f0e7ce3cd55c7e8e107fee38fcbd8dfcc145716045488a4c802c021e28df42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716217, "uuid": "c4c5a183-954f-4dde-876b-25b1bffb1564", "value": "T19615F122722BA614DC3987F55C74D1B16BFE6C29922CC6782AC8ED7F7D732785AD0240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716217, "uuid": "cc618565-70d9-4aac-8033-4fe02740fa49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716217, "uuid": "8c93dd92-d1ea-4324-bf63-f99c19190e68", "value": "24576:0vDBlBPIOBPMAfeQrdkBrwSyQj0pS0fS9:spPDPhlGBrwigFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626716217, "uuid": "606e0574-d2d8-4120-8277-c193e77e8126", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626716217, "uuid": "bb2d86e9-7662-42f6-b920-1b86e30be1af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716217, "uuid": "c71f05d6-9ac0-45cf-9904-80e79270df62", "value": "SecuriteInfo.com.Trojan.PackedNET.935.22091.30528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704c14e4-e885-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1626694537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626694537, "uuid": "0c7e6a57-538b-48fd-8fbb-d2ce9e0ff860", "comment": "Malware payload (BitRAT)", "value": "1aa4ec7db318a524fdfb5aaff61a1031", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626694537, "uuid": "d5889870-01b9-4679-99f1-818540f8ead2", "comment": "Malware payload (BitRAT)", "value": "ba47f657a4745c96a62c444100d6c38bbff772b47ac03e83dc3ef5d94bc1d77c", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626694537, "uuid": "0579d8a7-394d-494f-89ac-be24a124bc36", "comment": "Malware payload (BitRAT)", "value": "bb804be3028c6cbcc62e81fb70482c1a2444667f", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626694537, "uuid": "9005b93a-14f4-4f40-9fa6-c113b0ab07dc", "comment": "Malware payload (BitRAT)", "value": "d4813c73995163fdb39ba6792b4cd547cd13b46bbe65fa2dd17aba817bc915132f09837ddf9f36dff3dec7142b0d8d00", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626694537, "uuid": "26c43da3-0c8c-4f4f-81d3-c32fa23206e7", "value": "T101C5231A677CE244E2D66CBA0013935156BABC4327ADFE1580D0FFE849F8BE098563D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626694537, "uuid": "a0a9bec0-89c4-4555-8e5f-0f12b6013672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626694537, "uuid": "84d7595d-e1d7-427e-8fb3-ba0eb3e05ffe", "value": "49152:332SKzAnWx/9H4GiwfQTuWwACHst9qxTcAGlrOOgl0UVODO:H2SKRZkLwACsqxTGlrOF0UVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626694537, "uuid": "d6b1eba8-4656-450f-9498-1ba1548b343d", "value": 2553856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626694537, "uuid": "6f5295a8-642a-468e-9e59-36a03d0d9c41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626694537, "uuid": "0d58d566-8e22-4f08-9f66-ca5295c62833", "value": "1AA4EC7DB318A524FDFB5AAFF61A1031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f871bc-e879-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626689238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689238, "uuid": "a98ab33a-2136-47f7-8066-bec3089e9655", "comment": "Malware payload", "value": "f57efce1d4d598fe588222053b7d0af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689238, "uuid": "93c047b9-b84d-44ab-8e52-b84847297cbb", "comment": "Malware payload", "value": "bc5d82859d4b7c567fa029977042a8e6629a2d1b3afa92b6f52a33d3006a068b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689238, "uuid": "6feec2e6-a057-4c91-b7d0-93f306bc5c9d", "comment": "Malware payload", "value": "4e244ad9f56a36436df87d254409d4c1f18f703c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626689238, "uuid": "f7a576d1-66c9-4684-a4c5-76ad10b78253", "comment": "Malware payload", "value": "b47679e80ecac4c151a2c64bd22e72638c0fc9777992f681cd397fe45eec90f9c0e6623fb3ba4966369dfe06ba01be29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689238, "uuid": "097ead79-cc5c-44af-a1c5-741792411bfd", "value": "T18105D03382600A9BD3BA51B4D0011101F6F5868BB393F7767DC868D5B1F9B6A87F352A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689238, "uuid": "f99406f1-0670-427e-8587-b1c77adc7e2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689238, "uuid": "beb59cd7-f266-4b54-ab40-579b42572f9d", "value": "24576:19Pei42L46EdiAV8iGEAS+Fmq8cqX6lp2iXVpv:1B02L49Oir+ZRIip2Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626689238, "uuid": "720ca561-a7d5-4b7d-8ae1-2656eed69fb1", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626689238, "uuid": "f90a7f5b-0d56-47a8-ba54-def76dcb74ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626689238, "uuid": "04859d35-2248-4b5d-abd1-300a0995a930", "value": "Drawing for New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816ed69c-e854-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626673521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673521, "uuid": "82036a1a-7c72-4d89-8b7f-2cfb8292f71b", "comment": "Malware payload", "value": "c4da4b011df1462374b04be56f99169a", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673521, "uuid": "bdacb46d-8a45-4130-b016-5abec05ae3c1", "comment": "Malware payload", "value": "bd6b76890564812dd399d1a15f8af070d44b7467ada40da9f94975e4ecf4e1e7", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673521, "uuid": "e5a5e172-eb55-48e4-aa12-f2537a5aa169", "comment": "Malware payload", "value": "64f038a765bfd5edcf97664bd4bdfd59803994cb", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673521, "uuid": "3be27617-517b-4a5b-ac61-4656bfdc799b", "comment": "Malware payload", "value": "75f2c832b6875ede027fb243ccfe772006112678cf04a29f725a6293fc5ef5effa751e1e1ed6a9f55a33e4e1bc3a7010", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673521, "uuid": "60439fa9-1f23-47a5-95c5-9d6bcf8be3ee", "value": "T17F62C0E876D5837DCA629FFE01781F5BE2C28C9ECB2445D7BC5424A438B23DA970690C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673521, "uuid": "5d7021d1-e42d-42c7-ab20-8051a6516a19", "value": "384:m3lHKdYGvPXhnA0tzF2bHOu7h8Qm4wKfqXYG0S4lsRes6M:KKfv/hntbrKh8QzqXuegsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626673521, "uuid": "3398c9d2-7035-49bb-8598-8a049c6acf38", "value": 14708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626673521, "uuid": "5f6be72a-5dc9-4594-a2bd-9bdfc3ce098d", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673521, "uuid": "3d7685cb-fdde-4094-a930-1ee9ffc2020f", "value": "Booking & Credit Card Details ,pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1a2e4c-e871-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626685970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685970, "uuid": "3a76f410-3393-491d-95e7-cd643a7a4bfd", "comment": "Malware payload (SnakeKeylogger)", "value": "2e5077d9cc4b6187f18e95fecc6bbd06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685970, "uuid": "a54d0b54-7273-429c-ba47-6d03e8e2659c", "comment": "Malware payload (SnakeKeylogger)", "value": "c03d7ae3df632d8ce5cc80a458729f4ecd26247466a50973b6b12e8c86cd7925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685970, "uuid": "a9831a69-9818-4753-b9fa-c8df9e8dcb84", "comment": "Malware payload (SnakeKeylogger)", "value": "37c6bef365e7dba7094c7850ce34bb18595e74d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685970, "uuid": "f05b32a0-dcc0-4ee6-b317-208a6c237e8e", "comment": "Malware payload (SnakeKeylogger)", "value": "0bce59c475af45e55919c1d5acbdec115c57d21e915c47d8ad6737959ec186d39749e0440971ed0f0521e2c487189a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685970, "uuid": "6b1d792d-93fb-4ecd-b284-0d2ba1377dbf", "value": "T157E4042835955A5BC2329B73C5A0E331FEF01C566203DD0A1AD6FD973E72603698DE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685970, "uuid": "2f9f4cb6-2e07-4373-bd75-4077d2bd99f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685970, "uuid": "e50c11be-3b49-432f-b68c-6a199a7e994b", "value": "6144:Tnn4Itp47Yrd+y6MQbwrJOl+6e0JxTocN/h1U9evYHMXQ0/WXKw16gA96+zOtZsR:DOZpjeaxcFHMg0/W6EY96+yX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626685970, "uuid": "2ef5842c-3bc7-4b83-9930-07b59bc7913b", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626685970, "uuid": "04908033-2c1e-4e28-a79a-82bd978b63a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685970, "uuid": "7af6c061-57fd-455e-82e5-efef5c4bbb67", "value": "MACHINE SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bda5e2-e88a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626696551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696551, "uuid": "0f9c0353-817d-4361-b475-1dae5c5daedf", "comment": "Malware payload (Formbook)", "value": "f8874c315b198d265440f6ce9ba1d6bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696551, "uuid": "b2e79533-73a5-4b2b-ad50-2a35d822c165", "comment": "Malware payload (Formbook)", "value": "c224e597b165da77d8555c2d28901b3526dd5369f0b89b4cd4c798c18a088c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696551, "uuid": "eec73b51-ab49-4665-aa2a-6c46f4168bab", "comment": "Malware payload (Formbook)", "value": "f4594476da9049365908bb79f3a130687281ae4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696551, "uuid": "9411d715-2b77-4660-a4cf-2bb2fc06684f", "comment": "Malware payload (Formbook)", "value": "f4a43ba0d90f9d8e4ec808f9bf03e6c74915fe76593daeb7e9a5e68621894a4fe699707a9e21fb5b649f4d743472046f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696551, "uuid": "b95bc716-8de9-49f9-b5b7-3caa19094140", "value": "T1C115F1652227A248DC3883F51C29D1B13BFA6C2A523CC6B86DC8FD7F7D726785AD0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696551, "uuid": "105db2d2-fabd-45ab-8efd-609e8241676b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696551, "uuid": "b4d7da96-fa31-4bb1-a071-7d2a93e72f07", "value": "12288:rhzyvUIZbVlBPI2VBPPLxqEQqbnTnszOYSP8f2uMxjicpcPcuHA4QG:wvDBlBPIOBPPLxqEQonDNPi2R34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696551, "uuid": "4800c12c-c95c-4fde-a4ea-10ce44cb9d2d", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696551, "uuid": "38ff0e64-9854-4d43-b7b2-994decee065e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696551, "uuid": "540b689f-98a7-4d92-abe5-582e5b94e0ec", "value": "Y-20211907-00927735_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f1689e-e860-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626678763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626678763, "uuid": "8fe64a32-afff-4138-9d93-d6c33a0c4d5d", "comment": "Malware payload", "value": "dee95c99395c1d074e7f815b8cdd33cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626678763, "uuid": "369c5eb8-0d5c-4d67-9acc-5b41dc2f50d1", "comment": "Malware payload", "value": "c25e2223ce02406f44264119d1cc1aec651d903991ecd91fb848a912fb1e349d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626678763, "uuid": "81aacf05-7670-49e2-8207-c6000e374d45", "comment": "Malware payload", "value": "06b1de1a538a711c4b27a279e2170a255bee31d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626678763, "uuid": "7ef23399-7bb2-4ced-be8b-b13815e09e3b", "comment": "Malware payload", "value": "3455844ad53a18285644cb82aff33c899f50dff7415751ef78a49e7711147016526e7fcac1733996e5eb5c82bf32560c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626678763, "uuid": "8704a4dc-fb04-4965-8a94-b639cded21c8", "value": "T18125BFA1F11B69C4EC3743F658B9ED20365A7DA95DFE921C391AB82959B320310E7C0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626678763, "uuid": "121a65c1-e824-48c4-a7b7-0533cb723945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626678763, "uuid": "086d93f8-3617-479b-8887-6ae083703a54", "value": "24576:2wvDB7BPG8BPdOcl7jMIAWIYoaDx/9MriNAhIN0P:2wjP/PgyfEWqaxWeAhq0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626678763, "uuid": "b04f6535-fe06-47b3-868e-b930b542ec1b", "value": 1035776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626678763, "uuid": "b84286af-d0f6-441c-9ccf-7dcd2936f1bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626678763, "uuid": "52610ad3-3642-480c-8024-de8475487d1e", "value": "KUWf9JS752FbEqN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25658ed0-e8c0-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1626719752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719752, "uuid": "10de583d-f95b-4766-a26b-308c586a92dc", "comment": "Malware payload (njrat)", "value": "a5ed586c6aa4674092bb6bd521affddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719752, "uuid": "8a532a31-6780-4c21-9c05-a63a78e9e792", "comment": "Malware payload (njrat)", "value": "c2bea2d868e82aacc04296992cd63a14383592c225b868eaf0609299557c55a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719752, "uuid": "25c141d6-1cd6-4f84-8f05-e01abaf3a57a", "comment": "Malware payload (njrat)", "value": "cd0034fafdcab582fa4b12ff2c5bbdceeca62533", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719752, "uuid": "0ceef7dd-3e5a-45bf-a970-11ff956207e6", "comment": "Malware payload (njrat)", "value": "c9442f50e7b2e606fa13c6ad4c2759874e21fd702d60d38f7f43d9ff8e1eff5c1285f67448e9a83bc1aaabf9ba511fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719752, "uuid": "6363c037-5ad8-4c02-9d73-5a401756fef7", "value": "T1A155E712FDE92D62C2DABF7974B1160762DCF7871937FA0AE65A22ED3060C4D9D0C852", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719752, "uuid": "6422ad23-55ed-4de0-9d3a-3d2b00be3c1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719752, "uuid": "2db915aa-5ce6-4485-af13-2c3581362f77", "value": "24576:DHme0Ac+iaw5TCTjLILVmH2OytG+0Fz3JYoinGQ:SLAcwwcXUVmH2OB+0Fz3JYoLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626719752, "uuid": "4751c88f-b8c7-485f-840d-04f877a085cb", "value": 1376764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626719752, "uuid": "d0add083-5d59-459f-899b-f3dfaf09cd10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719752, "uuid": "47408d5d-59c6-4c1f-92ba-096705214d5a", "value": "PBHACK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4a3535-e89c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626704620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704620, "uuid": "b83147b9-e1d2-48bc-8b93-ef16c4ee88c2", "comment": "Malware payload (AgentTesla)", "value": "7679d24a6be3b575d0d2b60a3df60a60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704620, "uuid": "e2410c21-c5a3-4a69-8169-0012b2b0f1be", "comment": "Malware payload (AgentTesla)", "value": "c2ddf339221a70ef5a3aca2ee22faad4884b2281ac5e9add22eb9829784986d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704620, "uuid": "deaf35bc-85df-484c-ba88-1aef579fdcea", "comment": "Malware payload (AgentTesla)", "value": "ebf47db4452e2aa55371a206f28248c594ad860d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704620, "uuid": "6af06cfe-e0f1-415d-ae59-bd0d4a5457f2", "comment": "Malware payload (AgentTesla)", "value": "2329e04da0e79ca55856707eef669c9c457386485dd25b823bbd6d2547b90eb9e47d114723ca01363c62ed8921a8ba6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704620, "uuid": "3d466c68-024c-4bcd-9ca4-aa316ec13246", "value": "T18C357B10236B5F98FC7EE7792438040057F5B80BD329DA0E7EE610DD1692F968AB6B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704620, "uuid": "9012e2f9-1f58-4104-aacf-41657b74bfce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704620, "uuid": "aca62029-a50f-4a46-b509-bf677b8a00c2", "value": "12288:xjkbQi/MpIoo/QlTNB/QyvUIZbVZgBImzQw4qmrCi6DDLhlGAh8q8/pjsij0BEvN:NouffvDBZ2HzQwMrE3Gm8q8/l0avOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626704620, "uuid": "960afdeb-4adc-4add-b4bc-5ff40bf6965f", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626704620, "uuid": "e880d30f-f9e6-4171-84ce-5d8d58e1ae8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704620, "uuid": "0d6f0529-ea32-4871-ac22-d66b8783dab8", "value": "New order 0007192021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237f814e-e835-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626660049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660049, "uuid": "a4650946-d071-4e51-8145-709de765c413", "comment": "Malware payload (Gafgyt)", "value": "d78184e598cf6b5592a4ebc3c60ade3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660049, "uuid": "ba05a286-0d23-4f4c-967e-ed2221554990", "comment": "Malware payload (Gafgyt)", "value": "c485165c91cd3efe947686f844aa361dd96b4f4ff2dfdb99835c559c816cf67d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660049, "uuid": "0eedcf71-ce5a-4b20-b160-679cedc9d029", "comment": "Malware payload (Gafgyt)", "value": "859d79a9d5e4b78befcb73843834a7feb9728447", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660049, "uuid": "84d0cbe9-8c19-48d1-99b5-2dc36fb17feb", "comment": "Malware payload (Gafgyt)", "value": "8572485b7575ddb5dc828e801713e7d165983e190c6a4f4b686fc9270b2ebdf4de9f26773c20ff955088d94c56c6944d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660049, "uuid": "6269f8f4-aab3-4a61-9ba8-9f74e5773141", "value": "T18BE31A34D4504717C2D213FAE69E825E3F221FA793EB33115738BAB41FE279A1D29924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660049, "uuid": "17de746b-3dcf-4808-82e3-908496c3a07d", "value": "3072:Eu5EWN96a/1P3HT/pOQ5GPoq9/ecd5/N9kmhxQwoVSUNu:E07Oa/1P/5GPoq9x/DkmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626660049, "uuid": "c94fcaa5-6d38-4e4e-9776-a64686c89768", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626660049, "uuid": "6ba891d0-fdbd-44a6-a3e0-6f6c01602b38", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660049, "uuid": "9eb49104-3224-40c1-b08a-531e37eadfe4", "value": "d78184e598cf6b5592a4ebc3c60ade3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76018183-e86f-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626685098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685098, "uuid": "edd74a52-c9c3-4832-b442-a2b2a9f9cdf3", "comment": "Malware payload (RaccoonStealer)", "value": "92823e5e4a6dd8edc4ae1797b896824c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685098, "uuid": "cd0402e7-0513-4d95-8e21-c47c7dc0ed9d", "comment": "Malware payload (RaccoonStealer)", "value": "c6455136a31d5172e97027b300869d6d1f70081fab41b2e18f0b444475e3280a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685098, "uuid": "6830c491-a52c-41ea-addf-723a98731d18", "comment": "Malware payload (RaccoonStealer)", "value": "829a8f44ee9d917583f5206e0b044957305ea657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685098, "uuid": "854d8a9e-1f39-4086-8ee4-cb80a0dea0d7", "comment": "Malware payload (RaccoonStealer)", "value": "34d7bbc917bbe154a4e6c52d4df63de8d235c662a20b36e5d40b81ba41122e7d8cf2dbde205badefd4f83a5110a0f8d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685098, "uuid": "21be7583-ee8a-48dc-a9dd-7450a91b40e8", "value": "T1CFB4F15176F1C033C1E606709874CAA02A7BBC726664758E768B3F5E7E323C1B5763A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685098, "uuid": "eb39b7c5-cb96-4cc3-b894-93181921ba70", "value": "9500feeae6f2027f3e5f8d8ceaf88edd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685098, "uuid": "c3298354-fc9b-4667-aa34-3e65d96fa88e", "value": "6144:P+JRAWpCdF8pmdyp0Mgch4Ynfn7zQpnRYSjBanal/FxnkmjHNpgTKlmCSBJaP:GQWM8pmgRlhZApnR39FnFHNWTUMBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626685098, "uuid": "e73686c2-a78c-408c-a9bd-b6998cd023a3", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626685098, "uuid": "27e39c25-540a-40f6-bc05-7445ca742d7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685098, "uuid": "2fdf7dfa-55c6-48b6-85f1-39db411770d8", "value": "92823e5e4a6dd8edc4ae1797b896824c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff58526-e833-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626659479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659479, "uuid": "80527fff-0ae2-4b3f-a6bd-f5020975ce96", "comment": "Malware payload (Mirai)", "value": "97133f1e1e56b8282500f9a00ee6f1cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659479, "uuid": "b1bd9014-9a52-4d30-8718-b6cdaf69ddc1", "comment": "Malware payload (Mirai)", "value": "c715f96c8313bb357821b1919217b2c0ff6fc5d2cd17991891673d7c14153604", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659479, "uuid": "a4f81883-d511-4890-b268-4aaac40b0434", "comment": "Malware payload (Mirai)", "value": "3b4c4fa56a1a50e716a4f478af656047bebc1bd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626659479, "uuid": "c37e2568-ba74-4e0c-98da-eed25c35648f", "comment": "Malware payload (Mirai)", "value": "47c27f8680b4baecab383934383c760db3ff4efeae51dd29a97e257077cc82dd6a2d1e344098600af84e95b2e502744d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659479, "uuid": "2d7b9428-e658-4a2a-b44c-ed5a39dd72de", "value": "T130430856BC818A12C6E0127AF66F85CE3B2123E8E2DF77079D211B6136CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659479, "uuid": "7b743c88-5b12-4b48-a4db-864c98029ec6", "value": "1536:FH0Rv9hcS5f76tdOE1gSqwcO8rs5BXuL27PMhFBw:FH09gQ3j4Bg27khF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626659479, "uuid": "11f6ab75-9603-408f-85f4-9cc45866470e", "value": 60476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626659479, "uuid": "b600bfaf-f149-474a-8b79-5bfd6b8ba770", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626659479, "uuid": "37f18c3f-1f49-4d0d-91c4-5c35088dc2ad", "value": "97133f1e1e56b8282500f9a00ee6f1cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2093c2-e8de-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626732707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626732707, "uuid": "c40f7cb9-7267-429f-a1f4-3641368623ac", "comment": "Malware payload", "value": "c65eb22434cbf550e158d45cf9a64470", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626732707, "uuid": "611703a7-1e89-4c6d-a798-1aff216fa5ee", "comment": "Malware payload", "value": "c76a9b5f3a1d4456cf2fe90c115f808e4a53f04a5520eabd945af7d41c44b986", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626732707, "uuid": "8d00b940-5bea-45df-abb9-ff059e64b3f0", "comment": "Malware payload", "value": "65bc53c6b4866cdc82a55a24c107359ed424cc55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626732707, "uuid": "0a524087-a670-40e6-bea2-02dd44f54216", "comment": "Malware payload", "value": "18755e47b2b78067a286987cf34fab0d49cfea45c916d9318a44ce70007de748c3134ccd499a4cef16f532e00a9bec0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626732707, "uuid": "a16349ea-49f0-40db-88fd-1a3a1f220d78", "value": "T19E35231037A09432D6A60A7448F4C253696FFD21EDB8054A76C0B7EF5E73DA2A9FC709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626732707, "uuid": "6f42175f-4a54-4e44-a4d4-28ab91cd0bb1", "value": "ae2db6c03e6b0c919da78387a2065daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626732707, "uuid": "53f57475-3eef-4dc4-b4f7-ebe3bbd5ba1e", "value": "24576:D3daVKZ3y7aoTk1V+GH0SyPxnT47YOiTRn+vULUyW:DNgSi7aoTKgxnTjdTF+cLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626732707, "uuid": "74d6df44-87b0-4258-a4e8-f144474d8df5", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626732707, "uuid": "b0ad069c-a403-47d2-9e64-f2b1bc847b02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626732707, "uuid": "13caee93-19b6-4029-b89f-423e51331496", "value": "c65eb22434cbf550e158d45cf9a64470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8321d0-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735897, "uuid": "ed8c1546-2d7c-47d6-b03a-cfc457867516", "comment": "Malware payload (Mirai)", "value": "58e5f30c44bf0fc394ff71723a6875ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735897, "uuid": "c1c237ee-709c-4021-bb03-ee217094a509", "comment": "Malware payload (Mirai)", "value": "c80f52c878f112f91e77777d886beb622ab5670f71a5ba96a1f941f5a95794cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735897, "uuid": "2b1f653d-52be-4a0d-8fab-6b5c4bc78b8c", "comment": "Malware payload (Mirai)", "value": "7d6d527b6e42d1558e9174f32ec01c15584939d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735897, "uuid": "7ac8be78-ecc2-46dc-a426-9667831fecd2", "comment": "Malware payload (Mirai)", "value": "5db9387a62a6ce7a122e4e87ee8cbeef77568762d981aadf7306a356c4ee8a7939812b976d1e2e87626b58736f25cfdb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735897, "uuid": "bbf2a909-1446-4bb7-b068-c73a594e4f10", "value": "T1A264D08AEE01AE25E9C016BAFA5F034D73774BACD3DBB111E620C72936DA54B4F76044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735897, "uuid": "df53c1ea-f136-4c56-bf11-09b907ebe60c", "value": "6144:p3lOYoaja8xzx/0wsxzSi+Ba77oNsKqqfPqOJ:p1CG/jsxzX+Ba/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735897, "uuid": "1265adff-f55c-4314-a4e7-b71b3181d41d", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735897, "uuid": "4e7d8782-f1f3-4944-8cb9-7e4c2c8f7b50", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735897, "uuid": "c612682a-21e6-4a25-843f-295f9f6366d1", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8c7e9a-e8bc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626718232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718232, "uuid": "9bcad10b-2f48-4abc-b72c-8ff59b7bc7cb", "comment": "Malware payload", "value": "08730cdd286a4c9d46b38bb6545ac311", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718232, "uuid": "02de501d-5d87-4883-9a2a-bb99e2bc1469", "comment": "Malware payload", "value": "cb2a2537987e45c8461d40a0ec6c24215920519257134db91dd1369ff5abf342", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718232, "uuid": "e80547ce-582c-4a14-9915-f5b3237e49d0", "comment": "Malware payload", "value": "001bb7b5b8d63e505661d7e4a178d08abe6bbad7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626718232, "uuid": "1b291b5b-c49e-4797-8392-41441fd66991", "comment": "Malware payload", "value": "9d20f1ba1a142ba17af6296b736a3d84587963264bb4da1874cdf8f0bb8b42ad5bcca82fcd03d390d12fcb0db0f7533e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718232, "uuid": "d01abee6-95ea-4505-a654-35836a129cca", "value": "T1DF443AA466D9FCCBD8B8B930AB44BD1D8279A4749E4C879578705328EE71FC104B4E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718232, "uuid": "bb9aa8b9-bf79-4a0c-be83-6c97a034db53", "value": "ce5c4ac311690d884b7f964e897cf716", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718232, "uuid": "bf6e1176-4422-4d3e-9445-44127c437205", "value": "1536:d/k1xdvMuWnLtmBcSa9O/C0UzIY+SpAkaYQryC7AfT/k1xD:5ktvMu8GcSaw/RQ80fDkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626718232, "uuid": "56433e78-f14e-4c5c-b7c5-69b5abe5dbe1", "value": 271464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626718232, "uuid": "74e0a073-06fb-495d-a103-c8ec4623e92e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626718232, "uuid": "588463b8-e1ab-4497-b05a-74aef3970cfe", "value": "08730cdd286a4c9d46b38bb6545ac311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0be334-e891-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626699793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699793, "uuid": "c49586c6-72f9-4c46-be72-a31ea2c87754", "comment": "Malware payload", "value": "14a388b154b55a25c66b1bfef9499b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699793, "uuid": "7f72de12-fb01-432d-b6c7-73785d74596c", "comment": "Malware payload", "value": "cb414e417f8f3de9392dbc6a89421d1a8e95beabbbe387e11771567d63a7b227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699793, "uuid": "2e890b41-d5fe-4fd2-941a-65bd8a0c0deb", "comment": "Malware payload", "value": "f1dc54b24f1256ba9287813d00221988646ba645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699793, "uuid": "2f69d1ae-5440-4491-a09a-0f108b9594d7", "comment": "Malware payload", "value": "6f12e92879380a8dd7b6a83699249b8cb90a0955b618f430e5f03ff8fb6eec67fea77a98f3c78de0a8681bef5d5569f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699793, "uuid": "1ba69c77-b7b6-40b6-930a-5c0ac25f66e0", "value": "T165E4E175732BA608DD7487F91C6AE1A27BBAA429225DC23C1F48C07DBD73B7C1AD0542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699793, "uuid": "0e840c2e-056f-4e58-848b-f3750e2d073d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699793, "uuid": "e8b8eef1-2d87-4d98-835f-333ae68693af", "value": "12288:GolyvUIZbVf9sVvRSWEFctglXW717OhtIt3U8HZ+gylpa7QmF2bW:1ovDBfWV0xFyglmtUUEgepa7QTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626699793, "uuid": "35613d6f-d2d1-4648-aa5c-a91ed0d12bb8", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626699793, "uuid": "0ab59b5c-1f40-4a6b-a058-af4cdd6ecb86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699793, "uuid": "d9b53420-461b-44d7-b824-c4cb40ef2f76", "value": "O0988374652635_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c80d0d3-e8a5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626708194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708194, "uuid": "6c516506-2574-47cf-81ad-9675c5756f6e", "comment": "Malware payload (AgentTesla)", "value": "3ebf5f673ea6b0c67163113b2023543c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708194, "uuid": "043fc793-384b-4c33-a068-5c2c8198f135", "comment": "Malware payload (AgentTesla)", "value": "cceb66dfe8d4e74b4f6ea988cb978e0438f29ffdb0923d7cb0590583fd31c46f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708194, "uuid": "1298a7d2-ac81-4f7e-bbd7-2f2c35a5fbcd", "comment": "Malware payload (AgentTesla)", "value": "2f9d9348e9884d05d88182e7c8a14b9bb4a4322a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708194, "uuid": "fa599413-77e7-4e33-a377-88a7a20936a5", "comment": "Malware payload (AgentTesla)", "value": "fe95c8d75bf9571cb97b3d56d810a580bf56f975bd3acf5572fe1f806384630a17af5402c73da53b40c7a65f1de700f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708194, "uuid": "82eceb72-d930-4fc6-9c98-12d0dc58374c", "value": "T10915F0711510D8A1C99B0EFD84B63BC86EA5EE77C3408EF4516B3C6DF8A26808BD91D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708194, "uuid": "d3d1a8ea-8c1d-4715-96c2-278bcade8184", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708194, "uuid": "d50bfb60-a703-40bf-a5f6-189a679616fa", "value": "24576:T/+MOQW87bhQxtVUCKeT+6bHcOTsi6uD0:z+rQQxtVUCDrci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708194, "uuid": "98bb8041-34d5-4f82-929d-f0b75d426b9a", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708194, "uuid": "50fb5686-8f3e-4fd2-92b1-4c4626af50de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708194, "uuid": "aace4b48-7599-4507-88bc-3b9cf38a2e9c", "value": "3ebf5f673ea6b0c67163113b2023543c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91d34d8-e837-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626661132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626661132, "uuid": "7c3e8877-8fad-4bf1-93cb-d9fe42f9caab", "comment": "Malware payload", "value": "c292df12ee6067765db8d94b81c7ce2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626661132, "uuid": "bdb336d6-951b-4bf7-81cb-a5cf32101198", "comment": "Malware payload", "value": "cd36c2fd2964a7c6a5c20dbf905e4e1bd28aa8e168f2fa50ff2891adcd5d1825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626661132, "uuid": "04699463-12f5-4a05-bde7-1e0f2e9d6b3f", "comment": "Malware payload", "value": "a8e75364d85c7fc255f3dfa235ad391a750fc069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626661132, "uuid": "9673898a-d6c2-4f9e-b213-eacba19b662f", "comment": "Malware payload", "value": "3650eb4c213581955f52f2cef3dad7a269359ee864ac4d9b4cf866a603de3205edb1d5a66a19aa89e9293dc84a662f75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626661132, "uuid": "72f02a37-d9b0-480c-9aa0-d2c8e60015ec", "value": "T1CB05E0663227A218CC3883F55C65D2B07BFE6C1A662DC2782EC8AD7F3D736785AC0545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626661132, "uuid": "be80699b-050b-4178-b710-9bd02ac5ae6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626661132, "uuid": "3a623e81-2ba4-4b04-93c3-fbcf886459a2", "value": "12288:r1AyvUIZbVlBPI2VBPJHRU+GYb2Gs+JrwZ+lvR7KCK+DE6UQr:dvDBlBPIOBP9qYSOrwZ+tR7Kvl6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626661132, "uuid": "51e5a9e6-2fbf-404b-9f34-3b005dc0bdc3", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626661132, "uuid": "941293c0-0868-4b80-8d5e-92330bae21a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626661132, "uuid": "2574d9ab-e2ee-4680-b712-72f12d9942e2", "value": "\uacac\uc801\uc11c\uac74 - NEOBLACK_RFQ074.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5181154-e855-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626674090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674090, "uuid": "cf8c399a-7653-432b-a933-55eff2d0f28d", "comment": "Malware payload (SnakeKeylogger)", "value": "2f24ed32a9d0e0a9060efff8422c0521", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674090, "uuid": "381d26b7-5b3a-476b-aac9-87f0f3bc2597", "comment": "Malware payload (SnakeKeylogger)", "value": "cd87994022445bf2097ea2ff491c084d5c323c54cdc8c6c5c97b026567227d77", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674090, "uuid": "24f63192-825d-48af-abb1-f8b97178451e", "comment": "Malware payload (SnakeKeylogger)", "value": "a648ce15d8a4dd2f0acaa438d84a95bd9f7dad47", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674090, "uuid": "026d65d8-5a35-42d6-abe4-d6b187fae8f1", "comment": "Malware payload (SnakeKeylogger)", "value": "f78fe59c7138b443a882f2a3428728614f84cd58c6547a4d9442a60617755aa8c2ec5a1f45b41fe55334d3b840c43927", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674090, "uuid": "d6a4ecc1-aef2-4bef-a588-3c0a04958015", "value": "T14F34226E031FE65809AAAB87D8CF7DF14689130EE7F8D6D31DF10D809C50DAB4264A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674090, "uuid": "5f5e08a1-39d6-41e6-82e8-aa78db00531e", "value": "6144:e4wRMFy/py30gSaRXmydG04podDLrVdZ1fL46xT:3wRMFQSZSaRWo4y/pLTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626674090, "uuid": "2cbabe3f-7346-4ecd-a0f9-962e94f7f450", "value": 244788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626674090, "uuid": "742015e1-96e4-4228-95c0-d542aae22338", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674090, "uuid": "00b094a1-c571-4e50-9464-9b6fbe35f2af", "value": "Quote.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392d5e9a-e86f-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1626684996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684996, "uuid": "f6d12310-0964-4c7b-a1c8-8f484f3eb20a", "comment": "Malware payload (TeamBot)", "value": "690f34d0cc11112bab173c2c864f911f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684996, "uuid": "4478e5cd-5084-4fd0-86d1-eb33624e53de", "comment": "Malware payload (TeamBot)", "value": "cda712d2d4c887e23f50f43223c218980731520b9111410cdffed78d32cabd98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684996, "uuid": "7fe91396-3474-4d37-8639-b1ea3f7de61f", "comment": "Malware payload (TeamBot)", "value": "ffb4dfe297715be9d974b8dab3d50f45203f34d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684996, "uuid": "128a10f5-5703-49ba-a4a7-2829f714b3a8", "comment": "Malware payload (TeamBot)", "value": "823cb94751899d5b9686e06b36bb1789848c683e47225a6260ac972e8b17d041a6b7f766b5305211a4fdb48a6bb68d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684996, "uuid": "315bf47c-b773-45e8-87d4-8447bb8fa2c9", "value": "T1C7F41220B281D973E6B0453464F4C2F4653FBDA61E3A099B6AA837DF1EA03D0667D742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684996, "uuid": "9ac05195-f8d0-4303-b09f-101a277b5dd7", "value": "b0fe27671bb60a5d31189716fdcf7690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684996, "uuid": "c9364a98-e52d-42f8-ba1e-7e0bc2658db0", "value": "12288:D92HorQdbxo5oipUJKIL8WWsDzFnQHvpY1Fb024NW8KYMTfZlujsmA/yw:D9OorMby55UH85IaHAFo24NWDwwyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626684996, "uuid": "3b14ebf4-59af-4b40-a35d-cdf14c8ac3c7", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626684996, "uuid": "e2a657e0-a6de-4331-9cbe-1a12c1854755", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684996, "uuid": "9307f526-952c-4022-bb44-52679ce775f8", "value": "690f34d0cc11112bab173c2c864f911f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d058e3e-e8a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626706853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706853, "uuid": "444988c4-b0f8-4a74-8d88-315d75632b0b", "comment": "Malware payload (Mirai)", "value": "7e813851d33e3fcf70ff68a8363c880d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706853, "uuid": "cb55e22a-f752-4a23-b1f2-0d0179e95dc9", "comment": "Malware payload (Mirai)", "value": "cee432dc98ab16fe238a59c066bcff4e7345b793e918215e1b5c55defad2eabd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706853, "uuid": "a7fcbbf8-d886-4597-9e1e-81f5c93e6f64", "comment": "Malware payload (Mirai)", "value": "53ccc13c62bbcbdcaf624a40b0454f0766e329eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626706853, "uuid": "cf0d3102-52c3-44d2-b22f-5959b0032c4f", "comment": "Malware payload (Mirai)", "value": "9eeaa677410a8487e6c9050551d8393732f29525184f2da434b8b03b09dcc0eb4201f01da168a84e1bceca3e5d196857", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626706853, "uuid": "9b411922-b55a-45b0-a0cf-e686ca0dc724", "value": "T17264F2CAFF11BC3AE985067539AB074DB7B4DA86C3C7E080F294C55E38AD285BB611D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626706853, "uuid": "fe7392ee-0c93-4fe5-a42b-7aae264f2331", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioaPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiMPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626706853, "uuid": "379e645f-6def-4d4e-8136-475faf1884da", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626706853, "uuid": "e6a860bb-1e5d-491d-8c07-6d61aa9245b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626706853, "uuid": "798371f1-3e34-41a5-807f-7fa1dead2247", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfce1d1-e864-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626680598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680598, "uuid": "1534809f-28cc-484a-829b-0c536fca7a5b", "comment": "Malware payload", "value": "b48a1b6628f1f941e506d15013a72619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680598, "uuid": "c044f409-8e08-4be5-9fda-8ae0b639fc58", "comment": "Malware payload", "value": "cf540119b481ff1a73efd8f50bc5942faaa46e79f9cb78d06b2b993ef4c921a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680598, "uuid": "0a032412-9170-4620-a452-d5d1f313dbfc", "comment": "Malware payload", "value": "4d6a9fb6ad5aa1b53440c2eb0806602fc164b0a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680598, "uuid": "30fe9415-42ac-4c33-bdca-2d43c8128890", "comment": "Malware payload", "value": "2854174f051ab6a4b711503edea34058210fd31af5097103f95369e4796c08fbf5a518d3a63e1f79ce151b86f19e240a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680598, "uuid": "8412c741-d3eb-4457-8c38-8da06a88b2d5", "value": "T19704D07A27DD5B4BDC61CABA3250B5E6A0445937290F581F933A148063ACBDE23FBD07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680598, "uuid": "878a118a-c6bc-4650-93f4-a1f8d24017df", "value": "8b9c7c9498a635f685c3b4d13969793b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680598, "uuid": "07fae68e-3e9c-4e15-94f7-09f6619aa7c4", "value": "3072:LizuMU66n2qcHf29Twf8uDiy88V2Sx5Ci8LBNaP08uxcRqqHq0cS0Gf3RMlyPrsD:lM+Me9cfBDiy8i20HunvxcRHqfGlov+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680598, "uuid": "5566704d-6745-4dd2-bbcd-03901e787c58", "value": 189375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680598, "uuid": "2eea99cc-e77c-4c9d-9c1c-6d7881fcde14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680598, "uuid": "34480969-304a-47c2-b9f1-af6808cd3f57", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa580bfc-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735866, "uuid": "1b9b1352-f5af-4279-add4-209af60c5714", "comment": "Malware payload (Mirai)", "value": "d208917e7e36882663bda2535b749f37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735866, "uuid": "bb97a094-e2ab-42be-8fb0-f4f84196cce5", "comment": "Malware payload (Mirai)", "value": "d06d2e31906bd52661ad9c78a040717251c1396087a4ed768ce8e65a75456f24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735866, "uuid": "3496d784-5144-4f36-81ab-81f4618decf0", "comment": "Malware payload (Mirai)", "value": "7bd5ad0475802a3b4fbdcbe80d1a07346126ba44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735866, "uuid": "5e1aa8a5-2ee0-493c-81fd-492cc93986b8", "comment": "Malware payload (Mirai)", "value": "b9c709438813f7052eeb30226da93b909d4e252a08e5d72e4a54f241a92dd27c77d02ec5a6f9fcc83a1b23d92fb6219a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735866, "uuid": "cec31c79-60c9-4af8-b575-3b72aa3a4791", "value": "T1F73329DAB402AD7CF99FEA7E80160E0AF221235510530B2B67BFFDD37E321549952E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735866, "uuid": "e49af0ba-d291-4c7d-8345-2840ac05b0cb", "value": "768:7MehvKgc46P1imWQc7/JgFHdIp8LujWeXzpUGRJTPOMdL88pIHk:QIK34GMmbBF28Sjp1UGRJbOMdw8Mk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735866, "uuid": "8b0f59e0-9ed4-4360-af98-5e19abacf9d5", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735866, "uuid": "85c1a7df-6e30-4905-be0e-cb1583dc1169", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735866, "uuid": "2288924f-bf5a-45a9-9473-7f23342b1867", "value": "d208917e7e36882663bda2535b749f37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb8161e-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Cryptbot)", "timestamp": 1626708736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708736, "uuid": "2d471f98-f4a1-4b9f-8b3a-9a1588b37021", "comment": "Malware payload (Cryptbot)", "value": "8ecd34ec6d7113125f8aa7d811068da7", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708736, "uuid": "4dd89938-38fd-4caf-8328-d0dd261cc095", "comment": "Malware payload (Cryptbot)", "value": "d0c2ffb2664b0757fa896299577579cb6bd7a7e9dd601e11c13efcc7b5879e2d", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708736, "uuid": "9e98a176-4941-4749-a567-9fcf8bd4a3c0", "comment": "Malware payload (Cryptbot)", "value": "7c1235168f940a977a7740f10e1e094fce4600a0", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708736, "uuid": "d127d40a-fa37-455e-95e2-c36640b5b287", "comment": "Malware payload (Cryptbot)", "value": "bcba62491ee660a918279b3168a6456ada58d2409fc5f73e8785c24b7b73d34f2c56cc9a59b51d229c789607a009009a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708736, "uuid": "af3aefc0-edbe-42da-b18b-be13d040e990", "value": "T1F1951242F293F838C592F2327A12EA7502E0AD23D61406C777D4EF5B79E1781B2E5636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708736, "uuid": "2ce23ee4-efbd-489a-82d2-605f4ed8fe36", "value": "bf6171d5e900bf93e668170d1a189f34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708736, "uuid": "ef1fce65-9b5b-49db-8542-22aafab53f70", "value": "49152:FIXQOaytd/QlJk3WQJjOiANo4NR5+FSP9:FIFPtd/QsWQRwmFSP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708736, "uuid": "aad5652c-a7ca-417a-8a14-1ce0d67399cd", "value": 1908530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708736, "uuid": "e3892196-b123-4516-bd9b-eab54c31fb31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708736, "uuid": "6d169050-f205-4579-9806-f962913e5366", "value": "8ecd34ec6d7113125f8aa7d811068da7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b906f4c5-e89c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626704538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704538, "uuid": "8c08c34e-01b6-4661-b50c-890c5df2bf23", "comment": "Malware payload (AgentTesla)", "value": "401937e7ab45fb7a6fc7e44a266576e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704538, "uuid": "e4dd20ed-a546-4df3-9c72-f62ad9f76ff1", "comment": "Malware payload (AgentTesla)", "value": "d0c624c824be16ad8dc2a5a55fad2667a93e23e022865d74f3d90fe78ee6fb00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704538, "uuid": "e892909b-365c-4495-9331-df8664af337f", "comment": "Malware payload (AgentTesla)", "value": "3bed12d3acd9c1d304e78672f52e2a2af0b848a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626704538, "uuid": "d8f4ffbe-e406-436c-9317-403f6699f240", "comment": "Malware payload (AgentTesla)", "value": "b022f561f57aec51bb6616853f869d1534c973011a41a6d8c907e113a05d6ee3a450ab7e11a9ee0fec795c5385100d0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704538, "uuid": "823a1ba6-ea88-403b-b893-24bc0e7bef94", "value": "T1E4F4262875855A5BC23297B3C5A5E372FEF00C566203DD0A0AD2FD973EB2603658DE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704538, "uuid": "7647cd8a-642f-45d6-bfd0-5cbe3e0ec318", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704538, "uuid": "2ced249b-6701-400f-a50c-862366287331", "value": "12288:BkZJuclbDigJ5pcc8MR7hE45ys4RC6uaA:BkZIvgJ0Mg45ys4RC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626704538, "uuid": "ad5b4dbd-c2e1-4340-904f-294a714edc70", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626704538, "uuid": "601f5ec6-32fe-49df-90b9-12c71bba4f37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626704538, "uuid": "7ac7dbf8-50a1-4f36-ac3d-693272a34313", "value": "MACHINE SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32fe260-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735881, "uuid": "9a598e21-43bc-4392-b46c-3f1e335eaf58", "comment": "Malware payload (Mirai)", "value": "21bb45a4143b321b771bb5f35eef9ee4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735881, "uuid": "1c69a9ef-df3f-47f6-9d6c-7bb57a7bf1c5", "comment": "Malware payload (Mirai)", "value": "d0fb9409fa4a402ce8ff585d0b4c7d7743089b2c061cb79e3cb54ec1f0b4dd27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735881, "uuid": "45c66cfd-e993-4ff3-8c6b-e2d4d46e4b3b", "comment": "Malware payload (Mirai)", "value": "2536675c5b189101ae956f10dc3062cb0f655ca6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735881, "uuid": "86817c71-54a1-48b6-832b-73e32b59b2f4", "comment": "Malware payload (Mirai)", "value": "0126310d90ce0efadf9f4c9e75d9c9e7cb631606390147d4ff0a6b9f0d0beb014d87e537c3c470b42ee19629fb056f5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735881, "uuid": "c23e676f-e139-49a2-b28e-561ae78e959d", "value": "T1B7C32A46EA408B13C5D61777FAAF414A3322DB54D3DB330689285BF43F87A5E0E57A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735881, "uuid": "b47cf100-607b-4a56-aacc-36777ce4f0ac", "value": "3072:IZMu4C+u2dLhLRE90bYK5h9T96NOK+5/YtM/9gM/:eMu4C+u+RfbYK5hb6f+5/AM/9gM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735881, "uuid": "a6326d36-2f17-42f6-8927-1cfc6b65943f", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735881, "uuid": "12a7fbdc-55f6-4438-8805-75e18de546cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735881, "uuid": "62d2b073-39a8-4fba-803c-76dba4187e59", "value": "21bb45a4143b321b771bb5f35eef9ee4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52254205-e8c4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626721545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626721545, "uuid": "b870e705-4788-44d2-b1af-da6eafc9fabe", "comment": "Malware payload (Loki)", "value": "5c95cf9a7973c9eed7b6fde4814a4b7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626721545, "uuid": "c5c624a9-78bd-4fe5-b806-3b7655440f67", "comment": "Malware payload (Loki)", "value": "d2403e6a7d524f652e38af89405a91abe3312b03b49e8ded8e826975d622ff3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626721545, "uuid": "637ac9a5-8958-4a08-84af-f838abf26686", "comment": "Malware payload (Loki)", "value": "b3d8feee0f5740777306abe2d30223e94f9fe312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626721545, "uuid": "098603b3-6644-4cb5-b0a5-0cc2c35886f5", "comment": "Malware payload (Loki)", "value": "37086eda86d0df329c8843a03b3295c6e82828414f788ada3cdfb3c9474e0ff7457d947590626f1091b7cade5763d081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626721545, "uuid": "e2b82729-4d38-4907-8433-0624760f2405", "value": "T183E4BF3342C40ADBD1B850B49C013601A6F58596B193EF623DE428DA71F97EE97F3A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626721545, "uuid": "5f939f00-df5e-4047-98e4-4f4b4e07e8a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626721545, "uuid": "0b4915bb-6a34-44c5-9598-93b2f1b3f5f9", "value": "12288:EOLIyRn0ivdVlCSFlp1383wsmC4VplYEiTnOPlGOz2APxQkQ0LcqkM:7IyiiJCSvfTR7VqnOf2yxQkQ0gqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626721545, "uuid": "37739d90-6fe0-4b21-8c3b-cc4411177e80", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626721545, "uuid": "3267587e-b8b0-484b-a1ff-812714062fbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626721545, "uuid": "e4ee390c-a6fc-47dd-8672-b215dd8dbf04", "value": "Document BL-ZXL RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4ed2ca-e83d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626663744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626663744, "uuid": "8a066b17-a417-4e67-9bc6-ac4a98ab6410", "comment": "Malware payload (Mirai)", "value": "ddb27ec3d631f11012baec8c7d569817", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626663744, "uuid": "91635042-0376-4124-9a3b-fb670bec7f3a", "comment": "Malware payload (Mirai)", "value": "d2f7cafa1255540984dd1f0a327b93792745403ea5402e0d5a11186f8f400d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626663744, "uuid": "7870b6b4-4738-4dc2-9fcc-5392f8fe9a68", "comment": "Malware payload (Mirai)", "value": "945068bc48d28cd0ca93e610132d5e53da35b3bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626663744, "uuid": "5b961fe7-f737-4b99-b059-58cf3fd3d904", "comment": "Malware payload (Mirai)", "value": "9acaa2fc58851a62e7830fcb7bf5ada0d0814e73ebb9e8b2a7d0ccfa5b818ac663c32e4b6abb2e9b9703dee8807a64ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626663744, "uuid": "947a634c-1578-4ae0-9cb1-20fe88d5e6db", "value": "T1CB03F1BC502B6435CAFD8EAA03D815FB73288D50951D3A9B3AC675339055D80BE57CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626663744, "uuid": "895a1514-9ba8-452d-90fe-25eeb1c7357a", "value": "768:w6s1r6zn2a+CQ6dSyNaAkaXX/ni0QvRyei8lMeLYgQO/s+FICYjP:w6sxeBQxOaAP/hzknQ0s+ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626663744, "uuid": "9c0eb208-0760-4a6e-8eb4-3994f023bbbe", "value": 39508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626663744, "uuid": "516aff31-d691-4636-bc04-0fa6157a6130", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626663744, "uuid": "f43039d3-ed21-43e5-b521-6928d8980739", "value": "ddb27ec3d631f11012baec8c7d569817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca159061-e870-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626685668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685668, "uuid": "9a24ff22-ec43-48dc-a385-dbaf84bcf934", "comment": "Malware payload", "value": "3cd8aa88a04bed66e00df1810933be1f", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685668, "uuid": "1d45a711-a7a1-46c7-856e-ded990e3d72d", "comment": "Malware payload", "value": "d342e759296da0a48f4cd087debfb1792e05233478c42a71a4aca5458cd2f1a5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685668, "uuid": "18de153d-cd9d-46bb-bb77-b6d07d348f9b", "comment": "Malware payload", "value": "d2adde33b411422b6bfe035285d3df72e666ff85", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685668, "uuid": "33d92f56-759a-4704-96db-6b7841cd88de", "comment": "Malware payload", "value": "3581211e45e2fbef1662bd3cc4350cc5a462d53bfeac74e7fc2c3c26bc70c9ca6f18b1ebd349f9d9419d948aacd721b6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685668, "uuid": "8f23a8a0-c85a-4508-9787-21eced4fbcfa", "value": "T157E423546D68EC9B41D300E81F3DBA101C0C3567FA221EE51AC7D6FCDE9DCFA8A5650A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685668, "uuid": "2011d0bc-8d95-47b0-a562-2768ff7a0dca", "value": "12288:VHxQR6bdcmykGNzsk0OQWfPcrthot1j4ESgmj/x1CDTmG5+AnFgjmfV:DQRZxd0rthQMgmlsDD5NnFgjmfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626685668, "uuid": "5732e3c6-8cff-49c8-a5f2-dd05ce5f5595", "value": 688292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626685668, "uuid": "5e4c5eac-9f70-42db-8f7a-2ec04bc385a6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685668, "uuid": "18555e89-f0b9-4f2e-a416-5df3205ab9fc", "value": "ORDER_683703789238738.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15875c0b-e827-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626654012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626654012, "uuid": "485932e4-8719-48dc-96e0-2ef3f4445a32", "comment": "Malware payload", "value": "ec079fbd394ed8838d2c8d062bbf1f39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626654012, "uuid": "a341395d-0aaf-4da7-907c-fdd9c6bdfeab", "comment": "Malware payload", "value": "d4318bfc9c962824b9254a8eecaa7f30c5e6cc3a209a6d8ef84395aeab2403b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626654012, "uuid": "3be27a83-5f13-4cb2-9b70-b45d61974edb", "comment": "Malware payload", "value": "2679b62510d9e8e14ec6c9aa3fc4950e9dc57a70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626654012, "uuid": "35fe82aa-a975-4227-9b62-e9f609a8fe35", "comment": "Malware payload", "value": "6de28ef7c3353d7a2dd413283f7ff22e8b0e147c96c07ad899dfc1d86d48caef5a38d7b6fac93b930022ec2d743a368d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626654012, "uuid": "fcdd2def-c64f-44d8-a86b-03fd55752832", "value": "T1F935CF027791C036FFAB92739B5AF21556BD7D290123852F13982DB9BDB01B1233E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626654012, "uuid": "6dc9492f-08ba-447f-a89b-3cf4696f2f67", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626654012, "uuid": "83432cd4-72d3-4063-8bd1-54a764e6443a", "value": "24576:5AHnh+eWsN3skA4RV1Hom2KXMmHaIggWY5GLSZT5:Ah+ZkldoPK8YafgS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626654012, "uuid": "f1b099ff-f0a4-4454-91b3-fbd88eb20a2b", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626654012, "uuid": "000b724e-a746-403f-b9e8-009c839a3d59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626654012, "uuid": "50586b7e-76a7-4d79-ae2c-1fcbf52d1c97", "value": "ec079fbd394ed8838d2c8d062bbf1f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d2a2b1-e859-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626675811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675811, "uuid": "34de38f6-0aae-4e9b-9933-138b2d21de3c", "comment": "Malware payload", "value": "f9d6e26834fc3e91bb29e9c4798761f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675811, "uuid": "1885cefe-c613-43aa-85df-ce490edaed6a", "comment": "Malware payload", "value": "d53f59caafca90c195a69426b840649a3f7c2b864b952c517b1360f515d0a970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675811, "uuid": "70303239-3a35-4f87-8bce-d9b032ff37bb", "comment": "Malware payload", "value": "2d99394935f0dfc7e74485bebbc8715ebd337382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675811, "uuid": "4a47bbcb-2301-4b0f-84d8-49b9c567a8c9", "comment": "Malware payload", "value": "f0b9bf964605ae1fed75f9d5f53531d032c573eec4617cad617652e63a66f83e02f2d3be185ded33a024bbee508b2659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675811, "uuid": "941e9140-b723-4dcd-bec9-28e86a3f4f49", "value": "T156250E3E6AA42A27B777D2244681C015F8BC81DB3A395DD742C7698C350E9027EE7F2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675811, "uuid": "85468b35-5892-4d60-a36c-93c143abac6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675811, "uuid": "e78815d9-bc4b-490c-b0a5-15e07c75785d", "value": "12288:ESuxZ0EG3KQyTs4XlhyI/vbUtNEg6c2NLJiBoHERse/fE6M/krccM0t:ES3T2NgBosR/fE6M/k4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675811, "uuid": "19e51ed2-d0dc-43de-86ff-573202f0180b", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675811, "uuid": "507bc6d6-611f-4018-b63b-e38e8b61ec56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675811, "uuid": "bb894bf3-de61-4ec5-b294-ecacee5ea0e5", "value": "S006992820034643.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3877fa83-e871-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626685854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685854, "uuid": "4610508f-bbd5-4733-bf5c-cd0dabcb97ea", "comment": "Malware payload (AsyncRAT)", "value": "9aea1f9f06bee7f0778d18685669041a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685854, "uuid": "1c09ad92-7125-4f46-b263-0f86eeca9f25", "comment": "Malware payload (AsyncRAT)", "value": "d642eb17671f269eddc3d1045845374a45eda0a7c3fd197d8b7f6a3355ba01d6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685854, "uuid": "d13b9267-020b-4279-839f-e0808fdcab5f", "comment": "Malware payload (AsyncRAT)", "value": "a4fd70c0eca2846d0425656a7a8f9f928c82d718", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626685854, "uuid": "c8b97d72-c3da-44e6-ac39-03db9f825ba3", "comment": "Malware payload (AsyncRAT)", "value": "a19fb46b22cfecb3a5f80e08c94ce0ddfb63bd267632d6273c6760320a739278fe3c2ae28a2fed0cbaf3f32cae6bc8aa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685854, "uuid": "460daf01-3dfd-41a4-8d92-28d066581123", "value": "T12D130A1A1491B118D5E709705D23FC703F68DB365890D60EE462564CCF82AFEB8EDEEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685854, "uuid": "9a1339ae-4d6e-439e-a2f4-02ac118a0c3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685854, "uuid": "c67df0df-3261-4780-836b-13cabddf8548", "value": "768:3MRrl3ZhEuewL4Fr7wIkkTkAWS0JkmoA2XTjK/A:8KhJ7wQFWzkmsjO/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626685854, "uuid": "adb2150a-b203-4b3b-97cd-4851e7cd07d1", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626685854, "uuid": "c7c0cd13-c126-422b-9f6e-6a8e94294264", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626685854, "uuid": "d33ce3fc-bd34-4bb6-916e-dbf58c8e6b86", "value": "9AEA1F9F06BEE7F0778D18685669041A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944273f7-e855-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626673982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673982, "uuid": "d67c92b6-5ead-4afb-9a88-11b06b3d76b6", "comment": "Malware payload", "value": "0f4b98f40808bac5804b6eb8d95771d4", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673982, "uuid": "3119786d-c892-4e20-8dbb-a1bde0b7dbcd", "comment": "Malware payload", "value": "d7151920849dd1270baa5fcd224f201158b553623f27421be29885e4c17badd4", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673982, "uuid": "4721fdcc-e3e8-4b65-88c6-59a77cbfebb4", "comment": "Malware payload", "value": "9427a6acdb264d41b5ff117f2b374aaaab2facba", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626673982, "uuid": "0e0df6c3-8845-44c7-979d-78d2a0d04f6d", "comment": "Malware payload", "value": "60f8968a9bfd31b94b0ca952ffef9e7ffb773ae76f0786d14e5dde6cfdaa3141ac83820e3b357f4d9b6215603702a681", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673982, "uuid": "6f71e5d3-3d08-4ef3-ab49-ad7d5c7b2c8a", "value": "T18052E143FEFC94FC4889F8B49C4E472095E6A2D07B31A7B4B887B5AD170E2984868444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673982, "uuid": "5d1154b4-a388-40d9-82ec-22946e8fa35a", "value": "384:gF7krh8TKK22KTd4Q7MA1Jja0Y9+6UfW3gfvv0:gF7krh8TKyTA1xa0Y9+Myv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626673982, "uuid": "1106bb3c-34cd-4e89-87c8-0c87d620de20", "value": 14216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626673982, "uuid": "5b62eb3f-6ad9-4a0c-b5e2-fb12497bf282", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626673982, "uuid": "0f5af4cd-1e0d-40aa-8b74-4b77efc4b224", "value": "3278_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f453be58-e891-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626699913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699913, "uuid": "c612e71f-5cbf-481d-a585-804dc05541cc", "comment": "Malware payload", "value": "296968fa478ce8b4832446c33afc37a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699913, "uuid": "8a42e09d-d487-415a-9667-26ca7aa17a6a", "comment": "Malware payload", "value": "d7854719c33f72a1afa0c562bdf44a8941b4017fbe90a215636aad91d1bf4f10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699913, "uuid": "97240e2c-3629-4e6c-8698-dc9497fbce7e", "comment": "Malware payload", "value": "b8331521ad1beb8814c5b50d9e16430440bb2947", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699913, "uuid": "289eca50-8a7a-448f-8f0f-aa67d58f9dab", "comment": "Malware payload", "value": "fe163bca632dabb02e569a66380bdc691b72db66281dc1fbf390e01d46073b1f8a08cd5a41f28b112353196ef3a7d914", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699913, "uuid": "0e60f816-febf-4367-9b5c-bd811eae2cfb", "value": "T12843C91465BFC02AD0E3EA716DED98BAC9AA65E3140CB53B01B4733B4B51B80CE4F179", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699913, "uuid": "1daa97a7-9a12-4063-841d-52831fcfbd34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699913, "uuid": "32f44445-8ea2-4ad4-8c56-46754b049ef3", "value": "1536:0TUwiw4WKvIjwroCRkxlfjNVDxdcA3qJ7:0TUwiAKwmoCWjgJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626699913, "uuid": "47cd0954-9d95-44c7-97bb-2e6043a88884", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626699913, "uuid": "d82551dc-827e-4b07-8e49-022146a81057", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699913, "uuid": "2a4f38ea-e84c-42dc-918b-cc4f1f3fc58f", "value": "296968fa478ce8b4832446c33afc37a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba599a0-e8c0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626719923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719923, "uuid": "d64f783f-a7b5-4ffc-9c8c-6cd2d8086aee", "comment": "Malware payload (RedLineStealer)", "value": "6a3a3a2ee332b4a6721ad1a740dfb38e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719923, "uuid": "c809e614-723a-473d-a6b8-7f9d88351dd6", "comment": "Malware payload (RedLineStealer)", "value": "d9809aabb95118f13e57197b878c992467931452027b70fda744c4579c5e1938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719923, "uuid": "771519b5-2c50-481e-8bdd-ba2b03a3d4cf", "comment": "Malware payload (RedLineStealer)", "value": "542e12a8fe4033b25f81494c0bdc2519d4c0c4e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626719923, "uuid": "5df48feb-710a-4c3a-a9e1-a88da14ed2c1", "comment": "Malware payload (RedLineStealer)", "value": "67e617141004b118b85870ba887462c9d64ba1cdfba4e463aaa8aa1b2f2d52a88349fb607d53f27c78298a7602bc6a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719923, "uuid": "ba2bb13d-3cb0-4746-9b01-c4b7872ceab9", "value": "T10AA5E0E75547E4DAD8F61E7ECB3ED730B9EF8FEC68164E1185AB21E740588432022C99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719923, "uuid": "799a9bb1-dc1c-43ec-a572-da2520932b33", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719923, "uuid": "93b7f5ef-cb70-49db-b3df-e80bcc139499", "value": "24576:GNyQ4A3N13YsdGAFW52vfSHqn30lCpPOpAGp0r3Nl/VpDJBW5/v9/6tBKxKGadzW:eB7gaw2H0qn3Epel9p1g5/v9/6LluaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626719923, "uuid": "df789960-a08f-4cc2-a84f-8f8bf07da899", "value": 2248096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626719923, "uuid": "e15b5449-873f-48ca-9361-165d108010f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626719923, "uuid": "9e7752a8-bef6-4881-ad65-9afee53dc8d0", "value": "RedFlame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128f8f20-e87e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626691373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626691373, "uuid": "30bbbfeb-d768-40a4-84fc-c01b5a321fe8", "comment": "Malware payload", "value": "c59677e174a469869400d73ef00bb6e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626691373, "uuid": "8f1e5783-49c3-4170-b2fe-3a306d9770f1", "comment": "Malware payload", "value": "dc2768ccfc25f2dc8a57db7a9c9ddd4532fc6044ffd9419c96cdf6e0251e7823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626691373, "uuid": "b1ffa880-9925-41e8-a697-d079e0aa9e46", "comment": "Malware payload", "value": "c5dd150a844d4f51c18629948def7e7cb6c1452d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626691373, "uuid": "a1241bbc-39e6-43f1-aa4e-ec508e2b3946", "comment": "Malware payload", "value": "a56f29b465d74dd8dc23340728748d11f2c590022331b7caeb6311ed2f56bd68b4a6f3067cb90c2db5cd43ebcfd99d0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626691373, "uuid": "2fc0088b-343a-47af-be17-154162b8bf12", "value": "T19F059D157300BBAAE55A0E3A843F8D1493E48E23B673FA8F6CE03AD14571F958B1F156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626691373, "uuid": "75970b41-03bc-4cb9-bd4a-529cb8749710", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626691373, "uuid": "f07e888e-6db6-4f3d-b8a3-a19d45fbdba2", "value": "12288:3hqHZDOlvbYO5rozarJNaOgKJfcgA2/RQDiVISCG2PeQU7:Rq5uvbYOVXH2L0RyiaSC5eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626691373, "uuid": "f524e08e-5a0b-4539-9d84-3ada3a032ee0", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626691373, "uuid": "81ca8245-c7fc-4436-b6ac-ab28d5740b06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626691373, "uuid": "bc01e733-e9d7-46c1-9bf4-0fd691b05b45", "value": "Nuovo ordine .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f31e01e-e897-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626702266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702266, "uuid": "87db9976-6bf6-4546-8aad-95f1d24b9ecc", "comment": "Malware payload", "value": "dafc7e7f07e95a22a1e8301da708d44d", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702266, "uuid": "d8b9733c-11b0-480e-9664-afca630bf7a9", "comment": "Malware payload", "value": "dee5d35a7dca5065914af0c90a1d420c6e94fbd50b29af715552b8685e6e8245", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702266, "uuid": "e86c3c44-6d1f-4ab6-af1a-c703916735f8", "comment": "Malware payload", "value": "3a0d48506fc177f894449c23589c1f7d9ea39508", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626702266, "uuid": "8c7f7a9a-d033-45f8-8e03-f21675eafe57", "comment": "Malware payload", "value": "e74e66113ecbfbd007df4f7781dee61e96aab42d5b789d7a1e11446736d59f4c790406cabab6f9659c951727c4d96130", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626702266, "uuid": "432e1588-6c08-4c18-8a6a-5627fb4920d1", "value": "T15F851215A206FC33CBFA1EF55F26A495952A27CB0401DA1B7BD406888E39DA9373C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626702266, "uuid": "271fed61-2cf6-42ce-8379-890164e6e32e", "value": "24576:FiN8Oo98aLLFy1VCLyG4/REA/lo4bvSZPc+tVMHFBMUoUNNjVWIX41Xp/P7tFo7t:FidO8aLxyDF/Rdo47SZPxe7MV8/G7YB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626702266, "uuid": "a1b8281e-9aa1-4ca9-a3c4-63f9a9ac6b67", "value": 1733283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626702266, "uuid": "ec685ca1-92f3-4a94-baec-f4829f6a0d42", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626702266, "uuid": "f3a190a8-435c-49f3-92c0-066e63a1f18b", "value": "log33.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f960092-e859-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626675477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675477, "uuid": "5f82b470-f9cc-4b8b-a3d8-629d0751f5fe", "comment": "Malware payload", "value": "e5f10abaeca1aeddda85263bbbfea140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675477, "uuid": "957f87e2-7330-4c3a-b2c3-44e02f2ab782", "comment": "Malware payload", "value": "deee0cbc7926b3bf60ae6071e6dc4233162cbfa125c649eb3979db7da100fa69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675477, "uuid": "4ffe5899-e3e3-4068-b987-6335aa716a0a", "comment": "Malware payload", "value": "cc02a52e9f17c24b283deea5fafa883baeb89632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675477, "uuid": "f1ea3972-7e2d-44f2-809a-edfcb1d45806", "comment": "Malware payload", "value": "e14605ef8fbada88725795f7960766721cf784073c29e365a8722e94cad667d8f28d37a5a3b67b834e85406ae82dc892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675477, "uuid": "57237d43-24eb-4436-ad61-6140d569bc4c", "value": "T1F4059D9C3240799EC4378E338994ECB1F6902C665707DA0358E77DAFBABC6579F110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675477, "uuid": "00be9798-9162-4e27-b0b5-f30ce7194131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675477, "uuid": "debc24d1-fc51-4f3c-8429-6463b7f8cffe", "value": "12288:hsbPBZ/yDrTpxYz9TO9+CrN3RVdhVJ0//VhJv/H8DRPugvJ:S7BZ/GrFk9TQjrNNhVJ0//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675477, "uuid": "4de88e77-961b-4087-8951-227756698d99", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675477, "uuid": "d83d76d4-752c-486b-9c61-5574ec482c56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675477, "uuid": "c66c38d9-33cc-4d61-b18a-ede3fcac03ab", "value": "0tSAeyf3wSuqkzT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba946d5-e880-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626692436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692436, "uuid": "d355ca09-caa3-4663-80bc-5b19edf42b26", "comment": "Malware payload (Mirai)", "value": "55156cb4df8f8654d608474ecafc0d9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692436, "uuid": "fa66a2c6-8d0c-48ab-8621-a456a95777b1", "comment": "Malware payload (Mirai)", "value": "e0340bfb488c525538588a5f7829b4fb5f1458ca77f0ddc2c820f16f1cbafe01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692436, "uuid": "1b7b7541-d50a-4d89-a51d-a5600875aecd", "comment": "Malware payload (Mirai)", "value": "45e1d54d17c70ae0e00a5c83734733a042165fd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692436, "uuid": "c36a5ee9-6bd9-43c1-af6c-69532f3a35e5", "comment": "Malware payload (Mirai)", "value": "9105d4b5394013cf444547431931ac339ed8d20da7f88f800db981fdbb58de409c10990091e9e25899bf51341e2ce36c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626692436, "uuid": "165a1748-5fdc-4872-99e9-6e4b71a8c3b3", "value": "T141131845BCD1C517C6D4237AFA1E12CD372663ACE2DE32039D266F62778B92E0E76111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626692436, "uuid": "8813bfc6-49a4-4091-84dd-fc224c393662", "value": "768:RvkRUU5UuTNrHseLgdKqw1cSNEcX+lqay9CtMD+9Pj5iLiv4vpTFRm6zU8:2RFtNgdKqqEculTyH+Vapxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626692436, "uuid": "1df4f77b-7121-435e-971c-f819687148db", "value": 42344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626692436, "uuid": "daa80f4b-89c3-4f4b-9e92-99d79e000a0f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626692436, "uuid": "ad2750a2-0dfd-4084-95a5-04e72d6bd8b7", "value": "55156cb4df8f8654d608474ecafc0d9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab686a8f-e840-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626665001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665001, "uuid": "63dc23f3-9295-4cdd-8273-3bd8be0642d3", "comment": "Malware payload (Mirai)", "value": "bf4a6ae3992bd931261e5323bb660caa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665001, "uuid": "f1190ba0-89ac-4dc9-ad91-70093e5e63c3", "comment": "Malware payload (Mirai)", "value": "e0d23ce906c8e8e3b6fca84d8e5622c4e9cf8ef62db6febd142a1b5f2ddb7153", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665001, "uuid": "a4d96f9d-9ce5-46b0-b007-5d0c4f11760a", "comment": "Malware payload (Mirai)", "value": "74ad0cd356eb00c04aff418a53f31a9c64533e6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626665001, "uuid": "0fa9bce9-42ec-4b67-84c6-f27c7eda21f0", "comment": "Malware payload (Mirai)", "value": "7d871020445b00ddf990cea927f2bd8c2ab5fcaad53e07216447c3cab9ed9cf220b4cd123d4ee7513f9ac7981282a949", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665001, "uuid": "92fe739c-0d1f-40a8-a420-b8860d496cce", "value": "T18483AFA6F520AE50D085433070F5DF380B73A6C596531EBBA69046B2544FEBCB61AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665001, "uuid": "b98d9cd2-ab33-4972-b8cf-fb8b8bf5b20f", "value": "1536:qa5/JPP6KQYsjwDvXxfYh2UKTl2r0aWqt8vRBCXs6m2ca10Wn:quJij2veqkrTWqt8vRBlID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626665001, "uuid": "743fb052-7bbf-4837-98eb-b044763f1023", "value": 84572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626665001, "uuid": "c38e3b02-1e72-4abc-931e-5d3a1cf81cb7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626665001, "uuid": "6e248df2-4224-4191-8d3a-ba3ba4bd04d1", "value": "bf4a6ae3992bd931261e5323bb660caa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca0b119-e892-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626700276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700276, "uuid": "5c83a336-3648-45fd-954c-d2ad19cf6a19", "comment": "Malware payload (AgentTesla)", "value": "e0d0cb54cb7a414240d3541ab98c5ada", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700276, "uuid": "aa2edcc2-3b25-4d93-b6db-44369c3925ad", "comment": "Malware payload (AgentTesla)", "value": "e18a890697a25ee3b0954c15463e17a4ec515428359c5040f603758cc01c3cea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700276, "uuid": "9201e9af-38ad-4502-a937-a62793e0ed3f", "comment": "Malware payload (AgentTesla)", "value": "2da36044c25cde92f75e838a83929ee56ed192b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700276, "uuid": "236becb7-485f-4f5b-8de9-09eced8260d8", "comment": "Malware payload (AgentTesla)", "value": "65d1a9defe556b5b0bdce205966a2abd0476c8e356809add6407db1bdd8e202fb02b0e7df936d1101dc303d6f93d51fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700276, "uuid": "f29061cd-1c30-4d69-a86b-94b8363c0622", "value": "T1E715F1267217A114CC38C7F91C68C1B12BBEAC2A526DC6782DC8ED7F7D736785AD4181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700276, "uuid": "0d6c8606-ede5-438e-814d-77cef0b4dac5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700276, "uuid": "55a8063b-fbba-4175-b6c5-a22463b0856d", "value": "24576:Y/vDBlBPIOBPl8tiluNJmQf8bqMjPym/8FA/obgYE2lr:YDpPDPl88uNQQf8vLATEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626700276, "uuid": "36cb10b7-629c-4593-82d3-5d5dca327576", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626700276, "uuid": "00cb5821-7f8f-41f8-8aef-ba2e5f9b9098", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700276, "uuid": "8f51c7b6-7125-4e0f-adad-cdc70da0609a", "value": "New order 0007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6d2c94-e824-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626652819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652819, "uuid": "c99a2d57-05c3-47e5-8e5d-f445e39d394e", "comment": "Malware payload", "value": "4959813eb191a14be4cd70c59d1e5e52", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652819, "uuid": "c9cfeb70-f4e1-44dd-a494-5e61affb049b", "comment": "Malware payload", "value": "e1aa59e71808b80afaeb4a1b8079ebc903465e977b0c48171102565f40a8cf2e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652819, "uuid": "a476802c-c429-4760-ae08-0653d74ce018", "comment": "Malware payload", "value": "d0e1be7cb026acdb64638c1e9594513ba5c032a7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626652819, "uuid": "a6bf9c61-fa56-48d4-9b01-1382804b0902", "comment": "Malware payload", "value": "f90e371898bd599260b984f231387f11411fc15d3c875bb36828be4bb400ff1f245ad7dc01b7c55082d53d276579f2ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652819, "uuid": "9c7a734e-8f69-4aa1-ba87-bd054f86238e", "value": "T16514198AFD81AF5585C127BBFE2E418A331317B8D2EE71129D145F2873CA94F0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652819, "uuid": "6d202806-91bc-411e-bb08-30011300704f", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsM:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626652819, "uuid": "0d0f44d6-2fe4-46aa-a9b1-463c0e29453a", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626652819, "uuid": "11c4a091-4ef0-41ac-b280-25b7349ce507", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626652819, "uuid": "a4e6980e-f8cf-428b-93c2-d2c2a64b32f8", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5cd738-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626708761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708761, "uuid": "7a39808e-bb87-4739-a515-d7dcea5e2cf5", "comment": "Malware payload (Loki)", "value": "ebdcd542d311ee721820a54a925859a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708761, "uuid": "d6a87c5c-3f2b-4792-a979-6c0973e09d6e", "comment": "Malware payload (Loki)", "value": "e38f60c9ff210681232148c43db51f11967e6360940b50a646c8edb472fb1c42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708761, "uuid": "b9a69355-996e-4f46-a95b-1d331843683d", "comment": "Malware payload (Loki)", "value": "2de6f6457960d71183bd9f3c05626e3533112742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708761, "uuid": "7765023a-7a02-4c56-9352-1fc32bf7bab6", "comment": "Malware payload (Loki)", "value": "cbf4498e73769b1719994d5c7e0681f017b68d284c46897642cb8353cd5939864a471271d9d0c39b29874f02fc7312f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708761, "uuid": "c77ba843-bd29-46c4-bdbc-6dab7bfda508", "value": "T15D15F1257227A204DC3887F51C68D1F02BBA6C2A562CC7786DC8AD7F7DB367C5AD0681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708761, "uuid": "f23c769d-dd7d-4e71-b192-d14549801341", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708761, "uuid": "0b5c033c-29e9-4a97-9317-5e6e3a2d52fc", "value": "12288:wmZyvUIZbVlBPI2VBPvYz9KTC4jtMu6nzz8tWg23aic/7M+Qe:gvDBlBPIOBPvYz54j+u6ncQghie7M+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708761, "uuid": "a77cd6dc-675a-4c3e-b61e-11913fbc4ede", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708761, "uuid": "b3974f65-3a83-4619-a7ec-aa7512d7919e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708761, "uuid": "06d66857-4ed6-4e15-877a-d921e87c1617", "value": "ebdcd542d311ee721820a54a925859a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952c659c-e844-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626666682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626666682, "uuid": "017c7971-1a91-4b41-bf92-e78d5ea57175", "comment": "Malware payload (DCRat)", "value": "d2bf3e6790adcdd2d33c9e2edb0c4f5a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626666682, "uuid": "07a90bf2-b1ad-4348-b4a1-482eb3091f30", "comment": "Malware payload (DCRat)", "value": "e3df75eda0f3fff88f4ab98a687f7ec50b1adde27dbb1bb0947f96892eebf493", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626666682, "uuid": "9e6b0d09-0805-4187-a937-77f58dbb7f5b", "comment": "Malware payload (DCRat)", "value": "e46b5dbf060cd08999adce8d0a3125adcb8a82fc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626666682, "uuid": "baabe0b2-6495-4153-91b3-1298a13df202", "comment": "Malware payload (DCRat)", "value": "9dd005cb10b304e51b656357af2257b5d324de471206c6b9567f3f9ac8ee710d38eb6ec885614b58bc4e86126d4812d3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626666682, "uuid": "c6b30df8-8f33-4ab6-a848-6f83e8d6da83", "value": "T131852302F841A871C5721E305979BA61653DBB201F15CDDFE7E81EADEA340E0B335AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626666682, "uuid": "136c3553-ce33-45f7-b860-19843724b777", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626666682, "uuid": "8f9d443c-6839-44ed-9f61-0358a82dcbef", "value": "24576:22G/nvxW3Wzt0Mz7/JGxk9k+JbTY/X5IarO9H5oyOgQ8BrpFrZ5QYf3GSIMGW1sm:2bA3Ybz7/JbqF/XPOp5oH8fFfaWOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626666682, "uuid": "7954ddd8-b546-4200-828e-f6c65f4dba6a", "value": 1818072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626666682, "uuid": "58136a62-94e7-4402-9f55-397388081b0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626666682, "uuid": "7850ef95-aa04-40b5-a297-73ac04f14659", "value": "D2BF3E6790ADCDD2D33C9E2EDB0C4F5A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f6daf9-e88b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626696966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696966, "uuid": "851c7948-9252-45e6-aede-739b98e645d5", "comment": "Malware payload", "value": "adb42bae8d1ab779c2fb58a47115b73e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696966, "uuid": "c8b2fedc-750f-4ad4-bca5-3badc4eee639", "comment": "Malware payload", "value": "e49a72aa3870171309d3e0eb09d4bdc03e65d98dfa9c0ef87eb7cfcd97c7c910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696966, "uuid": "ab598d42-6793-486b-878d-812c6a813491", "comment": "Malware payload", "value": "315ea1f3a6648be932c542538ae6b9756164274e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696966, "uuid": "918a1e9d-842d-4563-90f8-6d8fee4f5263", "comment": "Malware payload", "value": "1f678e57cd251e9b5ef2d32872bde357e3bb901a70ca490bfae2eae075e80d5a60e94a7cf75b20ec147422b0059bcc11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696966, "uuid": "40c23be9-7a13-4e57-95f4-d25be74bffa2", "value": "T1BE358D88B140759DCC278B328975DC71A2627CB95637D80E18DF3D7B7FBE6839A110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696966, "uuid": "f4f7f93f-9550-452a-8e6c-4555a848982f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696966, "uuid": "fda340d4-38e2-45a5-9a4b-b5d83fedcbb2", "value": "12288:30il3Nla2ZNVZjH18f+TdeS9U+srClsf9aqG60Y7DmjWpA4XHfZzyfP7r9r/+pph:Er2ZB6Ud99jsrCK1axQ6jN1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696966, "uuid": "d353303e-bb5f-4721-aa03-53188be3ebbf", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696966, "uuid": "6c499612-31fe-497a-b3f7-ab4aab88a303", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696966, "uuid": "3b042bd3-4919-45ca-aeb6-2716b48d6613", "value": "Sale Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e4f64d-e885-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626694729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626694729, "uuid": "96c517e1-beaf-49cd-ace8-518b092954c0", "comment": "Malware payload (RaccoonStealer)", "value": "6d0dc4f594960fc810a0080c8f307bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626694729, "uuid": "10490ae4-e845-43a2-83a8-b6a808f28e97", "comment": "Malware payload (RaccoonStealer)", "value": "e4d1670d1785eabdda12d45ee5c32c185863e1f3d049424a8c616a062659cb50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626694729, "uuid": "0465694a-e718-405e-a37a-c023f3a4ed44", "comment": "Malware payload (RaccoonStealer)", "value": "e905c00a001706e3b4e104d9b16669156b240692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626694729, "uuid": "f7ac6795-f9d9-4681-9a47-ebde39dec8d2", "comment": "Malware payload (RaccoonStealer)", "value": "1bc4915e08c6ed9428e3b5cc57bf96bcbe5faa807822c6135a8ab32d668642d1b4e6d36f8ddecf6273819c200678035a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626694729, "uuid": "af51495b-4c78-4bf7-accd-a8c82664335a", "value": "T1EBA40110B891C436EBB6893049F5C6B1A63FBD659D7B910B328D6ACF1E321C2587D346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626694729, "uuid": "a26e6907-494e-4b36-b0c4-5d1e00076e04", "value": "d0200a61185e5e47748a9fc60359c3ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626694729, "uuid": "db0a15b3-d63b-4348-8253-3a14d53bc2c4", "value": "6144:Vn/1kEyZPj1qAebHAXNVCHcqVfgGLZVOtCXI63sijVyr/utD8O+1odODmO7jLyXM:VYSbg7CnYIct7jicrWtD8O8odIp73y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626694729, "uuid": "f20906c8-3fd6-46e9-b44d-a6e4a3251f44", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626694729, "uuid": "1072d07c-e4d5-4ed2-860d-08ebe86e4b97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626694729, "uuid": "4039a155-5cd8-45a2-8390-bbf0a2feb3df", "value": "SecuriteInfo.com.W32.AIDetect.malware2.30103.19620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0325e86-e888-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626695987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626695987, "uuid": "0bace791-c462-403e-846c-4a9d955e895a", "comment": "Malware payload", "value": "b56980d49b6f899a1549623f62b84ce9", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626695987, "uuid": "b393ef6f-e95e-4108-bdae-ddfda14a1980", "comment": "Malware payload", "value": "e97784f9b36934b0ff9c6311ba87b595d7966a02fb304db24ab947d03ae4d4ce", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626695987, "uuid": "c25fc2f2-1f0b-45b2-a10e-076d433ce337", "comment": "Malware payload", "value": "d1ad78bccdd9718a8bbdc67fbef7c625082aecf6", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626695987, "uuid": "4eeb6e5e-b513-4432-b754-40ef34ab43f7", "comment": "Malware payload", "value": "b0e4c72e6bfff37225a28a71430ec565290ca6f50e6396e4669b123f4861d8df2d9ff0ba8d63187a708b7a1e867b2809", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626695987, "uuid": "620aef12-cd2e-445c-8c10-858a5b92fba8", "value": "T164F0A365DF547689D84C1133C1435F0516DC365E5F5892B173E5F10C54744A47FAE075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626695987, "uuid": "a3d4c339-98fc-4196-89af-2ddd489fb356", "value": "12:8rfl3OB+Dh4dWfs6xuxxDkbJP/oKxXbA70OrH8xGteJRO98+M:8HDhL0xJsR/X80OrcVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626695987, "uuid": "40e1a516-440d-40d8-bc99-7c1bfd3cdc11", "value": 538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626695987, "uuid": "876dca1f-3369-4625-9b5f-7c491bfebdb4", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626695987, "uuid": "ff986e76-ae23-424f-b0eb-de037548b512", "value": "banload.LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd89fec-e8d0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626726745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626726745, "uuid": "5f57b1ee-fadf-4e59-ba77-eb41ed42781e", "comment": "Malware payload (Loki)", "value": "0c89a6ac4ceb310ad34dcf92ec3a77bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626726745, "uuid": "2158b731-9518-4531-b07f-cb680527b9a4", "comment": "Malware payload (Loki)", "value": "e97a4942254a12b854161a49aa1921910d93d2ea2d6af2f2ed771d7ed7d70bad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626726745, "uuid": "797d4332-0107-45ac-b0a5-4951423dc898", "comment": "Malware payload (Loki)", "value": "d02c76c33f136c2fe3e3c1c232d64ecd2b2c0f1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626726745, "uuid": "bf441ef5-2f93-487e-8eb5-add8e6b4f301", "comment": "Malware payload (Loki)", "value": "22c9cdf0eb03a7ce732d602daf246bed476d4a7181560a41ec2002dd5b6ed38417a5562c8acbefb679f62ebaa1f71b84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626726745, "uuid": "52d2efb0-1c50-4be9-a265-08c0bfedd486", "value": "T13EC4E079722BA208DC348BF91C79E5A277BFA02A661DC63C1E48C13DBD7277C1AD0552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626726745, "uuid": "1d4412bd-269e-4479-b933-fc045d75485c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626726745, "uuid": "f8ac73fb-fd9b-4935-bb04-aa190b7be844", "value": "12288:mdtWyvUIZbVedKiGL+CZSgTX9JDtBN6iv8EqMS4/d3h760:4PvDBedUrVTnDtbTvOMrh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626726745, "uuid": "73ca88ad-31e7-49d0-9f4d-dde36485d37e", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626726745, "uuid": "f2909b18-9ef7-4aba-ba2b-b7152924a867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626726745, "uuid": "b46de44c-d6c5-4a4e-8ba0-dc9b21ddc867", "value": "0c89a6ac4ceb310ad34dcf92ec3a77bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c879e75e-e892-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626700269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700269, "uuid": "9b3391f7-b053-4419-bdfb-defd7ac863b7", "comment": "Malware payload (Formbook)", "value": "081f5f42ff8f75d52ca942383d097028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700269, "uuid": "97d70e0c-915d-4258-b7bf-951d9d8ac0ce", "comment": "Malware payload (Formbook)", "value": "e99179189d603b5fe86e06f80326ff9716c05825a47c4c0dfecc5d9b3429d917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700269, "uuid": "669dc1f6-966e-46e7-a552-662643cde859", "comment": "Malware payload (Formbook)", "value": "8382c3a28ab790b7090f25cb5b7259638b57cb5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626700269, "uuid": "5d28aba2-6400-4547-990f-fc948c215255", "comment": "Malware payload (Formbook)", "value": "8ff86cba6f8030141128c522d9492d1a07dc57c48b00f25a10f640f8c8df67102a34555afc175b1e8a90fb0b1c8ede19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700269, "uuid": "6ff4581d-8cbc-4ae2-80ff-88dbc059bf07", "value": "T19DF4C03342490A5FC2BC10B5D0021545BAF5818BF2D3E7713EA46CD970FA76AE7E366A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700269, "uuid": "038ce642-e16d-46be-b4ab-0d2ee7b33ad4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700269, "uuid": "691dead1-3757-471d-91c3-52523305acf6", "value": "12288:w6VsSZE0i9rzDGjAtsRqUesf1zYJtYIUDhDWN1DuBXm87:VsSvi9rX+rRqZWYJtWFvBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626700269, "uuid": "0cb74461-a929-435b-882a-f0a2efdb44ee", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626700269, "uuid": "88463e8f-8010-4ed2-b021-6c32edb86690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626700269, "uuid": "d1b659bd-bd2a-4526-9458-4928f62230a1", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b347b08f-e89a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626703669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626703669, "uuid": "340db4a7-45a0-46cd-9085-ff97fbdebbdd", "comment": "Malware payload", "value": "14af10f86ce4733a02e1e74e0ef0f351", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626703669, "uuid": "b967acf7-5342-4e15-b8f1-079203501c71", "comment": "Malware payload", "value": "ea0eb7fcb776c77ee4568e3fbdc0b093fd999978e1882b6163589ed837497782", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626703669, "uuid": "513fbeaa-870f-4a23-99ed-c933536484bd", "comment": "Malware payload", "value": "b224e654fb95c297ee49b3bcfcdf6ad53a376414", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626703669, "uuid": "ca9bec64-4a25-452c-bc5c-dc9ddafbe840", "comment": "Malware payload", "value": "a0d137bcfa0af7347cac790f5ee1ac5ce6c6593bf1c1a3cf11b97018e947e3a5404738df38bec1f285d820b530517468", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626703669, "uuid": "b2109395-1299-4d15-8807-02c30a599c4c", "value": "T166F2F13DDBD03196EBDE6DBC919857929A0A71CA22D7C7CE0B13CC8CEA715573C0A660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626703669, "uuid": "81023fa8-0994-4db8-ab38-753299ab3d3c", "value": "768:c6pXYsWn6WrF37+vKDZkUQnIcElOJ9IWDjbxfw6jIWUK:5X/Wn6oF3lDtc0HQPxfHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626703669, "uuid": "e962dcd7-8db3-44c7-bb4c-78ac0516c5b1", "value": 36536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626703669, "uuid": "3baddc1c-9952-48c5-b348-c457048a91d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626703669, "uuid": "c24f4cc7-1174-4b2e-bc02-e6696924b482", "value": "popsmoke.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd1c741-e8a7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626709327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709327, "uuid": "9d6d5836-eb38-40f5-92b1-1c151d943cd8", "comment": "Malware payload", "value": "7af0bdd072b3104337f0a87c3061308b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709327, "uuid": "d114637e-a7c6-41a0-8bf4-9d9733cf6944", "comment": "Malware payload", "value": "eb649315f832bf63ea610d6fcea3078637ba3039fb6937099c7bcc616126d1db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709327, "uuid": "ac23a0cc-c353-429e-9a05-9dd3209df9bb", "comment": "Malware payload", "value": "9c402a7c042aad1de38607245ca9547a50ed1379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626709327, "uuid": "bb8ba31e-237f-4f45-ae18-629256f288ac", "comment": "Malware payload", "value": "b85fa4fafc3c14b1a76658c859b0fe0b4eece4dec87935053932822ff0093f1e3c482494162ba22e5cc9eea5858b3ba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709327, "uuid": "9d8fd3ed-15d0-4b7b-b7a1-1a40b966bc83", "value": "T14A1512321C06C886CD9B027D44B78FC86FF1557BD2954FF6AABC621ED6B77411A0A2E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709327, "uuid": "4c01e6d9-ae8d-4d5a-ace2-4f90f54696a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709327, "uuid": "58fc57e1-7719-4428-9849-b9d29e41f3f8", "value": "24576:i+MOQW87bhQxtVUz9dv7GbEvjJidAFWG/pVqG59/2cof:i+rQQxtVUpLJYQBjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626709327, "uuid": "fb4946dd-047a-40df-bfc0-c1b70deb4571", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626709327, "uuid": "1a8ee836-5e0f-4b4b-8cfe-f2c6a1505e35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626709327, "uuid": "00ad0d53-8cf4-4a18-aba9-8867127ba417", "value": "IINO - FUNDS SENT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84abfb46-e859-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626675674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675674, "uuid": "1d83791a-00e1-42a3-ad4f-5c2b4566bfda", "comment": "Malware payload (AgentTesla)", "value": "90c4957524bc706c3a2268a449517de6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675674, "uuid": "210bd834-1b27-425b-a06d-343394365ee8", "comment": "Malware payload (AgentTesla)", "value": "ecb8d56bed016172afc7ae48c9e3cf36d717fb3d0a61cac6f513fa6fe8529989", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675674, "uuid": "c08ff42a-1f1b-46be-9950-197940180f05", "comment": "Malware payload (AgentTesla)", "value": "f064c781aa15fba3ca65a5ce10e91aadab12a78e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626675674, "uuid": "befc0808-f7e8-40b4-8cc5-4c0581ef9a9a", "comment": "Malware payload (AgentTesla)", "value": "0b4261cb2106ff6f58d866cd0f7c2084e942484e4a99655afc38655961672680cb7465f6c9ace196663c03d2893500ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675674, "uuid": "fa01a487-a317-4cf5-96f5-f67005fd55ef", "value": "T161251201BB92CE2FC2446B7542E78330177ECDC16E169B57324CB25D6F32F865A823A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675674, "uuid": "3ed64bcf-4c88-474d-85a9-aee195a57dd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675674, "uuid": "ad526c21-ea64-42c0-889e-d4160e88e454", "value": "24576:zDE1yr5y2Mda/BkOhCQBMNq0h7EcrSMG3eXmp5:zg14y2MdaZkOk+MI0h7EmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626675674, "uuid": "50dfb650-bd80-4563-aa99-27532f9931dd", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626675674, "uuid": "c3945be9-ba89-479b-b177-06a8002238f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626675674, "uuid": "21c20eab-fdc6-47ff-8602-dd7502e0c607", "value": "MV. PACIFIC VISION_Vessel description.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ce8a80-e865-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626680776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680776, "uuid": "a8e83fbd-b8c5-4c7b-8de1-6fe7989d31e9", "comment": "Malware payload (Mirai)", "value": "7c57348fcc72d8b9bd84deffde3c30d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680776, "uuid": "e61583e2-c5a9-45c7-b568-016859df8626", "comment": "Malware payload (Mirai)", "value": "ecfe16343e0f1b4585a5421aedac53e4fad1548f8bf0255253faf331bc1d58a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680776, "uuid": "c455e480-4bbc-42c9-8496-bb81f0578105", "comment": "Malware payload (Mirai)", "value": "4b7061efc0e63002bf4c0d97473d4f00b3beb9ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626680776, "uuid": "c4075027-3ebd-4a16-bb38-afcb6f33d26f", "comment": "Malware payload (Mirai)", "value": "085fe9df3a1dd8fa5ee37920ba4a2d9d9a16ea6c7aa5d6338eb9990e4bdda9322592ae122252bb00d7a6f38ffd4290eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680776, "uuid": "f885f74a-51b4-4ccf-9f89-f32d1e5ad3ca", "value": "T1A5635B89B8024E3DF98BE5B954160E05B9302390AAE30B2767AFFDD37D73168F912D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680776, "uuid": "480156ef-1168-4032-af5a-d9eb6f42355e", "value": "768:Ue636Hs6RvdlL/Bchr1N4Nnd8uQ/utgFHm+XuD8A8vRv67wyDJfXzeKJozVoC:UPCBchxCu3Fm++D8A22wyDJfDeKmoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626680776, "uuid": "653f0b27-1b71-478b-8167-7ba528e2b130", "value": 71316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626680776, "uuid": "5160df04-8db9-4c28-9e8a-a1252667a57f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626680776, "uuid": "7e0fece6-bd6f-4b29-9fcc-d5e7f0746794", "value": "7c57348fcc72d8b9bd84deffde3c30d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cab462-e880-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626692513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692513, "uuid": "d7faa799-1a3e-4ba8-b579-95abdd0aeccb", "comment": "Malware payload", "value": "7e19235ca4a6192bdace52baa0a40d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692513, "uuid": "214f950f-e8f0-4269-a6e0-e4c596d32887", "comment": "Malware payload", "value": "ed762437d06ffae4d27baec39379997d8acf7ae6e6e758611793f3fb2fafcee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692513, "uuid": "7a72268a-77eb-46c7-a9fa-cf5d137f74ae", "comment": "Malware payload", "value": "1ac8aa96052b0da4f7d1072ca8fee01ade2e9f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626692513, "uuid": "61ff7216-7266-4b9a-8f19-008eaa4aba0e", "comment": "Malware payload", "value": "bbac392e971f71287d6f932fc65f1206cd7807f97191e0f7418a6050e234130bfc9475146886b1f74fc73e4339b7aff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626692513, "uuid": "ee645388-4515-4483-a604-c64486c0f66a", "value": "T1CAE4F1A9723BE20CEC748BF92C69D1A267BB6429621DC63C1E48D07DBD7337C26D0552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626692513, "uuid": "ab309766-edc2-4348-9a59-6101ef561618", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626692513, "uuid": "5c11e830-2ffc-433a-bd13-a4aae460c35d", "value": "12288:l3MyvUIZbVWX7Q6cgNMuAx206pm2MGydGcHazvuHw3ItoaI43JYLh2ADli:5TvDBW3cEaeMGpcHazv0tV/OLh2ADl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626692513, "uuid": "3ffb2bc2-22a1-4cfe-8b32-53a6338e6d8c", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626692513, "uuid": "017760ed-e37f-4ee0-aae9-4d2ebd17091c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626692513, "uuid": "9119dbad-061b-409c-a222-9049152c9e17", "value": "87597.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35f479c-e877-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626688744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688744, "uuid": "76987356-7ef8-4e50-b27c-181433e30244", "comment": "Malware payload", "value": "27794f3e2ea722ba2bbf7dcbc17dd1af", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688744, "uuid": "ac9b758c-0664-4636-80a1-65e98553daaf", "comment": "Malware payload", "value": "ef3f54f062d22eda5ca51e346b71661827e9880f31862c29d21bb803b4c25089", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688744, "uuid": "bef8b892-ede0-4c3b-b391-2230cdc6d734", "comment": "Malware payload", "value": "8cb029f76b11e8938034fb6681b073ba4896e9aa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626688744, "uuid": "c8425b72-c32d-4c22-b5ab-c378d56246b1", "comment": "Malware payload", "value": "79c7226efc84c0b5baa6f7c366691affb2ab5a2108f254a1e02e765840555111457a54d7ce6f0cecfd1990bdeb18c9b7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688744, "uuid": "2ac5d15b-b68d-4c68-bfe6-b9a1238a75a4", "value": "T100228D2CD649A90BC266087DD05A81FAF32C6017B243F96B611673CC4BA07C387DA1FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688744, "uuid": "332dc957-8a0c-4702-afa4-4e641f97edd0", "value": "192:ScIMmtPVG/bD1YafOOjgb5SEzBC4vNqW603yp:SPX4D1YLOjKhlqaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626688744, "uuid": "cbdda078-2e01-410c-a98f-a6989336840b", "value": 10327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626688744, "uuid": "29729523-e087-4807-9275-3cf80ad770cc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626688744, "uuid": "0bb9e213-0c46-40cf-8f6b-55b81d04cff1", "value": "Invoice-Scancopy.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e485e4e6-e86d-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626684424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684424, "uuid": "9114f1c4-0d16-460b-aad2-31f76e53a710", "comment": "Malware payload (CryptBot)", "value": "e3a6c49bfc77fe0bd389fc9a0d2d8157", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684424, "uuid": "a55a79af-fddb-4580-b588-0442d40a234e", "comment": "Malware payload (CryptBot)", "value": "f17b1b65d255f0dc1cecdb50f258d63510dada450a7ccc8cecc7deda2715a7d8", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684424, "uuid": "ff2c2554-74f1-445f-a929-cbdf8e811525", "comment": "Malware payload (CryptBot)", "value": "9bef96a2abd661d6a6dab3fcc3030642406e2703", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626684424, "uuid": "c6908dd8-8887-41c2-a466-0622d117bafb", "comment": "Malware payload (CryptBot)", "value": "e20b9861fc10b87609bfe7000e1bdf5612597f59384bda6c0d557e3a6840793121feddcb69a4d7ebd4029858a8306a41", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684424, "uuid": "fb350b77-1bd5-471f-9ca6-5b513cc5ce8c", "value": "T12BE4012072B1C433E1F609706470C3A51A7ABD262964B58B77A73F0F2E312D1BA76797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684424, "uuid": "24178276-c21a-4e1a-9953-779da95187d2", "value": "4c2cb70eaa36e2f27e3da0ec1f2cb347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684424, "uuid": "5e7bfb2c-bbbe-4e6d-a271-b51e5a447b73", "value": "12288:Jpvh4HAE6HZ7J0Tyhr9te9igfmtvYgK7KkISi3NlBJ:HvOaHZd0TyB9U9iTvYgKf6NlBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626684424, "uuid": "bf555b2d-a2f1-4605-ae7f-f20392f272eb", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626684424, "uuid": "947d092a-4f09-4d12-bda3-c11cc82fcff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626684424, "uuid": "73e48cca-16b7-43f7-a7f5-4dba38f6af25", "value": "e3a6c49bfc77fe0bd389fc9a0d2d8157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ac052e-e8af-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626712392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712392, "uuid": "ecb20704-d961-4e9b-85a5-459d88531ba4", "comment": "Malware payload (CryptBot)", "value": "4b475a6d16ac0c8cc332710648807d1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712392, "uuid": "53e5c55e-f47f-427d-9034-4a61166ee6fd", "comment": "Malware payload (CryptBot)", "value": "f295dc94dd07fb071024ec4e90382aa1cb3a4f9f307d4e2bd3848b4b96663b3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712392, "uuid": "f5585dcc-0e00-4481-a0e6-18707267e162", "comment": "Malware payload (CryptBot)", "value": "7e5f5765593907f62f4436e82de84274ba8f6ee2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626712392, "uuid": "4ea2216f-c6c2-4c19-ab24-bb1a6be02391", "comment": "Malware payload (CryptBot)", "value": "fbf49749403a2dc378a3c13cb786c64188fd46d272cae494183652462e7700e39bbc3a9936cc23adb7cb650f4d6cbc4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712392, "uuid": "d5ac1fa5-16f0-439e-9099-869dbaf8dad1", "value": "T1DDD4122036B2D031E5B2563188F5CA915A3F7D621874868F36947BDF2DB22D22B7E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712392, "uuid": "a9a5faf1-9c86-42d2-ae34-f73ee4aba737", "value": "d0200a61185e5e47748a9fc60359c3ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712392, "uuid": "0d6dd61a-3f14-44bb-a6f6-c5017d02ca2a", "value": "12288:DnpQ9riKsE5BVsCx2sqUxVJySqEeP2iolnpFWxcQsMxOvzERS2RtK9rCy:Dn5KsE5Baw2U/JySqrMpFBj/2C9ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626712392, "uuid": "6a12595c-0008-4742-815c-383bf8c7a5fa", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626712392, "uuid": "fa28d8fc-7751-44c4-bbe8-d7381154bcac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626712392, "uuid": "9fdbd24c-458d-41ce-b1cc-c9230bb4e1a9", "value": "4b475a6d16ac0c8cc332710648807d1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e77d795-e8b7-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626716036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716036, "uuid": "7c4e72d0-cd7b-4a02-842c-6d0f9cb5b43e", "comment": "Malware payload (AveMariaRAT)", "value": "35c9dcf7c4a922996d01cd1172e5ee72", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716036, "uuid": "8bdce560-b181-43cc-b336-4b1e7d22e4d6", "comment": "Malware payload (AveMariaRAT)", "value": "f415487e104efb2d80000858f7942cd9db73526601066eca5e63d99a50926298", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716036, "uuid": "afd48840-dc8f-4112-80c1-5d761d344072", "comment": "Malware payload (AveMariaRAT)", "value": "f04b7261c7209fbca4a6ca7b64d52b24fb0a0bef", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626716036, "uuid": "64665111-90c9-4efd-a26b-2115450db489", "comment": "Malware payload (AveMariaRAT)", "value": "a7b27968f93f104272113a4eede5acbdecca9ddc2fd987f17b8d43f31ebb49f75807a7903b908be75870122d63abfaa3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716036, "uuid": "464ea44b-9acf-4686-a628-c82beca196a0", "value": "T1E9356AD441CB1AF3F1CD3A541A50F04E572AA64E50914C6A2B2D9FE4BF093FB5F8829B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716036, "uuid": "8618c8f2-6f6c-4f1a-b7d5-ae0df56ce923", "value": "12288:pc+NeyoDJLR7mWZ2b7B/u43mWZsdzFZRsUj:URsUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626716036, "uuid": "a64c044e-5e92-449e-a654-050363bb2253", "value": 1067566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626716036, "uuid": "deeb8f1e-e73f-49f3-8e77-8fca35d0afb2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626716036, "uuid": "ff5eed26-ee02-4e37-b3c1-e66aaf41d7d3", "value": "PO for ART IMPEX GROUP LLP.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943af83a-e8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626735829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735829, "uuid": "bc0f599c-6af6-4cdf-b494-fc0cfc3e21aa", "comment": "Malware payload (Mirai)", "value": "5479f4b94bef77ec37a189dafa2b4fd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735829, "uuid": "bd618d3b-fe11-4604-bef4-4a905206e66f", "comment": "Malware payload (Mirai)", "value": "f4cdc3634c2a925310304ba72073a144ae547b24d569a84b56ad2262ade00b35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735829, "uuid": "198ea595-754a-48b7-a7d8-f688813e4ca4", "comment": "Malware payload (Mirai)", "value": "cb568424d451febb6b737c26f8f27eff2de9a554", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626735829, "uuid": "0ab4b4f5-7a6c-4c3e-b9e2-33c1f6b80d56", "comment": "Malware payload (Mirai)", "value": "0b7cdb89e7280df98b9c0d3b31d118ac1a10f1f30a20a38106b7bb92028d44967268a23588c0e75fce8c669410289f20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735829, "uuid": "214962e5-f988-4233-9b6b-6b863c5a4565", "value": "T195332942B22C094BF9E65AB0353F0FE093BFE94024E4B585695EEA458136F331586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735829, "uuid": "047a45e9-221a-465b-b9b2-0625e17712b1", "value": "768:/KfsbnHAt1ezbnAgCN7RkIV3fgB1TRNRR7Eg3tbv6VFssuWXwdyvq:k6HAt1ezbnAXZUBt33tbC/3Xw6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626735829, "uuid": "d9aff94c-6b39-4c59-bc0d-deb03ada4d91", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626735829, "uuid": "e9bbc4fb-f7c6-4984-94f4-569a2adef723", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626735829, "uuid": "9e05f925-c1ae-49d3-9c7b-2d0ddb871d67", "value": "5479f4b94bef77ec37a189dafa2b4fd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc302e7-e85e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626677783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626677783, "uuid": "2be5d5e0-82df-4940-a7ea-e606340ef47d", "comment": "Malware payload (AgentTesla)", "value": "e09cedff281ffabeea998c023fd1452a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626677783, "uuid": "2b61365e-c1bb-48ff-93e0-ed12c6f6f044", "comment": "Malware payload (AgentTesla)", "value": "f4eda49ca8e4098cd24842ef3b8c0ac249e10fd106c8c59815a3af3b1bf96778", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626677783, "uuid": "16c7fd85-4ab0-4bb9-b452-db911237c742", "comment": "Malware payload (AgentTesla)", "value": "6a796969b864595831de75385d43e408192e613d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626677783, "uuid": "81fe5f4f-617e-4fe3-8e33-53dd7a24e949", "comment": "Malware payload (AgentTesla)", "value": "a5042f0827a00e005f743eb38501e5aa6ac00cdf29fe005cf7ce6b2f2bde8e7bdce2a91d51c0a1259c3f4b28d9b847cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626677783, "uuid": "bdbf6fc1-ffcb-421c-a96e-907d12ff7510", "value": "T17E25F1263227A214DC3987F41C65C1B12BBEAC2A572DC27C2EC4AD7F7D726BC5AD0590", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626677783, "uuid": "2b6aa78c-34b0-4b7a-8f2e-7c281f206c8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626677783, "uuid": "d1af642c-4381-413a-b688-4da92123c053", "value": "12288:cw8/ZJyvUIZbVlBPI2VBPy4dux7zWLOvQELHSTMSJSg6+7ZtA3gJDBRIQJ:/xvDBlBPIOBPy4dIUOoEDdg6+7wQBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626677783, "uuid": "bdbf5eec-0f2c-481a-840b-5fed5dd4250c", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626677783, "uuid": "5fa87124-221e-46cb-b83d-09d1959a7689", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626677783, "uuid": "02466690-f9bf-4c0f-b2dd-647041a212f7", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DZG.genEldorado.2340.23025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92e542b-e8e6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626736321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626736321, "uuid": "d45ba95a-7c6d-4e49-a355-3a88012494fb", "comment": "Malware payload (Mirai)", "value": "3c8d22bd1096194d1be193fafe929934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626736321, "uuid": "b265ae4d-b86b-47ea-8ccb-3016e6125a72", "comment": "Malware payload (Mirai)", "value": "f60e823cbdfe369215b25bef122f3952178bd86fba84d017a112697d5250f566", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626736321, "uuid": "8b311b31-3eff-40f1-8489-a3973625739f", "comment": "Malware payload (Mirai)", "value": "120b4f5ff6b027538590ddfe520049f96dd1809b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626736321, "uuid": "6aa3f312-c3df-40ea-b900-5bd5923631e6", "comment": "Malware payload (Mirai)", "value": "a30ffb067f52baff02db23fb4a999a4ffbb9f9263f1553f5c4d01c164b8594c4c5a889b958331ce784c7d57acac5b84e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626736321, "uuid": "a0ebb366-6862-4d82-a6c8-3b80a55323ef", "value": "T16F432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626736321, "uuid": "9635b36c-bdb5-4dc4-a98b-d2ece31935e1", "value": "768:TXon00+q9wp3C+vactfa1sDHHYAzsv6WswWSHoXdss63B/9JO+zC3R:TXw00+SY3CaactfI6Hvzsv6vwcGJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626736321, "uuid": "431459ae-2dbe-4d47-8981-28ca4914ef83", "value": 60116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626736321, "uuid": "12fc09b1-13de-455c-9db7-b3d5af8995ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626736321, "uuid": "bf30845b-f08e-4997-85a6-1fee5a0ab241", "value": "3c8d22bd1096194d1be193fafe929934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669b2acc-e889-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626696239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696239, "uuid": "1918f229-72f6-4a8d-a27c-cc52e972abd4", "comment": "Malware payload (Mirai)", "value": "e4c7c13f32e453dc9620e497cde9bc7b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696239, "uuid": "72ab6af5-00e0-4684-9696-c5158f757591", "comment": "Malware payload (Mirai)", "value": "f7a1b45aaf907b258dbefb4603495f2cba60ca2251effc728559709cef7624e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696239, "uuid": "ddcb1e92-9a56-4879-84f3-ba8571198e1a", "comment": "Malware payload (Mirai)", "value": "d263d6ff5d3d21c584fd3d42848a2e6b142d7180", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626696239, "uuid": "06739f69-3d57-4ed2-b181-d2f9b4efe8fe", "comment": "Malware payload (Mirai)", "value": "d976d3d30434ff3ed486128506b7dc6d7f86a104b60cd3552223d57b4c5b4f4a09006f7841fac70980b593c50702b8ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696239, "uuid": "f8552dda-0c1a-4174-91e7-4ab6c1446650", "value": "T1AC6412ABD8B7BD8EFE1B0FF525970E4E0EFDE2DAD1C16C94551900802AF93426594BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696239, "uuid": "15d15f8b-56bc-4bc9-a0da-cb3775283d2c", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626696239, "uuid": "ccfa2c10-3b8e-46e1-8a08-6f434404e8ad", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626696239, "uuid": "5fd4bd76-ac10-446d-b593-7aba64266a59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626696239, "uuid": "5d16369b-0c8b-4b37-9044-22adf5c32a18", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e32d71-e835-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626660024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660024, "uuid": "50a77fbd-a50c-4c73-8cbf-4ffad9eb2b4f", "comment": "Malware payload (Gafgyt)", "value": "95e0e58e94fef6e58692d26c30024690", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660024, "uuid": "309f7ab2-678e-41c5-869a-dfe358a91c3f", "comment": "Malware payload (Gafgyt)", "value": "f88ac02d07305cee61bcf4bc0276c7c73cc998734c7372de72015f95a0bafc2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660024, "uuid": "e224b1d1-8c13-4141-8bfb-0683e10610db", "comment": "Malware payload (Gafgyt)", "value": "fe952838aa2e009f244e8ed6189bcc207d4c5865", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626660024, "uuid": "624d8586-1c50-4bcd-ab2f-968243a701e0", "comment": "Malware payload (Gafgyt)", "value": "daed03964bd6aead67f408e6dbb613ca8bc0bedf833dcfa178466a9090c5c02c9fc5633cc918252aa0f19b16e228cab7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660024, "uuid": "02c6dba9-c9f9-482b-b6c8-5f62f3f97a91", "value": "T164B30877A4555FB3C04165F125BA99310F13AD931F1F1A886638BAB04B3B4CEB88EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660024, "uuid": "8a404683-063c-4274-9ddf-0e842e813ad2", "value": "3072:OBjTanyiQXPo6O8m1N+A3BnHuTldWZJwafKLtBmH1cuEgvniuN/:OBjGy8HAEKLtBmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626660024, "uuid": "f86c536f-a65c-4df9-904b-5f90414532bf", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626660024, "uuid": "eca3afb5-2c71-44d0-b73e-87a9ce87323e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626660024, "uuid": "56bcff53-28f3-4af9-b11a-7f37c58d64cd", "value": "95e0e58e94fef6e58692d26c30024690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cde87ac-e857-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626674748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674748, "uuid": "5670a2ef-76a2-466d-a5f9-1922e5fd139c", "comment": "Malware payload", "value": "d6922e1f5a3d4dddb4ebc3504ca00adc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674748, "uuid": "388c427f-5c35-475b-b13e-1794e563a4da", "comment": "Malware payload", "value": "fcccd136fbbfdfdf821ca253865afe70d1af86c41191cc9e9ee3fb8be32111b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674748, "uuid": "9b6b7ab5-9114-4ac8-8fb5-af144b2ed830", "comment": "Malware payload", "value": "6695a91406ff76aa1810126131e038932d47ba93", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626674748, "uuid": "4be8ebe4-95ad-4e46-87ef-c27a8a73aea4", "comment": "Malware payload", "value": "c4f5cff1fef04c947ba34749547c6e284ba2792cb1fe16a19a5cd1da127d57dea7bb32e1519c3f3a40e93ee7c65ef604", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674748, "uuid": "17fd0759-20ab-4683-8eaf-456e44f14fd9", "value": "T10C6412ABD8B67D9EFE1B0FF525870E1E0EFDE2DAD1C16C94452900802AF93426594BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674748, "uuid": "7a2528d6-d748-4719-8eb8-3e055d541ba9", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626674748, "uuid": "88242f90-0800-4eca-b05a-ded21506071f", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626674748, "uuid": "8cc23717-8ab1-4e40-bc55-8a0e0f2b0b46", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626674748, "uuid": "88bfc66d-7ce5-4856-b173-f680843b30ae", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764e7757-e85a-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1626676079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626676079, "uuid": "336b5fc1-0361-4786-8c8d-3fee6aa8e673", "comment": "Malware payload (BazaLoader)", "value": "ea3612919bf05b66e9a608bee742a422", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626676079, "uuid": "174185e4-d20d-43aa-89a3-6bd4e082daf7", "comment": "Malware payload (BazaLoader)", "value": "fd001fb71e9faa68c6e53162ed0554fd6f16a0e381aa280cea397b3d74bb62eb", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626676079, "uuid": "c3493f09-5c3f-4eaf-86ec-2b9a81de2921", "comment": "Malware payload (BazaLoader)", "value": "032747a1658fea7f8d624c11ae965f3218f96909", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626676079, "uuid": "91dce7d2-3da4-4ff4-9454-355b48a80117", "comment": "Malware payload (BazaLoader)", "value": "8452e05fa69bf81ebfe7d31a8cb69852ecd733f27fbdb32f9868338083ce8b7194509b72bf7d8fece8e24f090c044210", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626676079, "uuid": "2d8ea9a0-b56a-4c59-97d3-a19454cea8cb", "value": "T196E36BAAA8450134DFFE47F48C766DDEF67462AA3B00350E523DB9F41A2277EE806512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626676079, "uuid": "992d6cc9-5d40-4e09-9eaa-cd792b13091e", "value": "3072:z3t152lkhgRRfIrJ1OrEbr1OmtC2aRzQc+MrxOf3mECQgV1hzoWhHl/5hH8JUR:TkehAI9YrEP1OP2aREMrVHQEHzl/HH8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626676079, "uuid": "e59b3475-e931-4f2e-aa89-3ee807a289ae", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626676079, "uuid": "73b14f57-f74f-42c0-a5e7-35ea713a9676", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626676079, "uuid": "338f87c1-655c-46af-ad32-2262f1f0d8db", "value": "ea3612919bf05b66e9a608bee742a422.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae406b0-e891-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626699924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699924, "uuid": "555804f7-42fc-4e3a-892c-cb93c7ce9d87", "comment": "Malware payload", "value": "a4bd709d2da4d231ecbeca29fa852bdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699924, "uuid": "f25e5a02-0e22-49d7-9904-55ee098e950a", "comment": "Malware payload", "value": "ff03a31c53b6e540bb918372dbc2a0213e5020273c6c46fdb2ef5f86ec7a0397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699924, "uuid": "a9555c97-4996-4d58-8658-708c1edb89fd", "comment": "Malware payload", "value": "4cad398255d98302db4bff95ef837a8adef11472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626699924, "uuid": "3d297536-e828-4b37-b20a-419d2ec59c4f", "comment": "Malware payload", "value": "b47e3b80424a3ab73fb658da559a65040f86c91d567add7c7398fc65f214464456a72bcc301f4c19384562bdb0b4d46a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699924, "uuid": "85f2d39d-f008-488c-a293-a275ce584d0e", "value": "T185566CF2B1E1219BC01BE0B9C1D0B86FAB6FF4765A08F15B959239765F07C81B42DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699924, "uuid": "7d5ebc0c-65da-44d1-b33b-2cdf69d63fe4", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699924, "uuid": "567e55de-5c1b-49a7-aa64-4db6b416d5dc", "value": "98304:DUt78cpCVGPPBz0rq55UojuA1+dSmymekplqWf+AFM/5ycyQxhB3G:DUtocbRBn1+dSmysGA6wcXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626699924, "uuid": "f1b1691b-38cb-49ec-be0b-46d2c303974a", "value": 6208232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626699924, "uuid": "c1337a80-e2ca-4261-aa5d-aa1f1f36d57b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626699924, "uuid": "d1fa0c5f-61e3-4c74-8d07-25c1ee8adbe2", "value": "a4bd709d2da4d231ecbeca29fa852bdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8b8df3-e8a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626707310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707310, "uuid": "fdbb043c-e9c0-4209-9f6b-2ce730130ce2", "comment": "Malware payload (Formbook)", "value": "65cb21f74729427dcb7ddb1bb8cb762f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707310, "uuid": "258af3e5-d52a-48a6-a911-694f92d6f9a8", "comment": "Malware payload (Formbook)", "value": "ffdce32ce2f9c0f99abb5cff3602bcc02f3ceb4933d145fe02f650244b513a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707310, "uuid": "e8b185c4-cbe7-4698-9271-d72f0e20f042", "comment": "Malware payload (Formbook)", "value": "56953fa95c04051b3bcb7c3ace9e993d6586fb29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626707310, "uuid": "dbebd2c2-c430-400b-b9a7-86e2b2989a68", "comment": "Malware payload (Formbook)", "value": "c3ac878781a8af2633eab29d97a7b0d8f2e5d464e001247f90b54c8751cf457a8efa28cba145e034be41e001c443cb99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707310, "uuid": "900fa134-860a-4c0d-9657-a2e419ea7912", "value": "T10A0512310860F8D1DE6F463C54F75FC66FE222B3D2548EFA42AC506DEA93F80865A5E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707310, "uuid": "661c8cee-1e7e-41d6-b646-4b2928063baa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707310, "uuid": "a99512e7-32c1-4dab-b36c-b46f5befd590", "value": "12288:R+MO8FsF87bhQxUKKKVxempYqoFGb3yWbgko4t3PgPMlkwIdd0yNXzgEu7ax:R+MOQW87bhQxtVUkDg+FYUkwed00XMLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626707310, "uuid": "acc7a52c-5b19-4f53-a445-84ebff023675", "value": 832440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626707310, "uuid": "b335cd4c-f972-404f-a611-c7483925e20d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626707310, "uuid": "c022da07-6f11-4666-a96c-6b55e731f309", "value": "quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61f442a-e8a6-11eb-875b-42010a9c0053", "comment": "Malware payload (Cryptbot)", "timestamp": 1626708828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708828, "uuid": "4058f142-7d36-48d2-907f-1529cc14b0fd", "comment": "Malware payload (Cryptbot)", "value": "abc1460749be77c32d1d942166db6f57", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708828, "uuid": "5e6a3176-2c2e-4fc4-8be3-27768a8f3a71", "comment": "Malware payload (Cryptbot)", "value": "ffe5b10cd81f4c1484f62863be69ea28732b8e765b12569c5cd11b463bd4d261", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708828, "uuid": "d67d1e19-0ee1-4df0-b81d-ad5a18f06306", "comment": "Malware payload (Cryptbot)", "value": "b7cb5dfb5960cefb3303de39c3946c67a381ca14", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626708828, "uuid": "e0315074-0ed5-4fb0-bd1b-cf6b7775b214", "comment": "Malware payload (Cryptbot)", "value": "00cc4c7ea3566890122a1ef79e657398e42b5a9ed9a62e5b893cb1d735fc4cc119f8dd97f5e310983c0b4107221fd879", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708828, "uuid": "4cac4b1b-6e93-443b-bc71-a25fede77342", "value": "T19D85892DE0A3B429C18FF0F1751EE7245494AE5F07A0C1C6736DFF4AE9EC681892527A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708828, "uuid": "36bd0a89-c4b8-430d-95a1-238e69039b63", "value": "bf6171d5e900bf93e668170d1a189f34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708828, "uuid": "d1bd1821-2a5e-4dda-bcc9-7a563641aab1", "value": "49152:mIXQUKY6L6MRZEyhGhKWP6YAbHinesLH8pyU1:mI9QLPCyBWyYCOR8oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626708828, "uuid": "23091454-c055-4868-9bdd-59c6514f061c", "value": 1804725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626708828, "uuid": "2615fc5c-fdbe-4c86-9988-97ef5bb97876", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626708828, "uuid": "ae5ab02b-28c7-4200-8770-c2062ae3fd60", "value": "abc1460749be77c32d1d942166db6f57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }